Beyond the login: Establishing an identity control plane in UKI retail

A till goes down on a Saturday afternoon. A warehouse can't dispatch orders. A supplier portal locks out the logistics team during a peak trading week. When you trace these incidents back, you rarely find a broken firewall. You find a compromised identity.

That's the shift facing U.K. and Ireland retailers right now. Security and operational risk has moved from the perimeter to the person. Identity is no longer just an IT housekeeping task—it is the centralized control plane that determines whether your business keeps running.

In this post, we’ll cover:

• Why the login is no longer the finish line for retail security
• How identity failures disrupt trading, not just systems
• What retailers like Currys, ASDA, and Specsavers show about taking control

Identity is the new retail control plane

Attackers have worked out something simple: it's far easier to log in than to break in. Rather than forcing their way through defences, they target the credentials that already hold the keys.

Three patterns show up again and again across retail:

• Phishing: A seasonal worker or store manager clicks a convincing email and hands over their login. In a workforce that turns over constantly, awareness training can't reach everyone in time.
• Credential compromise: Reused or stolen passwords give attackers a legitimate looking way in, often through accounts nobody is actively watching.
• Impersonation: Attackers pose as suppliers, IT support, or head office to trick staff into granting access or resetting credentials.

The common thread is that none of these attacks look like an attack at first. They look like a normal user doing normal things. That's exactly why identity, who has access to what, and whether they should, has become the control that decides your exposure.

Takeaway: If you can't see and govern every identity across your enterprise, you can't see where your real risk sits.

Why this hits operations, not just IT

For a retailer, a security incident is never only a security incident. A single compromised identity can ripple straight into trading.

Think about what sits behind retail access today: point-of-sale systems, stock and warehouse platforms, ecommerce, payment tools, supplier portals, and head office applications. When an attacker gets hold of an identity with too much access, they can reach far more than one account. They can disrupt fulfilment, freeze orders, expose customer data, and knock out systems your stores depend on to trade.

The commercial impact follows fast: lost sales, recovery costs, regulatory scrutiny, and damaged customer trust that takes far longer to rebuild than any system takes to restore. For risk and resilience leaders, this is the point that lands in the boardroom. Identity isn't an IT housekeeping task. It's a continuity issue.

Takeaway: In retail, identity risk and operational risk are the same conversation.

Where retail identity risk quietly builds up

The reason identity has become such a soft target is that retail environments make governance genuinely hard. High turnover, seasonal peaks, franchise and joint-venture models, distributed stores, and a web of third parties all create access that's difficult to track.

When joiner, mover, and leaver processes stay manual, the gaps widen. Access lingers after someone leaves. Permissions pile up as people change roles. Orphaned accounts sit dormant, unnoticed, and ready to be misused. Every one of those is an identity waiting to be compromised.

A common retail mistake: Treating MFA as the finish line

It is incredibly effective at securing the front door. But once that door is open, MFA has no say in what happens next. It doesn't tell you if a store associate who transferred locations last month still has legacy access to their old branch's point-of-sale systems. This creates 'entitlement creep'—a massive accumulation of excessive permissions. MFA will gladly let users log into systems they no longer need because it only checks who they are, not what they should be allowed to do. Authentication is just one layer; establishing identity as an active control plane is what actually reduces your exposure.Takeaway: Strong logins are necessary, but they're not the same as strong identity security.

What leading retailers show about taking control

Establishing identity as your centralized control plane isn't just theoretical. It’s how leading retailers are replacing manual administrative chaos with automated, policy-driven action: The good news is that retailers are already proving this can be fixed, and the results speak for themselves.

• Currys automated its identity processes and achieved a threefold reduction in access risk, cutting unexecuted user risks from over 8,700 to under 2,800, while managing 24,000 identities with full audit trails and automated recertification.[BH1] (#_msocom_1)
• ASDA rebuilt its identity infrastructure from scratch after a Walmart demerger, safely onboarding 138,000 employees, many of them frontline and seasonal staff, with a lean identity team of just five.
• Specsavers recovered 2,000 Microsoft 365 licences tied to duplicates and leavers and now manages 10 times more identities than on its previous platform, all under role-based least privilege.

Notice the pattern. Each retailer turned identity from a manual burden and a source of hidden risk into a controlled, automated foundation. They didn't just tighten security. They improved efficiency, cleaned up their data, and gave themselves room to grow.

Takeaway: Governing identities well reduces risk and removes friction at the same time.

The bottom line for UKI retailers

Retail cyber risk is now identity-led. Attackers are logging in with credentials they've phished, stolen, or tricked out of your people, and reaching straight into the systems that keep stores trading. MFA alone won't stop them. Moving beyond the login and establishing identity as a centralized control plane is how you close the gaps they exploit. The retailers pulling ahead treat identity security as a dynamic business foundation, not an afterthought.

The retailers pulling ahead treat identity as a business foundation, not an afterthought. That's the practical move for CISOs, CIOs, identity architects, and resilience leaders alike: know where your identity risk sits, then govern it before it costs you.

Want to go deeper on this? Join us. on 29 September for our 45-minute webinar, Retail identity security in 2026: reducing risk without slowing growth, for a practical look at where retail identity risk hides and how to close it. Save your seat