Before taking the CISO role at LogicGate, I spent years running enterprise security programs for major consumer brands, most recently as Vice President and CISO at Hyatt, following his security leadership role at United Airlines.
Managing security across thousands of hotels and airports teaches you a hard truth: Guest experience and risk management run on the exact same systems.
A property management system checking in guests and a register processing a payment are revenue drivers and compliance liabilities at the same time. When one of those systems breaks or is breached, it isn’t just an isolated IT incident, it’s an immediate breakdown in guest trust.
Today, those of us running security programs in hospitality and retail are managing through a massive shift where digital networks, physical property systems, and AI tools overlap. Below are five GRC trends I’m tracking closely this year. Two represent urgent operational demands with strict penalties already in place; three are long-term structural shifts that will reshape how we manage enterprise risk.
1. Third-Party Exposure Is Now Your Primary Attack Surface
Retail and hospitality now report the highest third-party breach rate of any sector at 52.4%. Vendor-driven compromises have officially overtaken direct infrastructure attacks as our primary threat vector.
The pattern across recent incidents is consistent: attackers bypass heavily defended corporate perimeters to strike the weakest shared vendor in the ecosystem. Co-op and Marks & Spencer were both breached in 2025 through a shared third-party provider, with M&S absorbing an estimated £300 million in damages alongside weeks of operational disruption. Jewelry retailer Pandora suffered a similar fate in 2025, traced directly back to a third-party platform vulnerability rather than its own internal network.
For hotel groups and retail chains, this exposure compounds with scale (RH-ISAC). I saw this firsthand at Hyatt: A Central Reservation System or Property Management System vendor can touch thousands of locations. Even when franchise properties are technically isolated from corporate networks, a compromise can still create reputational damage to the brand as a whole.
Boards are now focusing heavily on vendor concentration risk too, and it’s a question I get asked directly. For the retail and hospitality industry, there are many locations that are managed through centralized technologies, and if those technologies goes down, every location goes down with them, regardless of the vendor’s individual security score.
I stopped accepting static, annual vendor questionnaires from my teams a long time ago. A spreadsheet filled out once a year is stale within weeks. We need continuous, evidence-based Third-Party Risk Management (TPRM) that combines real-time monitoring and automated workflows that flag drift the moment a vendor’s posture changes.
TPRM aligned to standard frameworks like NIST or SIG is also critical, but recognize that these frameworks provide a strong baseline that you need to make your own. Generic questionnaires often include irrelevant or outdated questions that serve to check a box rather than deliver real meaning with regard to risks.
Organizations must customize these frameworks to align with their specific environment. Security leaders must clearly identify their organization’s critical risks and crown jewels, using those insights to properly tier and prioritize vendor risks based on actual business impact.
Explore how LogicGate TPRM helps security leaders automate third-party risk assessments, monitor vendor posture drift in real time, and quantify concentration risk across enterprise footprints.
2. PCI DSS 4.0.1 Ends the “Annual Checkbox” Era
With penalties ranging from $5,000 to $100,000 per month for non-compliance and 12 core requirements live as of March 31, 2025, PCI DSS 4.0.1 has permanently altered payment security compliance.
Point-in-time assessment sprints no longer cut it. Requirements that were previously optional, such as automated log review, multi-factor authentication (MFA) across the entire cardholder data environment (CDE), and mandatory 12-month scope reconfirmations, are now strict baselines.
I experienced this exact problem managing PCI across thousands of hotel properties and terminals: saying “we have a policy” stopped being valid evidence a long time ago. Auditors now expect living proof that controls function consistently across every property, terminal, and connected third-party system.
My rule during my time at Hyatt was simple: treat PCI compliance as a continuously monitored control environment, with evidence gathered and controls validated year-round, not a report rebuilt from scratch every time audit season rolls around.
3. AI Is Outpacing AI Governance
When employees have access to AI tools, there’s a real data security risk that forms. While employees may be using ChatGPT or Claude to do their jobs more efficiently, they’re also relaying what might be sensitive data through chat prompts. Many brands have learned this the hard way and already banned the use of generative AI across their workforce.
Agentic AI brings in another layer of risk. While 74% of organizations plan to deploy agentic AI within two years, only 21% have a mature governance model for it, and a startling 8% report having a comprehensive overall AI governance framework despite 88% using AI somewhere across the business (Deloitte; Aon). Adoption is moving at full speed, but the guardrails are lagging far behind.
Retailers and hospitality organizations are rushing to deploy AI agents for inventory management, automated checkouts, and guest services. But agentic AI changes the risk landscape because these systems don’t just generate text, they take autonomous action. An agent authorized to rebook rooms, issue refunds, or adjust prices dynamically isn’t a chatbot risk, it’s a financial control risk, and needs to be treated as such.
