Threat Labs Report: Retail 2025

The proliferation of genAI within the retail sector is experiencing rapid acceleration, with 95% of organizations presently leveraging these applications, representing a notable increase from 73% in the previous year. Significantly, 97% of retail organizations utilize tools that integrate genAI-powered features, and an equivalent number rely on genAI applications that employ user data for training purposes. Overall, 95% of retail organizations have adopted genAI apps directly, slightly outpacing global adoption, where 90% have embraced genAI solutions.

At the same time, the use of personal genAI accounts remained steady at around 74% from July 2024 to January 2025, before dropping sharply to 36% by June 2025, where usage now appears to have stabilized. In contrast, adoption of organization-approved genAI solutions has risen from 21% to 52% over the same period. This shift reflects a growing preference for company-sanctioned platforms that provide stronger safeguards for sensitive data and greater control over usage. As this transition continues, retail organizations should prioritize secure, enterprise-grade genAI solutions that enable innovation while supporting compliance and reducing risk.

In the retail sector, the top 10 most widely used genAI applications closely mirror global usage patterns. Leading the pack is ChatGPT, used by 81% of organizations, making it the most popular genAI app in the industry. Google Gemini has also gained strong traction, with 60% of organizations integrating it into their workflows, positioning it as a prominent alternative to ChatGPT. Microsoft Copilot is used by 56% of organizations, while Microsoft 365 Copilot follows closely at 51%, highlighting growing demand for genAI tools embedded directly within productivity platforms. The rest of the top 10 includes a diverse mix of domain-specific applications and embedded AI tools tailored to business needs and retail-specific use cases.

The chart below illustrates how the popularity of these top 10 genAI applications has evolved over the past year, underscoring the rapid pace of change in the retail genAI landscape. ChatGPT remains the most widely used app among retail organizations, though its usage has shown a slight decline since January, marking the first dip we have observed in its popularity. In contrast, Google Gemini has demonstrated steady, incremental growth throughout the year, reflecting rising interest and adoption globally. Microsoft 365 Copilot has seen the sharpest increase in usage in recent months, fueled by its integration into productivity platforms already widely deployed in the sector. Notably, Grok has entered the top 10 for the first time, signaling the emergence of new players in the retail genAI ecosystem.

As genAI adoption accelerates across the retail sector, the risks tied to data exposure are becoming a central concern. Retail organizations are increasingly embedding genAI into their operations, but this integration often involves sending sensitive data to external applications, expanding the surface for security threats. Data security is now a growing concern as genAI becomes part of daily workflows and shadow AI continues to emerge as a challenge. The risks associated with DLP are particularly relevant as employees turn to these tools for business-critical activities.

Analysis of recent data policy violations reveals that the most common type of sensitive information exposed to genAI apps in the retail sector is source code, accounting for 47% of all violations. Regulated data follows at 39%, often shared as employees use genAI to process sensitive business or customer information. While other sensitive data, such as intellectual property, passwords, and API keys, is also being exposed through genAI apps, the frequency of these exposures in retail closely aligns with global patterns.

Retail organizations are taking a careful approach to genAI tools, with many blocking apps because of security, privacy, or compliance concerns. While each company’s policy is different, some apps are blocked more often than others, showing where the most significant risks are seen. If these tools are used in your environment, it may be worth reviewing them and deciding whether blocking whole categories of apps is safer than managing each one separately.

In the retail sector, ZeroGPT tops the list of most blocked genAI apps, with 47% of organizations restricting access. The main reason is how it handles user data: it not only stores submitted content, but has also been reported to redirect user data to third-party websites. DeepSeek follows at 44%, reflecting ongoing caution around data transparency and the risks associated with rapidly emerging genAI platforms.

These trends indicate that retailers are not only responding to specific application risks, but also strengthening their overall approach to managing genAI usage within established risk and compliance frameworks.