AI is changing online shopping. Is cyber security keeping pace?

AI is becoming an increasingly familiar part of online shopping. Recent YouGov research found that more than a third (34%) of likely Black Friday and Cyber Monday shoppers expect to use AI to help navigate the sales, while 40% would be comfortable using it to find the best price. Yet only 5% would currently be comfortable allowing AI to complete an approved purchase.

Agentic AI could change this. Unlike tools that simply respond to prompts, AI agents can make decisions, interact with other systems and automate more open-ended tasks. The Information Commissioner's Office (ICO) has suggested that personal shopping agents could anticipate consumers’ needs, search for products, monitor sales and even negotiate prices or identify tailored financing options.

As consumers delegate more of their shopping journey to AI, retailers could see more automated interactions with their websites, platforms and payment systems. That brings cyber security, data protection and resilience into sharper focus.

Keeping cyber security measures under review

Cyber security is not solely an IT issue. Where personal data is involved, it is also a legal and regulatory concern.

The UK GDPR requires organisations to process personal data securely using appropriate technical and organisational measures. This includes considering risk analysis, organisational policies and physical and technical measures.

Third-party risk also matters. Ecommerce businesses increasingly operate within interconnected digital ecosystems involving technology, communications, payment and other service providers. Understanding which third parties can access systems or customer information, and ensuring appropriate cyber security and incident-response provisions are in place, should form an important part of cyber risk management.

The threat itself is evolving too. The National Cyber Security Centre (NCSC) has highlighted AI's potential to help attackers carry out activities such as vulnerability discovery and reconnaissance at greater scale and speed.

Building resilience into ecommerce

Protecting payment environments also remains fundamental. The Payment Card Industry Data Security Standard (PCI DSS) includes controls covering areas such as network security, access, authentication, monitoring, testing and incident response.

But prevention is only part of the picture. Organisations also need to know what happens when something goes wrong. Incident-response plans should be tested so that relevant teams understand their roles and weaknesses can be identified before a real incident occurs.

For retailers, five useful questions are:

Are our organisational and technical security measures appropriate for our current cyber risk?

Do we understand the cyber security of third parties with access to our systems or customer information?

Are our ecommerce payment arrangements aligned with the PCI DSS requirements that apply to us?

Have we tested our cyber incident-response plan, including legal, regulatory and communications decision-making?

If we use AI within our cyber security arrangements, have we assessed the additional risks and controls involved?

Getting the fundamentals right

AI is changing both sides of the cyber equation. Consumers are beginning to use it within the ecommerce journey, while it also has the potential to increase the speed and scale of cyber attacks and play a role in cyber defence.

The response does not need to start with the technology. It starts with the fundamentals: understand the risk, implement appropriate controls, test those controls and know how the organisation will respond if something goes wrong.

As AI becomes more embedded in ecommerce, now is a good time to ask whether those foundations are strong enough for what comes next.

Read the original article on Gowling WLG's website.