Containing the Incident: How Segmentation Keeps Retail Running

Published 26/10/26

A reflection from our network segmentation webinar with Darren Ashcroft.

Most retailers I speak to are already putting plenty of effort into preventing attacks. The harder question is what happens when one succeeds. How do you stop an incident spreading without disrupting payments, stores or other essential services?

That is particularly difficult in retail, because so much needs to stay connected: stores, colleagues, customers, suppliers, applications and cloud services. The more connected the environment becomes, the harder it is to know which communications are genuinely needed and which could give an attacker room to move.

Segmentation is about control

This is where segmentation can help. By separating an environment into zones and allowing the traffic the business actually needs, you make it harder for an attacker to move around while keeping important services available.

There is no single design that works for every retailer. You might need broad controls between sites or environments, alongside more detailed controls between particular applications and workloads. The useful question is less about how much segmentation you can introduce, and more about where it will reduce risk without getting in the way of the business.

Start with what the business depends on

Incomplete visibility is one of the problems I see most often. Traffic data can tell you what is communicating, but it rarely tells you why that connection exists, or whether anyone still needs it. That is why technical discovery needs input from the people who understand the applications and services.

A good place to start is with one critical transaction, a payment, say. Trace it end to end, identify everything it relies on, including services such as DNS and time synchronisation, and then work out what genuinely needs to communicate. From there, you can test whether the transaction still works when unnecessary connections are blocked.

Make it sustainable

The technology is only part of the answer. Someone needs to own the dependencies, the security intent and the controls themselves. Application teams can confirm what their services need, security teams can define the boundaries, and platform teams can implement and monitor them. If an exception is needed, give it a clear business reason, an owner and a date to review it.

Why this matters now

Retail environments rarely stand still. Every new store system, supplier integration or cloud service adds another connection and another question about whether it is still justified. Segmentation gives you a way to answer that question on an ongoing basis, rather than only during an incident. That is what turns it from a project into a practice.