--- title: BUILDING CYBER RESILIENCE IN RETAIL description: "CYBERSECURITY 2040 : QUO VADIS? Presentation by Johan Kestens during BE-CEC 2025 Q3 on September 11, 2025 in Dolce La Hulpe" image: https://www.pointury.com/hubfs/Cybersecurity%20in%20Retail%20(1).png --- ![Pointury White Banner connecting](https://www.pointury.com/hs-fs/hubfs/Pointury%20White%20Banner%20connecting.png?width=250&height=100&name=Pointury%20White%20Banner%20connecting.png "Pointury White Banner connecting") - [Home](https://www.pointury.com/nl/) - [Toekomstige evenementen](https://www.pointury.com/nl/#upcoming) - [Voorbije evenementen](https://www.pointury.com/nl/#past) - [Artikels](https://www.pointury.com/nl/#articles) - [Diensten](https://www.pointury.com/nl/services) - [Opleidingen](https://www.pointury.com/nl/services#webinars) - [Ronde Tafels](https://www.pointury.com/nl/services#round-tables) - [Gemeenschap](https://www.pointury.com/nl/services#community) - [Onderneming](https://www.pointury.com/nl/company) - [Over ons](https://www.pointury.com/nl/company#about-us) - [Hoe doen we het?](https://www.pointury.com/nl/company#what-we-do) - [Partners](https://www.pointury.com/nl/company#partners) - [Adviesraad](https://www.pointury.com/nl/company#advisory) - [Wat deelnemers zeggen](https://www.pointury.com/nl/company#quotes) - [Publicaties](https://www.pointury.com/nl/publications) - [Blogs](https://www.pointury.com/nl/publications/tag/blogs) - [Artikelen](https://www.pointury.com/nl/publications/tag/articles) - [Vorige Evenementen](https://www.pointury.com/nl/publications/tag/events) - [Videos](https://www.pointury.com/nl/publications/tag/videos) - [Contacteer Ons](https://www.pointury.com/nl/publications/cyber-resilience-in-retail#contact) - [Nederlands](https://www.pointury.com/nl/publications/cyber-resilience-in-retail) - [Engels](https://www.pointury.com/publications/cyber-resilience-in-retail) - [Frans](https://www.pointury.com/fr/publications/cyber-resilience-in-retail) nl [Terug naar blog](https://www.pointury.com/nl/publications) # BUILDING CYBER RESILIENCE IN RETAIL ![Picture of Luc Brouwers](https://app.hubspot.com/settings/avatar/c2b0bc244d014dd5c1ffdc6af9ca1fcf) [Luc Brouwers](https://www.pointury.com/nl/publications/author/luc-brouwers) 11 sep 2025, 23:00:00 [articles](https://www.pointury.com/nl/publications/tag/articles) [blogs](https://www.pointury.com/nl/publications/tag/blogs) ![Cybersecurity in Retail (1)](https://www.pointury.com/hs-fs/hubfs/Cybersecurity%20in%20Retail%20(1).png?width=720&height=405&name=Cybersecurity%20in%20Retail%20(1).png) Building Cyber Resilience in Retail Presented by Dirk Beynaerts, CISO at Colruyt Group, at BE-CEC on September 11, 2025 in Dolce, La Hulpe A case study presented by Dirk Beynaerts on how Colruyt Group transformed its cyber defense.  ![Dirk 008](https://www.pointury.com/hs-fs/hubfs/Dirk%20008.jpg?width=720&height=480&name=Dirk%20008.jpg) Colruyt group represent nearly 11 billion € in revenue, half a billion € in investments per year, over 33.000 employees, over 2000 people in IT and over 70 people in cybersecurity. ![Slide5](https://www.pointury.com/hs-fs/hubfs/Slide5.png?width=1920&height=1080&name=Slide5.png) What does size and complexity of the Colruyt Group mean for cybersecurity? ![Slide8](https://www.pointury.com/hs-fs/hubfs/Slide8.png?width=720&height=405&name=Slide8.png) ### Case for action Colruyt’s cybersecurity posture, while in “OK-ish” shape in the present state, clearly required a transformation to meet the growing risks and challenges of the digital landscape. An external formal assessment confirmed what was already acknowledged internally: although progress had been made, it was insufficient, unstructured, and lacking long-term direction. The absence of a clear strategy and vision meant that cybersecurity initiatives were often reactive rather than proactive. This was compounded by a fragmented security architecture and the persistence of legacy systems, both of which weakened resilience and increased exposure to threats. In addition, governance and steering mechanisms were not clearly defined, leading to siloed decision-making and a lack of alignment with business priorities. Cybersecurity was too often perceived as a source of friction instead of an enabler of business value and innovation, further limiting its effectiveness across the organization. The overall risk posture needed significant improvement