Retail runs on access. Staff need customer details, store systems have to connect to central infrastructure, and suppliers need remote connections. IT teams oversee servers and network devices. Increasingly, applications and AI-driven systems want access to business data too.
As retail gets more digital, that access turns into a serious security problem. A recent global study from Kaspersky's Internal Research Center shows how big it is: 87% of retail organizations faced at least one cyber incident in the past 12 months. The damage was real. Of the retailers surveyed, 28% reported customer data theft, 25% saw financial losses, and another 25% dealt with business or operational disruption. Nearly one in five lost data they could not recover.
These figures show how quickly a security breach becomes a business issue once an intruder reaches critical systems and data. That is where Privileged Access Management (PAM) becomes relevant.
Retail's Attack Surface is Changing
Retailers today run far more complex environments than they did ten years ago. A typical firm may have hundreds of stores, data centers, cloud systems, databases, point-of-sale infrastructure, network devices, e-commerce platforms, third-party apps, and remote staff. All of it is linked, and all of it has to stay available.
At the same time, access keeps spreading outward. Staff work from home, partners reach corporate systems, and administrators manage infrastructure from different sites. Automated tools connect through service accounts and API credentials. In this setting, managing access matters as much as spotting threats.
Kaspersky's research named phishing as a leading cyber incident for retailers, reported by 21% of participants. Cyber espionage and web application exploitation also ranked among the top risks. PAM cannot replace endpoint, email, or application security, and it shouldn't try. Its job is different: it adds a security layer around the identities that can reach and change critical infrastructure.
That matters most when an attacker manages to compromise a legitimate account.
A Compromised Account Should not Become Compromised Infrastructure
A common belief in enterprise security is that authentication is enough. A user logs in with a valid username and password, but that says nothing about whether what they do next is legitimate. A stolen administrator credential looks exactly like a normal login unless extra controls govern privileged access. That is why Least Privilege matters more and more.
Kaspersky reported that 31% of retailers adopted Zero Trust or Least Privilege methods after a major security event. Kron PAM applies the same idea to privileged access. Instead of giving administrators permanent entry to every system they might need, organizations can specify which users may reach which resources and under what conditions.
The shift looks small, yet privileged access is now something explicitly granted and managed rather than something users hold indefinitely.
Just-in-Time access takes this further. An administrator can get temporary access to a server, database, or network device for a specific task. When the set period ends, the privilege is withdrawn.
For retailers with large IT teams and distributed infrastructure, limiting standing privilege can sharply reduce the paths available to an attacker.
Passwords are still a major weakness
The research also points to a problem that has been around for decades and hasn't gone away: weak and reused passwords. Kaspersky reports that 33% of retail organizations named weak or reused passwords as a risky employee behavior.
It gets much worse when the password belongs to an administrator account. Privileged credentials often open the most sensitive systems in the organization. They may be used to manage servers, databases, network infrastructure, or security systems. If those credentials are shared between administrators, kept in spreadsheets, or reused across systems, compromising one password can open the door to several critical environments.
Kron PAM's Password Vault tackles this by centralizing privileged credentials and controlling how they are accessed. Administrators can request access to a credential without needing to know the password or share it manually.
That changes what a password is. It stops being something an administrator owns and carries from system to system, and becomes an asset the organization manages and secures. The organization keeps control of the credential, and access can be granted, monitored, and revoked according to policy.
Access Control is Only the Beginning
Controlling who can connect to a system matters, but it isn't the whole picture. Once an administrator is on a production server or database, the organization needs to see what happens in that session. In retail this is especially true, since a single administrator may have access to systems supporting thousands of stores or millions of customers.
Kron PAM's Privileged Session Manager puts a controlled gateway between users and privileged resources. Instead of letting administrators connect straight to critical systems, organizations can route privileged sessions through a centrally managed access layer.
Sessions can be monitored and recorded, and commands executed during SSH sessions can be captured and indexed for later investigation. Security teams get more than a login record: they can work out what happened during a privileged session and tie an action to a specific user and session.
That visibility is especially useful when investigating incidents involving compromised accounts or unauthorized changes.
Third-party Access Creates Another Risk
Retail organizations often depend on outside parties. Technology vendors, managed service providers, system integrators, and maintenance teams may all need access to infrastructure.
Giving these users permanent VPN accounts or broad network access creates unnecessary exposure. But cutting off third-party access altogether is rarely practical. The better answer is to make external access controlled and temporary.
Kron PAM can give external users controlled remote access to privileged resources without opening up the internal network. Access can be limited by user, resource, policy, and time window, and the resulting sessions stay visible to security teams.
