Are Retailers Giving Data Security Its Rightful Place in Today’s IT Spend?

It sounds simple but is worth repeating: The No. 1 way to lose customer loyalty is through a security breach. RIS unpacked the state of retail IT spend and explored some of the biggest risks retailers are facing when it comes to security breaches. (Hint: POS is still a prime target, but hackers aren’t stopping there.) Read on to learn more. Tim Denman: Welcome everyone to “Where is Retail Tech Investment Headed Post-COVID-19,” which is hosted by RIS News and presented by Fortinet. I'm Tim Denman, editor in chief of RIS, and I thank you for joining us today. Now I'm sure we’ve all experienced a little COVID-19 fatigue and wish that it would just become a page in a dusty history book somewhere, rather than a constant presence in our daily lives, but unfortunately, that's not the case. The pandemic continues to impact nearly every aspect of our personal and professional lives, but there is some hope on the horizon. As we know, vaccines continue to be administered, active cases are falling and there's cause for some celebration. In fact, the retail industry is returning to a “state of normalcy” with restrictions lessening and stores returning to post-pandemic activity in many parts of the country. With all these encouraging signs of recovery, forward-thinking retailers are investing heavily in their tech stacks to ensure they are among the winners when the dust finally settles for good. With me today to discuss where smart retail players are placing big technology bets is Courtney Radke, national retail, chief information security officer at Fortinet. Courtney, thanks for taking some time. Many of the investment plans we'll be discussing today were recently covered in-depth in RIS News’ “31st Annual Retail Technology Study: Building the Future-Proof Enterprise,” which was sponsored by Fortinet. The research was conducted in January and February of this year and the findings were released late in March. The annual report has been benchmarking retailers' tech investment plans for more than three decades, and is a key indicator of where the industry is headed, both in the short- and long-term. Like we do for all our benchmark research reports, RIS goes after high-ranking retail decision-makers. You can see that about one-third of respondents hail from retail C-suite, and more than half are from retailers and revenue of excess of a hundred million, with 10% claiming sales of excess of 10 billion. A mainstay of the report has always been the benchmarking of retail IT spend. With retailers depending on tech more than ever, it's not surprising that just around 13% reported a drop in IT spending year-over-year. Compare that to the 19% that reported a year-over-year dip in IT spending last year, and you see an ongoing commitment to technology advancement. What is most striking about retailers playing in the IT investment this year is that a staggering 30% report they will increase spending by more than 10% over last year. At this point, I'd like to bring Courtney into the conversation and get an insider's take on these staggering statistics. So Courtney, welcome. Do these numbers look on-point to you? Courtney Radke: They do, but IT spending could be extremely broad — it’s infrastructure, digital, cloud security — so there's a lot to unpack with IT spend. We need to better understand where exactly the 60% of companies that are increasing, are spending it within their IT budgets. Around that 30% pace is not unusual, we expect companies to have expanded digital transformation strategies, and even the 10% decrease isn't necessarily eye-catching, except for maybe those that are decreasing by more than 10%. That just may be a natural microcosm of the events of the last 18 months, or maybe they're already heavily invested and are looking to get back to standard run rate costs. As we know, COVID and everything else expedited digital transformation, but it didn't create digital transformation. They may have already been well on the way of their journey. By and large spending looks healthy, but we need to understand where it's going, how underfunded the IT budgets were previously, if they're just playing catch up, and what is the current IT budget versus the rest of the organization's budget overall. Denman: Great points, we're going to get into a little bit of where that money is going throughout the webinar. To your point, traditional things like POS are still part of the IT bucket. We’re talking about new digital technology, so yes, it's a huge bucket, but to see those kinds of increases — 30% are going to increase by more than 10% — that's certainly eye opening. At least it is to me. Where are you seeing your clients focus their IT spend? Where have they been spending the money over the last 12 months or so? Radke: We’ve been seeing it being focused on functional areas, not necessarily one tool over another. Obviously digital transformation, again, is broad and that's driven a lot of the spend. What we've seen is a focus on four areas in technologies aimed at reducing or creating predictability in cost, technologies aimed at standardization of technology, reducing that complexity and footprint inside those organizations, and increasing operational efficiency and then reducing, mitigating, or eliminating risks. It’s not necessarily one technology versus another. Yes, we could say there's been heavy investment, especially lately in supply chain, mobile applications, ways to service the customers, be it curbside and order ahead, or some