Your incident count is missing a few incidents

If you run security for a brand with hundreds or thousands of locations, the tools you’ve bought may have little to do with whether an attack stays at one store. A new VikingCloud survey asked 200 security and IT leaders at U.S. and European chains about the past year. None of the 13 security technologies it measured was tied to less spread between sites, and neither was real-time visibility. One policy decision was.

The sections below cover that decision and why it matters most if franchisees run some of your sites. They also cover how many serious incidents never reach executive leadership, and the exposure that opens with every new store. Eighty percent of these chains open a location before central monitoring and enforcement reach it. The problem is widespread: 86% of respondents were attacked in the past year, and 77% of those saw the attack move past its starting point into other locations, corporate systems, or shared vendors.

The biggest chains spread worst

Spread gets worse with size. Among attacked companies with 2,500 or more locations, 89% said the intrusion moved beyond its starting point. Among smaller operators, 71% said the same. The leaders reporting these numbers are mostly comfortable anyway: 83% call themselves confident or very confident in their security posture.

That confidence rises with spending. Respondents with four or fewer of the 13 security technologies measured were 73% confident, and those with 10 or more were 100% confident. Yet 48% of all respondents lack real-time visibility across every location, and 40% say they would likely miss an active threat at their least-monitored sites.

Tools didn’t limit spread. A mandate did.

Only 51% of respondents say corporate sets security policy and requires every location to follow it. A third let sites decide how to apply corporate guidelines, and 15% let each site write its own. Among companies that own every location outright, 41% still don’t mandate policy across all of them.

That policy choice mattered more than anything on the purchase orders. Real-time visibility didn’t make a measurable difference to how often attacks spread, and neither did any of the 13 technologies. A mandate did: where one was in place, 64% of attacks spread past where they started, compared with 89% where there wasn’t one.

Among mixed and franchise operators, companies with a mandate were three times as likely to say an attack stayed put. Among corporate-owned chains, the mandate made no measurable difference. A company that employs everyone at every site probably gets consistency without writing a mandate down.

“You cannot monitor your way out of blast radius. You have to govern,” said Kevin Pierce, VikingCloud’s President and COO.

Incidents don’t reach the board

Ninety-one percent of respondents said at least one material incident in the past year never reached executive leadership or the board. Forty-three percent said five or more went unreported, and at chains with 2,500 or more locations that share rose to 58%. The most common reason, at 47%, was fear of professional repercussions. Only 14% said they weren’t sure what counted as reportable.

The money follows the same pattern. Seventy-eight percent say headquarters makes the ransom decision, but only 51% say headquarters mandates security policy everywhere. Headquarters often pays for incidents at sites where it doesn’t set the rules.

Opening-day coverage is the gap with the simplest fix. The 80% figure held whether or not a company mandated policy and did not improve at larger chains. Only 7% of respondents named budget or staffing as their biggest risk. Closing the gap takes one named owner and a sign-off before the doors open.