to achieve higher quality and maturity. While there was acknowledgment that work needed to be done, there was uncertainty about the how—how to prioritize, how to organize, and how to set a sustainable path forward. This combination of challenges—an acceptable but fragile baseline, legacy and fragmented systems, lack of governance, and insufficient strategic clarity—created a compelling case for action. Transformation was necessary not only to strengthen security, but also to reposition it as a business enabler, underpinned by a clear long-term vision and a structured program of improvement. There was a clear for action. So, when Dirk Beynaerts started as CISO at Colruyt Group, he got following assignment:  - Create a Security Strategy & Vision - Develop and execute a long-term roadmap ### Colruyt’s Security Strategy & Vision Colruyt’s security strategy is designed to ensure the **right level of protection**—strong enough to safeguard the business, yet pragmatic enough to avoid unnecessary complexity. The focus is on striking a balance: **enough security, but not too much**. The strategy is built around six key pillars: 1. **Embed security in the IT lifecycle** Security is not an afterthought but an integral part of every stage of the IT lifecycle—from design and development to deployment and decommissioning. By embedding controls early on, Colruyt ensures that systems are secure by design and secure by default. 2. **Make IT security SMART** Security objectives and measures are made **Specific, Measurable, Achievable, Relevant, and Time-bound (SMART)**. This ensures clarity, accountability, and the ability to track progress effectively, moving from abstract goals to tangible results. 3. **Reduce technical risks** The organization prioritizes reducing technical vulnerabilities and exposures that could be exploited. This involves addressing legacy challenges, strengthening architecture, and applying consistent controls to lower the overall risk profile. 4. **Be ready to respond** Recognizing that not all risks can be eliminated, Colruyt invests in **incident preparedness and response capabilities**. This ensures resilience: when incidents occur, the organization can respond quickly, limit impact, and recover effectively. 5. **Secure solutions for the future** Security is aligned with long-term business and IT strategy. Future-oriented solutions—cloud adoption, digital transformation, and new customer-facing technologies—are built with robust security in mind to avoid repeating past fragmentation. 6. **Create a security mindset** Technology alone cannot secure the organization. Colruyt fosters a **culture of security awareness and accountability**, ensuring that employees at all levels understand their role in protecting information and systems. Together, these pillars form a coherent strategy that ensures **proportionate, effective, and sustainable security**—enabling Colruyt to operate with confidence in an evolving threat landscape. ### Colruyt’s Security Transformation Journey Colruyt Group’s **Security Transformation Journey** was initiated as a strategic response to an increasingly complex and demanding environment. The **business case for transformation** was built with strong sponsorship from both the **CIO and CEO**, ensuring leadership buy-in from the very beginning. **Why transform?** The decision was driven by several converging factors: - An **evolving threat landscape** with more frequent and sophisticated cyberattacks. - The introduction of **NIS2 regulation**, requiring stricter compliance and higher accountability. - The need to address **internal historical gaps** in the evolution of security processes, capabilities, and organizational maturity. **Understanding the current state** A clear picture of Colruyt’s **risk posture** emerged from: - Existing **external assessments**, which highlighted residual risks and improvement areas. - A **self-assessment using the CYFUN framework**, helping to benchmark maturity levels and identify structural weaknesses. **Quantifying and justifying security investment** To secure executive buy-in, Colruyt adopted a structured approach to **risk quantification** and established a **global security risk budget**. This allowed the organization to link security efforts directly to **business, operational, and financial impact**, ensuring that investments were clearly tied to value and risk reduction. **Challenges