Cutting through the noise

The surge in cyber-attacks targeting leading UK retailers over the past year underscores an urgent need for robust triage processes. With vast stores of personal and financial data, retailers remain among the most attractive targets for threat actors—making proactive risk management a strategic imperative.

 

Retailers today operate in an environment defined by complexity. Multi-vendor ecosystems and legacy infrastructure have significantly widened the attack surface, creating vulnerabilities that cyber-criminals are eager to exploit. At the same time, the pace of digital transformation—from e-commerce platforms to interconnected supply chains—has introduced new layers of risk. Threats are not only more sophisticated but also harder to detect, often hiding in plain sight within sprawling technology stacks.

 

For security leaders, the challenge isn’t just about defending against attacks; it’s about cutting through the noise. With countless alerts and overlapping systems, prioritisation becomes mission-critical. The ability to identify, assess, and act on vulnerabilities in real time is no longer optional—it’s a strategic necessity. Those who succeed will not only protect their organisations but also build resilience and trust in an increasingly digital retail landscape.

 

Context is everything

Attackers are leveraging new capabilities to deploy multi-stage tactics, such as privilege escalation and lateral movement, often mimicking routine administrative actions. For security teams, no single event signals compromise. Instead, by correlating multiple threat indicators, analysts can reveal malicious patterns, prioritise action and safeguard retailers. Correlating anomalous behaviour, such as suspicious logins and unexpected API calls, can help formulate threat narratives and is the backbone of effective threat triage.

 

Recent Fortinet research has shown that retail organisations are one of the most targeted sectors for ransomware, illustrating the pressure security teams face in distinguishing genuine compromise from background noise.

 

Protecting retailers requires clear, time-ordered views of incidents showing who was involved, what occurred and when. The retail industry, perhaps more so than many others, relies on a sprawling network of supply chain dependencies, often operating in multiple geographic markets both online and in-person. In such distributed environments, visibility gaps are common and incident response across the sector is slowed as a result.

 

Creating these observation timelines is, therefore, made that much harder. But getting them right can help analysts and the wider security team cut through noise and focus on credible risks. Establishing a unified view of data from endpoints, applications and networks can make this process faster and more reliable without adding operational complexity. This can reduce the time taken to triage potential threat incidents, allowing retail security teams to focus on the most pressing cases and prevent disruption.

 

The dual role of AI

AI is now one of the primary drivers of both cyber-attack and defence. With AI capabilities broadening threat vectors, leveraging these same capabilities to triage risks effectively is vital.

 

Behavioural analytics and automation can allow retailers to identify irregular activity before damage occurs, helping focus resources on the most urgent threats. Balancing the amount of important information being made available to security teams while still maintaining thorough enough oversight to filter, sort and tier malicious activity is a key challenge facing teams tasked with protecting the industry.

 

Automation, guided by AI, acts as the first line of triage. It can collect and correlate threat data, prioritise alerts by risk and even initiate predefined containment steps. This frees teams to investigate higher-value incidents. Beyond immediate impact, deploying technology to support with triaging can also help prevent burnout and fatigue in security teams.

 

Turning data into decisions

When it comes to triaging threats, it’s all about turning signals into insight. Retailers which contextualise multiple alerts and leverage new capabilities to lay the groundwork for in-depth observation timelines can identify threats and act early.

 

This past year, retailers have been very much on the frontline. With the volume of threats facing the industry so high, the challenge is not a lack of information, but the ability to translate vast amounts of security telemetry into actionable intelligence. With retail security teams receiving millions of alerts daily across systems yet, only a fraction requiring real attention, adopting an intelligence-driven approach is crucial.

 

---

 

Jonathan Brooks is UK Sales Director at Fortinet

 

Main image courtesy of iStockPhoto.com and Blue Planet Studio