of those other technologies, but it's more on, how can I have better investments in technology to meet those four pillars that I just discussed, and we often talk about a platform. So what we're seeing is heavy investments in platforms as opposed to one product versus another. Denman: Well said. As a research project, most of the questions that we have, most of these findings are all quantitative in nature and we're going to be presenting a lot of statistics throughout this webinar, but we did ask one open-ended question this year. We asked the retail execs to describe the current state of retail in just one word, and as you can see from this word cloud that we designed based on the results — changing, transforming, influx, unpredictable — those are the most popular responses. So Courtney, I'm going to ask you, what one word would you use to describe the state of retail today? Do you think that word is going to be different a year from now? Radke: Well, if you would've asked me a year ago, I think resilient probably would have been one of the biggest out there. I think transforming is still going to be one of the biggest, because it's an industry that's always transforming to meet customer demand, and adapt to market changes. What's nice is that not every one of these was negative, right? Changing and transforming, I think are appropriate. With the retail industry, we've always desperately needed both. Influx and unpredictable are also expected, but those will give way over the next year. Then, maybe equal parts challenging and exciting. We look at it as retail's never really the biggest trendsetter, a lot of a trend follower is based on customer demand and the market dictates it — it creates where retail needs to be. We'll always see some of those negative terms sprinkled in. An interesting one on here is “cattywampus,” but even that makes me think that people believe that the pieces are in place, they just need some rearranging. Denman: That's interesting you mentioned cattywampus; everyone in our staff that looked at this report sent me a note about that one word. It definitely sticks out. I haven't found a way to use it in my daily speech yet, but I'd like to try. This slide talks about the top challenges with so much disruption and change that we just discussed across the industry, retailers are facing a lot of new challenges. For traditional challenges that we're still seeing here at the top, tech integration, retiring legacy systems, change management, those things are our challenges year-in and year-out. Courtney, looking at this list of the top challenges retailers told us for the next three years, does anything really stand out as interesting to you? Radke: What stands out is how far down customer data security is. I say down there as compared to everything else, but it should be a higher priority and it's going to be much more front and center as we continue to flush out U.S. data privacy regulations as they continue to mature. There's also a fact that honestly, retail hasn't been great at protecting this data. In the events of incidents, over half of all breaches have some confirmed personal or financial data loss. That should be a higher precedence and that stuck out for me. It’s also interesting that upgrading store bandwidth and infrastructure, while I'm happy that it's on there because it's needed, but we've continued to put more technology into these stores to reach the customer. We’re going to see that upgrading the store bandwidth and infrastructure should also have higher prevalence here. The top three, as you said, they're always major challenges and I don't think that's ever going to change. Data security and the store bandwidth stand out though. Denman: It's very interesting with the security. Let's hope it's glass half full, it's no longer a challenge and have it all figured out, but that's probably not the case. Fueled by the pandemic, the industry has seen a great increase in digital sales. Survey takers report that 32% of sales can be accredited to digital efforts. Does this stat seem at odds with the commonly quoted stat that around 85-90% of sales occurred at the store level, but you can think a little deeper about it probably really isn't. Respondents are saying that 68% of sales are credited as digital sales, but rather they are digitally-influenced not credited, but digitally-influenced. Many of those sales, depending on internal reporting standards, might ultimately go down as, “store sales,” but no matter how the accounting department divvies up the revenue, there's no doubt that digital is skyrocketing in importance. With so much on the line, getting the digital experience right is becoming paramount. Retailers named CRM and personalization as top investment areas over the next two years, with digital marketing efforts like email, mobile and text messaging a close runner up for the digital spend crown. Courtney, what do you think about CRM and personalization ranked number one on this list? Radke: Well, physical gave way to digital in a big way in the last year, and however accounting divvies it up, we know it's being used with more prevalence and by people that had maybe not ever used those digital channels before. Retailers are trying to adapt to that and understand what they like, how to better personalize the experience. It’s not just to get them the first time, it's to retain them, the loyalty is what you want. As we start seeing it swing back to physical, retailers are going to have to win that battle on multiple fronts. Personalize those digital