to overcome** The transformation journey also acknowledged significant **organizational challenges**: shortages in staffing and expertise, gaps in knowledge, and the need for stronger collaboration across departments. These challenges had to be addressed in parallel to ensure lasting impact. **What & How: A multi-year transformation program** The outcome was a **multi-year Security Transformation Program**, designed to deliver sustainable improvements across governance, technology, and culture. This program ensures that security becomes embedded in the organization’s DNA—practical, proportionate, and aligned with long-term business strategy. **Benchmarking progress** To remain on track, Colruyt committed to **benchmarking its progress** against both external standards and industry peers, ensuring continuous improvement and avoiding stagnation. ![Slide13](https://www.pointury.com/hs-fs/hubfs/Slide13.png?width=720&height=405&name=Slide13.png) ### Principles The security Transformation Journey had following principles Beynaert's principles: - Align with CG processes DNA where it helps.  Be disruptive where needed - Perfection is the enemy of speed - Simplicity & Pragmatic - Use Standards (e.g. frameworks CyFun) - Align security goals with business outcomes - Visibility =\> Awareness =\> Accountability Security principles: - Assume breach’ mindset - Automation is critical in today’s threat landscape - Shift to the left - Shift to a Zero Trust model - Build an adaptive, integrated security architecture - Embrace AI - Simplification  - platform, not point tools - Use what you have before buying new - Consolidation ![Slide15](https://www.pointury.com/hs-fs/hubfs/Slide15.png?width=720&height=405&name=Slide15.png) ### Colruyt’s Security Transformation Journey Executive Support & Mandate ![Slide16](https://www.pointury.com/hs-fs/hubfs/Slide16.png?width=720&height=405&name=Slide16.png) ### Colruyt’s Security Transformation Journey Security Transformation Program Approach ![Slide17](https://www.pointury.com/hs-fs/hubfs/Slide17.png?width=720&height=405&name=Slide17.png) ### KPI's - Risk - Maturity - Project progress/ On Time On Cost - Cyber insurance - Awareness progression ### Pillars of the program - **Stakeholder Management** - Increased IT and business team confidence in security posture - Gained business trust *security team invited early into innovation projects* - Communication & Change Management - ‘On Tour’ *IT dept, IT communities, business…* - ‘Unlocked’, newsletter - Enterprise connect *Ent RISK – DPO - BCP/DRP - Legal - PA* - Improved Collaboration with non-security teams & business - Change Management structural embedded: corporate, program & project level - **Awareness** - Role based behaviour - Visibility, not real awareness yet ### Security organisation ![Slide20](https://www.pointury.com/hs-fs/hubfs/Slide20.png?width=720&height=405&name=Slide20.png) A security organisation and a steering board were put in place  ![Slide22](https://www.pointury.com/hs-fs/hubfs/Slide22.png?width=720&height=405&name=Slide22.png) ### What's next? Looking ahead, Colruyt’s focus will be on embedding security even deeper into the organization’s culture and operations. **Awareness** will remain a priority, with initiatives aimed at engaging business stakeholders and spreading a security-first mindset “like an oil slick” across all layers of the company. By fostering **role-based behavior** and linking **visibility to accountability**, Colruyt ensures that every employee understands their responsibility in safeguarding the business. At the same time, efforts will shift toward **maturity**, with “shift left” practices becoming part of the DNA, governance and compliance strengthened, and security improvements designed to **stick** for the long term. Finally, the organization will evolve from a project-driven approach to a **standing security organization**, characterized by continuous effort, empowerment, and clear accountability placed where it belongs. Together, these priorities define the next stage of Colruyt’s security journey: moving from transformation to sustainable excellence. ### Lessons learned Colruyt’s cybersecurity transformation has delivered valuable lessons that will guide future progress. First and foremost, security must always be developed **with the business in mind**, ensuring it supports rather than obstructs objectives. **Leadership buy-in is non-negotiable**, as