This works well for organizations with geographically distributed operations. A vendor maintaining infrastructure in a store doesn't need access to the entire corporate network, only the specific system required for the task. That is the Zero Trust principle in practice.
Retail Needs Centralized Control Without Centralized Infrastructure
Another Kaspersky finding matters especially for large retailers: 23% of respondents named insufficient centralized control over IT infrastructure as an internal security risk.
Retail infrastructure is distributed by nature. A retailer may have hundreds of locations, regional offices, data centers, and cloud environments, with network devices spread across all of them, while access policies and security requirements still have to stay consistent. Kron PAM provides a centralized control layer for privileged access across that distributed environment.
For network infrastructure, Kron PAM's Network PAM capabilities include built-in TACACS+ and RADIUS, so organizations can centralize authentication, authorization, and accounting for network devices. SSH access, MFA, privileged session monitoring, and command-level visibility can all sit under the same security framework.
This matters for retailers whose network infrastructure is essential to store operations. A compromised network administrator account should not give an attacker uncontrolled access to routers, switches, and other critical devices across the organization.
Detecting Unusual Privileged Behavior
Access control alone cannot fully address one more dimension of privileged access: behavior. A legitimate administrator can do something malicious, and a legitimate account can be compromised. A vendor can access a system outside the normal maintenance window. An administrator can suddenly start running commands that look nothing like their history.
In every one of these cases, the identity itself may look legitimate. Behavioral analytics adds another layer here. Kron PAM's Threat Analytics and User and Entity Behavior Analytics capabilities can analyze privileged activity and flag potentially anomalous behavior. Risk can be evaluated from contextual and behavioral signals, which helps security teams tell ordinary administrative work from activity that deserves a closer look.
Combined with session monitoring and access policies, this gives a more adaptive security model. Access isn't treated as a one-time decision made at login; activity can keep being evaluated throughout the privileged session. For a retailer with many administrators, contractors, and privileged accounts, that extra context can make incident detection much more effective.
Protecting Customer Data Starts With Controlling Privileged Access
Customer data is one of the most valuable assets a retailer holds, which also makes it an attractive target. Kaspersky's research found that 34% of retailers reported customer personal data as a target of cyberattacks, and 28% reported employee personal data as a target. Customer data theft was reported by 28% of respondents.
Much of that information sits in databases, and database administrators often have broad access to them, sometimes with the ability to query, modify, or export large amounts of sensitive data.
Kron PAM's Database Access Manager brings privileged database access under centralized policy and monitoring. Database sessions can be controlled and audited, which helps organizations establish greater accountability around sensitive data access. Even organizations with strong database security controls can use PAM as another layer, since it focuses on the identity and privilege used to reach the database.
The goal is simple: sensitive data should not become freely accessible just because someone has administrative privileges.
The Next Privileged Identities Will Not Be Human
Perhaps the most forward-looking finding in the research concerns AI. Kaspersky reports that 12% of retailers already use an LLM-based tool, and 83% are evaluating, designing, or piloting AI-based solutions. Yet 33% of retailers reportedly don't consider AI a security risk.
The traditional PAM model is already changing here. AI agents, automation platforms, service accounts, APIs, and cloud workloads increasingly need access to enterprise resources. Unlike human users, these identities may run continuously and at machine speed, and they may hold credentials that open databases, applications, cloud services, or infrastructure.
So the challenge reaches beyond human privileged users. Kron PAM's Secrets Management capabilities cover this growing class of non-human identities by protecting and managing secrets such as API keys, tokens, and service credentials.
That becomes more important as organizations move toward agentic AI. An AI agent that can reach enterprise systems needs the same discipline around identity, privilege, and accountability as any other privileged entity. The identity may be non-human, but the risk is real.
The Retail Security Question Has Changed
The Kaspersky research is a clear warning: cyber incidents already affect the majority of retail organizations, and the consequences reach well beyond IT. Data is being stolen, operations are disrupted, money is being lost, and in some cases data and systems can't be recovered.
For retailers, better security can't stop at building a stronger perimeter. Organizations also need to limit what happens after an attacker gets through.
A compromised employee account should not automatically carry privileged access. A stolen administrator password should not open every system. A third-party account should not stay active forever. A service account should not carry unnecessary privileges indefinitely. And an AI agent should not get broad access just because an application needs to automate a task.
Modern PAM is about creating these boundaries. The most effective security architecture assumes that identities can be compromised and focuses on limiting the damage when that happens. For retailers, that means protecting privileged access across humans, machines, and increasingly AI. Stopping attackers at the door matters, but so does making sure that getting in doesn't mean getting everything.