experiences, but also use that data to better tailor physical in-store experiences. We’ve continued to see it, and will for quite some time, everybody has an app. They've launched an app, they're adopting applications to have better personalized customer experiences, and it's not necessarily about being cutting edge all the time. It’s about being repeatable, consistent with incremental growth to meet those customer needs, so CRM can be critically important. As we talk to that, again, that's going to be fed by data and that again goes back to my data security — about how it needs to be a higher priority because one of the number one ways to lose loyalty, which is less inherent in retail, is to have an incident, a breach, a loss of customer data that's out there. CRM is critical, being able to execute consistently, providing those good customer experiences every time. We’re going to see that it's not going to stop, but rather it's going to be continuously important. Denman: You mentioned this earlier about security, obviously in a digital space, it's become even more important. What are the leading or smart retailers doing on the digital front to keep the enterprise secure while executing on all these great key initiatives that we see here? Radke: Over the last year there's been a lot of partnerships created to solve point-in-time challenges and keep up with the demand — to change and adapt their business models because some of them had no cloud presence or no digital presence. Reevaluating the partnerships and understanding, do these third parties continue to belong in my environment after I've solved that challenge? Do I have to evaluate that, create new partnerships? That’s the vital component we're seeing. Again, going back to data security, we're seeing a lot more configuration management security, cloud workload protection, some of those that are becoming a requirement at this point, because we've seen a high prevalence of cloud sprawl. It's very easy to spin up cloud. Thankfully that was a technology that allowed retailers to adapt, but it was also a technology that was easy to get out of control, cloud sprawl. Anybody with a credit card for that company can sign up for a cloud instance. Reevaluating the partnerships, looking at how much you've shifted to the cloud, does it meet your security strategy going forward, and then protecting the configurations of the cloud environments because that's one of the number one causes of incidents and breaches, is misconfigurations. Denman: As a way of benchmarking the tech maturity, we asked survey respondents to rank various solutions as: currently investing, investing in the next 12 months, or investing the next 24 months. This formula is used throughout the study. What we see here, and this is all supply chain stuff, supply chain spending is way up. What's interesting here is that distributed order management pops up in all three of these, and that's the only technology to end up in the top five in all the sub-categories. Obviously, signifying significant investment in this critical technology. Other technologies that placed in two of the lists fulfillment, returns, management, real-time inventory, warehouse management, all are going to be very important going forward. Courtney, can you speak to the importance of having a next-gen order management solution, and why you think we're seeing such a huge investment in that technology now and into the future? Radke: Distributed order management is just the optimization of everything that falls below it. Fulfillment, logistics, all of that from warehouse to returns, everything — it's about how you get products into the hands of customers as quickly as possible and as cost effectively as possible. It also speaks to us ensuring that the product is always available, in general that's what the DOM is for, anticipating market changes and meeting those demands. Customers now, more than ever, expect options. Where the inventory currently is doesn't matter to them. They just want it in their hands as quickly as possible. The process by which you do that needs to be transparent to them. One of the things that was talked about as a challenge was application integrations. This back-end to front-end integration has to move forward to create more real-time inventory and distributed order management. That's going to continue to be a challenge, it's what's going to drive forward the dom. Denman: How important is automation on a retailer's tech agenda? Things like workflow, RPA, AI. We're going to talk a little bit about these analytic things later in this discussion, but in what areas can they find the most ROI? Radke: Anywhere there's a mundane routine process or right now, unfortunately, anywhere there's a process that we don't have people to fulfill — staffing shortages across the board, not just inside of the store, but behind the scenes from my side or network and security side — anywhere there's a gap where there could be mundane routine processes filled by automation, that could be across the board. I don't think it could be overstated how critical automation is and building that into your stack throughout the organization. Again, we talk about it as automating with a platform approach, and it makes things easier. It's hard to pick out one area, it's everywhere and we're going to see that as staffing gets back to normal. But again, anywhere there's a gap, a mundane routine task throughout automation, AI, all of these things are going to be absolutely key. Denman: Right, and the key to all that is data and