visible support from the top enables momentum and resource commitment. A clear **strategy and vision**, combined with active involvement of other IT departments, ensures alignment and sustainability. Giving the transformation a recognizable **name** helped create identity and focus, while deliberate investment in **communication and change management** proved essential to build trust and understanding across the organization. Above all, the journey reinforced that **culture eats strategy for breakfast**—lasting change depends on embedding security into mindset and behavior. Celebrating **quick wins** not only demonstrated progress but also made teams proud and motivated. Finally, the principle that **visibility creates awareness, and awareness creates accountability** became a cornerstone for driving ownership at all levels. ### Conclusion CYBER RESILIENCE IS EVERYBODY'S RESPONSIBILITY EVERYDAY! View Comments Hide Comments [Share this blog post on Twitter](https://twitter.com/intent/tweet?text=I+found+this+interesting+blog+post&url=https://www.pointury.com/nl/publications/cyber-resilience-in-retail) [Share this blog post on Facebook](http://www.facebook.com/share.php?u=https://www.pointury.com/nl/publications/cyber-resilience-in-retail) [Share this blog post on LinkedIn](http://www.linkedin.com/shareArticle?mini=true&url=https://www.pointury.com/nl/publications/cyber-resilience-in-retail) ## Related Articles ## [CYBERSECURITY 2040 : QUO VADIS?](https://www.pointury.com/nl/publications/cybersecurity-quo-vadis?hsLang=nl) ![Picture of Luc Brouwers](https://app.hubspot.com/settings/avatar/c2b0bc244d014dd5c1ffdc6af9ca1fcf) [Luc Brouwers](https://www.pointury.com/nl/publications/author/luc-brouwers) 11 sep 2025, 23:00:00 ![CYBERSECURITY 2040 : QUO VADIS?](https://www.pointury.com/hubfs/Cybersecurity%20Quo%20Vads.png) [articles](https://www.pointury.com/nl/publications/tag/articles) [blogs](https://www.pointury.com/nl/publications/tag/blogs) Cybersecurity 2024: Quo Vadis?Presented by Johan Kestens at BE-CEC on September 11, 2025 in Dolce, La Hulpe [Read More](https://www.pointury.com/nl/publications/cybersecurity-quo-vadis?hsLang=nl) 0 Comments ## [BE-CEC 2026 Q1 AT TECHNOPOLIS](https://www.pointury.com/nl/publications/be-cec-2026-q1?hsLang=nl) ![Picture of Luc Brouwers](https://app.hubspot.com/settings/avatar/c2b0bc244d014dd5c1ffdc6af9ca1fcf) [Luc Brouwers](https://www.pointury.com/nl/publications/author/luc-brouwers) 12 mrt 2026, 23:00:00 ![BE-CEC 2026 Q1 AT TECHNOPOLIS](https://www.pointury.com/hubfs/BE-CEC%202026%20Q1%20picture-1.png) [events](https://www.pointury.com/nl/publications/tag/events) [blogs](https://www.pointury.com/nl/publications/tag/blogs) On Thursday, March 12, 2026, Pointury organised the third edition of BE-CEC, Belgium’s Cybersecurity Executives Conference, in Technopolis. It was again an inspiring... [Read More](https://www.pointury.com/nl/publications/be-cec-2026-q1?hsLang=nl) 0 Comments ## Contacteer Ons [![Pointury](https://www.pointury.com/hs-fs/hubfs/Website/Logo/Pointury%20White%20Transparent%20Logo-1.png?width=320&height=91&name=Pointury%20White%20Transparent%20Logo-1.png "Pointury")](https://www.pointury.com?hsLang=nl) [Follow us on LinkedIn](https://www.linkedin.com/in/brouwers/) - [Diensten](https://www.pointury.com/nl/services) - [Opleidingen](https://www.pointury.com/nl/services#webinars) - [Ronde Tafels](https://www.pointury.com/nl/services#round-tables) - [Gemeenschap](https://www.pointury.com/nl/services#community) - [Onderneming](https://www.pointury.com/nl/company) - [Over ons](https://www.pointury.com/nl/company#about-us) - [Hoe doen we het?](https://www.pointury.com/nl/company#what-we-do) - [Partners](https://www.pointury.com/nl/company#partners) - [Adviesraad](https://www.pointury.com/nl/company#advisory) - [Wat deelnemers zeggen](https://www.pointury.com/nl/company#quotes) - [Publicaties](https://www.pointury.com/nl/publications) - [Blogs](https://www.pointury.com/nl/publications/tag/blogs) - [Artikelen](https://www.pointury.com/nl/publications/tag/articles) - [Vorige Evenementen](https://www.pointury.com/nl/publications/tag/events) - [Videos](https://www.pointury.com/nl/publications/tag/videos) --- Copyright © 2026, Pointury [Privacybeleid](https://www.pointury.com/nl/privacy?hsLang=nl)  |  [Gebruiksvoorwaarden](https://www.pointury.com/nl/terms-of-use?hsLang=nl) [info@pointury.com](mailto:info@pointury.com)