I draw a clear line for my own team between low-risk convenience tools and high-stakes autonomous operations that touch guest profiling, biometric data, or employee workflows. With 96% of IT and security leaders identifying AI agents as an emerging risk, closing this governance gap is urgent (SailPoint). Resilient programs require formal AI use-case intake, clear risk tiering, and mandatory human-in-the-loop approvals for high-stakes operational actions, full stop.
Learn how LogicGate AI Governance enables teams to establish structured intake workflows, classify AI risk tiers, and route high-stakes use cases to human review before agents deploy.
4. A Fragmented Privacy Landscape Targets Loyalty and Biometrics
With 20 U.S. states now enforcing comprehensive consumer privacy laws (including Indiana, Kentucky, and Rhode Island as of January 1, 2026), multi-state retailers and hotel operators no longer have a single baseline to rely on. I managed guest data across state lines for years before this patchwork of biometric and algorithmic pricing laws existed, and even then a single national baseline was wishful thinking. State-level regulations are now directly targeting core revenue streams like guest Wi-Fi tracking, room-service apps, CCTV, and in-store beacons.
Two areas in particular are seeing aggressive regulatory expansion:
- Biometrics: Facial mapping and body scanning used in virtual try-on mirrors or keyless entry now generally classify as sensitive personal data, requiring explicit opt-in consent rather than standard opt-out disclaimers.
- Loyalty & Algorithmic Pricing: Statutes like New York’s Algorithmic Pricing Disclosure Act (effective November 2025) require clear disclosures whenever loyalty program data or app behavior is used to set individualized prices.
Layering on additional data classes, such as Colorado’s protection of precise geolocation and neural data, makes building separate, state-by-state compliance workflows unsustainable. The only viable path forward is to architect a privacy program around the strictest applicable state standards by default, deploying modular controls only when local variances demand them.
5. Physical and Digital Convergence Accelerates Insider Risk
This next trend is one I’m intimately familiar with. Running security across thousands of hotels, restaurants, and airports means smart locks, building management systems (HVAC, electricity, sprinklers, etc.), and guest-facing mobile apps aren’t abstractions to me, they’re systems my teams managed every day, and I watched physical operations and digital networks merge in real time.
82% of North American hotels experienced a cyberattack last year, driven primarily by IoT exploits, AI-driven phishing, and third-party vulnerabilities (Viking Cloud). As physical infrastructure becomes digitized, the attack surface expands in tandem with operational efficiency.
Two structural issues make this ecosystem uniquely hard to secure:
- Legacy Technology: Older property systems frequently lack modern security controls while remaining connected to updated cloud platforms.
- High Turnover: Seasonal retail hiring and high turnover across property operations create a constant influx of temporary staff. Every new hire is a phishing target on day one, and every departure is a ticking clock on access you forgot to revoke.
An account that isn’t revoked the day an employee or contractor departs is a standing invitation to an attacker. Managing this convergence requires removing the historical wall between physical security and IT. Door access systems, badge readers, and IoT devices belong on the exact same risk register as your core servers, supported by automated identity lifecycle processes that revoke access the moment someone leaves the organization.
What GRC Leaders Must Do Next
For me, navigating these five trends comes down to balancing immediate fires with long-term strategy. Third-party risk management and PCI DSS 4.0.1 are live operational mandates with active financial penalties; they require automated workflows and immediate execution. Agentic AI governance, privacy fragmentation, and physical-digital convergence are multi-year structural shifts that reward security programs building the underlying muscle early.
The common thread across all five is simple: point-in-time compliance exercises are dead. Security leaders who unite vendors, AI models, guest data, and physical endpoints into a single, continuous risk register will protect both their operations and their brand reputation. Programs still running annual checklists in isolated silos will continue to discover their gaps the hard way.
Frequently Asked Questions
Third-party and vendor risk is the most urgent. Retail and hospitality have the highest third-party breach rate of any sector, and most of those breaches now involve ransomware.
Yes, it is mandatory for all retailers or hotels that process, store, or transmit credit card data. PCI DSS 4.0.1 has been the only active version since December 2024, and all previously future-dated requirements became mandatory on March 31, 2025, with no grace period.
Agentic AI can take real actions, like issuing refunds or adjusting prices, rather than just generating text. That makes approval workflows with human oversight and audit trails essential, not optional add-ons.
Yes. While broader frameworks like the CCPA and GDPR apply to organizations with a global footprint, state-level laws such as New York’s Algorithmic Pricing Disclosure Act also require clear disclosures when loyalty programs use personal data to set individualized prices. Biometric data used in guest and shopper experiences typically requires explicit opt-in consent as well.
High turnover creates a constant stream of new employees who are prime phishing targets. It also strains the onboarding and access-revocation processes tied to both physical and digital systems.