analytics. With the stark rise in digital, it comes in with an equally impressive amount of data that retailers are collecting on not only their customers, but their enterprises in general. As you can see, there's quite a bit of investment activity centered in the analytics space, but there's still a number of critical areas where retailers report they're not quite up-to-date. You can see in the top right here, just 20% of retailers can effectively track in-store shoppers. Around 13% can't segment customer behavior across channels, and only 7% have up-to-date price optimization software in place, which is pretty surprising. Courtney, do any of those three seem surprising to you? Radke: For years retailers have been giving me all the data possible and I'll figure out what to do with it later. Now that's another area where we're seeing AI come in, sifting through the noise and making it as valuable as possible as quickly as possible, but also who retailers collect it from, and when do I need to get rid of it. We're going to see that become more prevalent. Retailers are going to have to get smarter with their data, and I think data stewardship should be one of those critical challenges because we're not there yet. We're not there, and a lot of retailers are still just giving as much as possible to try to make it as valuable as possible, but we need to get smarter with it. That's where automation, AI comes in. Getting better with the data that you already have, and getting rid of it as quickly as possible once you've monetized it. That's how you gain the highest value of it. None of this is extremely surprising. Again, we see these constantly as challenges, but as the technology evolves, hopefully they go farther down the list. Denman: Obviously we're sitting on a lot of money spend getting into digital; however, the store is still vital, it's still the center of the retail universe but its role is certainly shifting. In addition to traditional in-store sales, you’ve got brick-and-mortar locations that are now charged with picking, packing, and shipping online orders, as well as executing, buy online pickup in store requests. We'll talk further about that later, but Courtney, where are you seeing the biggest investments at the store level right now? Radke: What we're seeing as some of the biggest investments at store level, and especially in a time when some of these locations' storefronts were shut down, was investments in legacy and aging infrastructure. We saw that previously, that was one of the challenges. Unless it's replaced, it's not going to get any better. So replacing in-store infrastructure to allow them to support some of those things that we just saw as challenges before. The in-store tracking, the analytics, the creating better predictability of shopping patterns inside of the store. That all requires infrastructure. Again, it also all requires higher bandwidth and smarter bandwidth utilization inside of these locations. That's what we're seeing, top investments in the building blocks that have been neglected for so long, but also, as we bring this technology on, it's creating gaps in visibility. So technologies to tie all of that together, visibility across the entire ecosystem. From our side, the network and security standpoint, that's where some of the biggest investments are, but obviously all of that supports this, supports the onboarding in some of these technologies for both out-of-store, and in-store experiences. Denman: Now on the security side, which you mentioned, we're seeing at least less of these big high profile POS breaches. It seemed we went through a big — that was a story of what 2017, 2015, all of these breaches. They slowed down a little, but where are retailers really spending the money on data security at the store level? Is it still the POS that is the most important piece of it? Radke: Well, I think the POS is still absolutely a target. The end goal has shifted from where the data is right to web applications. But to get there, it's still the tried and true — through email, the user, POS, endpoints, and with all the other IOT devices coming online — endpoint security is still absolutely critical. We haven't seen the end goal being the POS because we've tokenized, gone into encryption on payment, so they're not stopping at the POS, but they're using that as a jumping off point to get to the crown jewels, which is wherever your data resides. If companies haven't made that shift into the cloud, they're still going for the POS. But if they have, now they're trying to use that to do some lateral movement to move vertically up the chain if you don't have endpoint protection and the proper cloud security in place. We're still seeing it across the board. You still have to have visibility, control and security across your entire landscape, but it's in the vein of understanding where they're trying to get to, not where they traditionally have stopped at. Denman: Now this is a little more on the POS. We collected a ton of data for this annual study and not all of it makes it into the final report. You see retailers invest plans for each individual technology, but also of note is that technologies that retailers said they have no plans to invest in, which is all the way to the right. For POS, grab-and-go, checkout terminals, and the ability to process split tickets are among the technologies that most retailers have no current plans to invest in. Courtney, more than 73% of retailers report no interest in grab-and-go. Why do you think that is? Is that grab-and-go fad over? Radke: It's not over; it was just too early, it's hard to pull off flawlessly. It already creates greater risk and room for marginal fraud inside of the organization. Eventually we're going to get there, but not everybody's comfortable with it yet. I do see this picking up over the next couple of years, but what we see more now is that we're catching up with NFC and some of these other contactless payment methods that the U.S. was historically so far behind on. Right now we're in a crawl, walk, run phase. We've got to have, not just pretty good, we have to have real-time inventory management, which is absolutely tough, except for the biggest players. We have to have more robust connectivity support, either the user's device being used to do this grab-and-go or a device being handed off to the user. We're just not there yet, the technology and infrastructure hasn't caught up to allow it flawlessly. Again, let's have time for NFC and other contactless payment technologies to mature, become more ubiquitous throughout the environment and then maybe we'll get there. The fad's not over, I just don't think all but the biggest, most technology savvy players out there are able to pull it off. Denman: Talk about contactless. As we all know, the pandemic had retailers scrambling last year to install buy online, pickup in store capabilities, social distancing became a household phrase. In addition to traditional in-store pickup methods, retailers also rolled out contactless curbside pickup. A significant amount of retailers have gone live with the two technologies, and more are currently in the process of installing. Courtney, it looks like the two technologies will continue to be important for shoppers and retailers, at least for the short term. Do you think in-store and curbside pickup will continue to be important long-term? Do they have the stickiness to remain a vital piece post-pandemic? Radke: They have sticking power. As a society we're the got-to-have-it-now society, right? We've gotten used to two-day shipping, but now it's same-day or next-day. The same-day is close behind as becoming the norm in our we’ve-got-to-have-it-now society. The problem rises again when the supply chain fails or doesn't allow the ability to have that instant fulfillment, curbside, in-store pickup and return. Honestly, the sticking power is in the hands of the customer. We also see this in restaurants as well, right? Lack of integration, slow message handling from restaurant API, from store to the API. Even while sometimes stores or restaurants have a lack of cell coverage — it’s not across the board, not everybody has good LTE or 5G coverage, so they're having to implement Wi-Fi to make sure that this works. Any technology that allows for a more convenient shopping experience always has sticking power. We've seen this as retailers have basically changed their back-of-the-store into warehousing fulfillment centers. They think this is going to continue, they're making heavy investments and changing their store footprint for it. The easier they make it, the better they get with time inventory and the better they can expand, scale out, and secure their supply chain. It’s going to be sticking around for a while. Denman: I would definitely agree. What do you think retailers need to be cognizant of as they start to implement these solutions at scale? Radke: Don't squeeze it in on the existing infrastructure and systems that you have. You have to make sure that you're not just planning for the scale of tomorrow, but for the future. We saw that a lot of retailers, even though they thought they were in a good place, got caught up when the demand was higher than they could keep up with. Having elasticity and scalability inside of the environment is key. The problem being in some of these locations, to keep up with fulfillment, that's not something that you can quickly scale up a lot of times, you have to plan for it. You have to predict what the future markets are going to demand. Building out the infrastructure and making sure that it not only supports today's requirements, but that you can expand your infrastructure to support the future requirements is going to be pretty critical. Denman: Just like the POS data that we unveiled a few slides back, we're also releasing some previously unseen workforce data for this webinar. In this full data set for workforce, you can see that education and training leads the pack, and currently investing in categories highlights the need to have quality employees able to leverage all the next-gen tech that we've been talking about here today. This represents a combination of what retailers are currently investing in, and what they plan to invest in over the next two years. Retailers clearly have some big investments on the agenda, with around half reporting current or planned investments in education and training, mobile applications, recruitment and onboarding, employee engagement and monitoring. Courtney, so many retailers are reporting that they will be investing in workforce education and training over the next two years. How can they best put this major investment to good use? Radke: The number one investment that anybody has is always in their people. We say that from a security side, that if you train your people accordingly, you're going to save your company a lot of money in the long run. That comes from our training, we do the same internally down to the retailers. Education and training is absolutely important. We have to remember that the people inside of these stores, running these