As artificial intelligence (AI) becomes further embedded in how consumers shop and pay, it is also creating new challenges for businesses trying to keep transactions secure. Mastercard has recently announced new capabilities that allow AI agents to make purchases on consumers’ behalf, while the UK government has set out ambitions for the UK to lead on safe agentic payments.
As the path to purchase becomes increasingly automated, retailers and payment providers will need to rethink how they identify and authenticate transactions that may no longer be initiated by a human.
The challenge comes into sharper focus as we approach Black Friday and the busy festive shopping period, when transaction volumes and therefore opportunities for cybercriminals increase. This Cybersecurity Awareness Month, industry experts share their perspectives on what businesses can do to ensure security keeps pace with evolving consumer payment preferences.[AB1]
The new cyber threats emerging for retailers
As AI agents are increasingly granted access to payment details and personal data, secure payments, strong authentication and clear customer controls need to be part of the picture now more than ever.
“Recent research from Rubrik found that only 28% of IT and security leaders believe they could fully recover from a cyber incident within 12 hours, down from 43% the year before, a fall in confidence arriving precisely when the sector can least afford it,” says Richard Cassidy, EMEA CISO at Rubrik.
“Cybersecurity Awareness Month is the moment to do the unglamorous work: decide which systems the business cannot trade without, agree which of them get restored first, and confirm where the clean recovery points actually sit. Mid-crisis decisions are rarely good ones, and having seen enough incident rooms, we know preparation makes all the difference.”
As threats grow, research from Babble reveals a significant gap between the retail sector’s confidence in its ability to recover from a cyber-attack – with 77% of organisations assured they can recover from one – and the reality, with only 52% reporting that they have embedded cybersecurity technology well. [MC2]
“This gap between perceived and actual cyber preparedness matters when attacks are becoming faster and more sophisticated,” says Mark Weait, Chief Revenue Officer at Babble.
“As the busy shopping period approaches, the most resilient retailers will be those that treat security as a board-level business risk requiring clear accountability and continuous oversight.”
Protecting AI-powered transactions
Businesses need clear accountability around what AI agents can access and spend, so consumers can trust agents to make purchases on their behalf.
“Cybersecurity Awareness Month is a chance for retailers to build that reassurance into every interaction. Companies must have messages easy to recognise, explain why information is needed and give customers a clear route to a person when something doesn’t look right. That way consumers can shop with ease, knowing they are secure at every stage of the buying journey,” says Robert Gerstmann, Co-Founder and Chief Evangelist at Sinch.
For Darryl Jones, Vice President of Consumer Segment Strategy at Ping Identity, identity is the ultimate key to securing consumer trust.
“Businesses need to embrace technologies like biometric authentication and verifiable credentials that allow consumers to securely prove who they are while helping retailers establish trust at every interaction. Putting identity at the centre of digital commerce can help reduce fraud without sacrificing the seamless experiences consumers expect. Cybersecurity Awareness Month is a reminder that building trust isn’t just an October priority. It’s fundamental to creating a safer digital economy for the years and generations ahead.”
For Manish Vrishaketu, COO at Tipalti, paying a growing network of sellers across multiple jurisdictions and in multiple currencies can be where trust falters, especially heading into the Golden Quarter.
“Fraud is already front of mind for business and finance leaders heading into this period. Tipalti’s global research found that 58% of UK finance professionals say it’s a growing concern. Retailers need confidence in both who they’re paying and how quickly they can pay them. Automated seller screening, real-time flagging of unusual payout activity, and validating changes to payment details before funds move – these aren’t just fraud controls, they’re what allows legitimate payments to keep flowing without interruption.”
That means fraud prevention needs to be built into the payment process from the outset, rather than treated as a safeguard once something has already gone wrong. “Security cannot depend on being surprised after something goes wrong,” adds Dan Holden, CISO at Commerce. [AB3]
“Privacy, security, third-party risk, and AI governance are all moving toward the same requirement: companies must understand and control the technologies operating on their behalf. As humans, partners, platforms, automations, and AI agents become more deeply connected, more autonomy and connectivity cannot mean less visibility or control.”
Strengthening retail cyber resilience
A continuous process of monitoring, and testing with consistent human oversight can help retailers, particularly SMEs, keep pace with emerging threats.
“Unclear guidance on approved AI tools forges fertile ground for shadow AI to thrive, creating security and privacy risks that businesses can’t see. Meanwhile, giving an agent purchasing access without its own clear guardrails adds yet more risk,” says Jacopo Santaiti, Cyber Security Manager, Soldo.
“Employees need a straightforward route to approved tools. Businesses should set spending limits and permissions in advance, require human approval for higher-risk purchases, and link expenses to traceable payments. That gives teams the flexibility to use AI while helping finance and security spot problems before they grow.”
Building security into the next generation of AI-powered research
As retailers prepare for another busy festive season, cybersecurity must be treated as an ongoing business priority rather than a seasonal exercise. AI may be changing how consumers shop and how businesses operate, but the fundamentals remain the same: understand where the risks sit, ensure clear controls are in place, and that human oversight is present where it matters.
“Today, 82% of organisations carry vulnerabilities that have remained unsolved for more than a year. Like financial debt, delaying action only increases the potential cost. The next phase of software security is building trust by proving security posture: embedding security in development, prioritising critical risks and showing vulnerabilities are remediated before they compound,” says John Smith, CTO EMEA at Veracode.
As AI takes on more responsibility across the retail journey, the businesses which build security into automation from the outset will be better placed to protect both their costumers and their bottom line. The organisations which fail to prioritise security face losing consumer trust, as well as compromising their own systems. [AB4]
[AB1]Something like evolving consumer payment preferences? Can def do better than what I’ve just said haha but you get the gist
[MC2]can we please double check this against the comment that was submitted and make sure we don’t change the wording: “SMBs in the UK retail sector appear confident in their cyber resilience. According to our research, 75% believe they can identify a cyber attack and 77% assured that they can recover from one.
But that confidence is running ahead of capability, with only half (52%) agreeing that they have embedded cyber security technology well and only 47% using AI and automation to strengthen their defences.
This gap between perceived and actual cyber preparedness matters when attacks are becoming faster and more sophisticated. As the busy shopping period approaches, the most resilient retailers will be those that treat security as a board-level business risk requiring clear accountability and continuous oversight. Its time to move beyond simply buying tools: SMEs needs to be continuous monitoring, active threat management, trained employees and clear accountability at the top.”
[AB3]Let’s just do a sentence bridging into this comment – doesn’t have to be long otherwise reads a bit like quote after quote
[AB4]Left the same comment for Wilby and you do touch on it here but let’s just make it really clear in the final part of the conclusion that security is imperative for maintaining consumer trust, and driving sales. It’s a big ‘or else’ for retailers if they don’t get their security ducks in a row.
