Beauty & Cosmetics

🔎     Major Findings Across Sectors

• Beauty and Cosmetics platforms are above-average performers in cybersecurity resilience.
  
  
• Standout brands like Boots and Superdrug scored a perfect  (100%), showing strong protection while balancing seamless customer experience.

• The rest of the sector had some good performances from SpaceNK and LookFantastic, but then rapidly reached sub-par.
  
  

⚠️    Threats & Weaknesses

• Bot-driven mapping, session replication, and login interface exposure were successful across many of the weaker performers. Automated bots were able to scan, map, and interact with authentication portals without encountering rate limits, anomaly detection, or session validation controls. Infiltration rates reached up to 95% on select domains, confirming a near-total absence of active defensive interception.

• Simulated scenarios validated the ease of site cloning to gain access to account login and facilitate account take over on all but the top performing domains. This gives the attacker access to account level data, access store credits, and the ability to e.g. change a delivery address.

• Poorer performing sites had login paths that were generally not well protected, allowing automated access to accounts. When combined with a site cloning attack, this could lead to serious fraudulent activity and business disruption. 

• In many sites no behavioural response to bot-generated input or repeated access attempts was detected. Although all sites had Web Application Firewalls (WAFs) deployed, our simulations were able to complete reconnaissance and interaction phases without challenge - highlighting the limitations of legacy, perimeter-centric defence strategies.
  
  

🔓 Unlocking Results

VerifiedThreat assessments highlight which organisations:

• ✅ Have robust, resilient defences
  
  
• ⚠️ Are at risk of automation and bot-based exploitation
  
  
• 🚨 Face critical vulnerabilities if left unchecked
  
  

💡 Why This Matters

Understanding sector dynamics allows businesses to:

• Benchmark against industry peers
  
  
• Prioritise investment in external defence
  
  
• Strengthen customer trust by closing exposure gaps

‍

‍