stores, this may be technology that they've used for the first time, let alone the customers' using it for the first time. We’re all in this trying to sift through this rapid innovation, rapid technology adoption like we've never seen before. The money that you put into training your employees, training your workforce, is definitely going to pay dividends down the road. We're going to continue to see that going forward. It's no surprise to me that over 50% say that education and training is one of the top investments for the evolving workforce. As we said, it's transformation, it's going to continue evolving. I hope that the education and training continues to creep up. That should never be something that has a lack of funding or buy-in inside of an organization. We always call it creating a culture of cybersecurity, when everybody feels like they're part of the process, that it just gets better, you get more secure. So I love that stat and want to see it continue to move up. Denman: I agree, especially with all this new tech, you can't be stagnant anymore, right? You have to have employees that not only know how to use the technology, but are willing and able to use it and fully leverage it. The only way is really to show them what all this great software can do. Now Courtney, we've been talking about security throughout our discussion and I'd like to invite you to give a quick look at what you and your team have been working on in the area of security. Radke: Sure. When we talked about the platform earlier, how we convey that is, it's a security fabric, all the pieces working together and we break that down. We talk about visibility and protection across the entire digital attack service, not just one portion of it. It's from home, to brands, to data center, to the cloud, you have to have complete protection across all of it. Integration solutions that reduce management complexity and share threat intelligence, and then automation — we talked about it, automation is key to everything that we do. We create self-healing networks and AI-driven security for effective security operations. For effective security and networking, and to be able to scale out, organizations have to move away from protecting with point products or protecting traditional security perimeters, to going where the attackers are going — to the data. They're attacking the billions of edges that are out there, the user's devices and critical applications. We talk about it in the vein of creating that predictability of cost, technology standardization, creating operational efficiency, and then reducing, removing, or otherwise mitigating risks. It's absolutely critical to have a platform in place to do that and that's a little about what we've worked on for retailers to protect the entire digital attack surface with the Fortinet security fabric. Denman: A lot of times when people talk about automation, they're talking about digital automation, but there's also that other side, that physical automation piece. Robots in this store, robots in the fulfillment center. Can you talk a little bit about the vulnerability of the hardware out there that's automated? Radke: As we talk about traditional retail, we've talked about IOT, but OT is becoming just as prevalent a part of retail organizations. Especially as these back-of-houses and some of these large retailers have turned into assembly lines or fulfillment and warehouses, and there's no people there to man and staff them. The ability to protect not only your traditional infrastructure, but IOT and now OT environments is going to be key. You need to be able to have information sharing between all of those, they can't be in a bubble. The problem being the network and security teams behind the scenes are also inundated with the amount of data. Trying to sift through customer data to make personalized experiences, network and security teams are being inundated with all of this data as well, and they're having to sift through it. What's real? What's not? How can I cut through the noise and automate some of that out so they can get to what's actually important and that's protecting the customer, protecting the business, and protecting the brand. Denman: One hundred percent. We're approaching the end of our time, but one last question. Investment being made in technology for digital transformation, which we touched on quite a bit, what do you see as the main barrier for security as all of this technology comes online? Radke: Complexity. The more moving pieces, the more you add to the mix, the less people you have to do it, the less automation. Complexity is often cited as the main barrier to data security. We recently ran a study and it was upwards of 60% — I think it was 66% — of respondents said complexity was their main barrier to data security. Yet we have a lot of them say that newly deployed technologies or newly brought on third parties were secure or very secure. It seems almost at odds, maybe that's different teams answering the questions. But time and time again, we hear complexity is the main barrier to data security. Again, subscribing to a platform approach helps reduce that complexity. Denman: That concludes our questions for today. Thank you, Courtney for joining us today, great conversation. I think it was a great one and we're looking forward to doing it again next year. Thanks everyone for joining.

You May Also Like

Prioritizing Amid a Sea of Data: Victories & Roadblocks Behind Today’s Analytic Investments

Today’s Supply Chain Tech Investments Driving Retail Profits