Speaking with TechGraph, Sriram Kakarala, Chief Product Officer at Scalefusion, discussed how the rapid expansion of digital payments across connected enterprise devices is making endpoint hygiene an increasingly important part of payment security, and how this evolution is encouraging organisations to look beyond protecting transactions and strengthen security across the devices.
Kakarala further explained how Scalefusion is approaching this shift by encouraging enterprises to move beyond reactive security models and adopt a more continuous approach to managing endpoint trust as payment-enabled devices become increasingly common across business operations.
Read the interview in detail:
TechGraph: India’s payments ecosystem has grown at an unprecedented pace, with UPI becoming the preferred mode of transaction for millions of consumers and businesses. What structural changes has this created for enterprise security that did not exist when digital payments were largely confined to banking applications?
Sriram Kakarala: The biggest shift is that payments are no longer limited to banking applications or financial institutions. Today, every business, from retailers and logistics providers to healthcare and hospitality, interacts with digital payments through connected devices. That has significantly expanded the enterprise attack surface.
A few years ago, securing payments primarily meant protecting banking infrastructure and transaction channels. Today, organisations must also secure the devices that initiate, process, or support those transactions. Smartphones, tablets, kiosks, point-of-sale terminals, and purpose-built Android devices have become operational endpoints that directly influence payment security.
As enterprises digitise frontline operations, endpoint security becomes inseparable from payment security. A compromised device can expose credentials, manipulate transactions, or provide attackers with an entry point into broader enterprise systems. This makes device integrity, continuous monitoring, and policy enforcement just as important as securing the payment application itself.
The conversation has evolved from protecting transactions to protecting the entire environment in which those transactions take place.
TechGraph: Digital payment fraud often makes headlines, yet compromised enterprise devices rarely do until an incident occurs. Why do you think endpoint hygiene remains an overlooked part of the payments security conversation, and what risks are enterprises underestimating today?
Sriram Kakarala: Payment fraud is highly visible because consumers experience it directly.
Endpoint compromise, on the other hand, often happens quietly in the background. By the time it becomes public, the damage has usually extended well beyond a single device.
One reason endpoint hygiene is overlooked is that many organisations still see it as an IT maintenance activity rather than a continuous security function.
They focus on securing the payment application or transaction itself, but underestimate the risk posed by the device that’s initiating it. An outdated operating system, unmanaged applications, excessive user privileges, or a device that has fallen out of compliance can all create opportunities for attackers long before traditional security tools raise an alert.
Good endpoint hygiene is ultimately about reducing opportunities for attack before they become incidents. It is one of the most effective ways to strengthen enterprise resilience, yet it often receives far less attention than it deserves.
TechGraph: Scalefusion works with enterprises managing thousands of connected devices across industries. Looking across this diverse customer base, what common gaps do you see in the way organisations approach endpoint hygiene, particularly when payment-enabled devices become part of everyday operations?
Sriram Kakarala: One of the most common gaps is the assumption that deploying a device securely is enough. In reality, the security of an endpoint needs continuous attention throughout its lifecycle.
The first gap is application management. Organisations often lack consistent access over what gets installed on a device after deployment, meaning the application landscape on a payment-enabled device six months later can look very different from what was originally approved.
The second, and equally important, gap is access management. Organisations don’t always have clear visibility into who is using a device, whether that individual is authorised to initiate or approve transactions, or whether those permissions are reviewed regularly. Many organisations manage the device itself, but not the identity and access associated with it.
Another challenge is the growing density of connected devices across stores, warehouses, field operations, and branch offices. As the number of endpoints grows, maintaining consistent security and visibility across the entire fleet becomes increasingly difficult, especially when devices are distributed across multiple teams and locations.
TechGraph: Artificial intelligence is lowering the effort required to launch convincing phishing campaigns and automate attacks at scale. Does this make endpoint visibility more critical than ever, or are organisations still relying too heavily on reactive security models instead of prioritising device health?
Sriram Kakarala: AI is fundamentally changing the economics of cyberattacks. Threats that once required significant time and expertise can now be executed faster and at greater scale.
In this environment, endpoint visibility is no longer optional. Organisations need continuous insight into device health, compliance status, application inventory, OS & app updates, and whether the device meets the trust requirements for secure user access. Without that level of visibility, security teams are often responding to incidents after the damage has already been done.
The real issue is that many organisations still treat security as something that responds to an event rather than continuously validating whether a device can be trusted in the first place. Devices change every day, new applications get installed, configurations drift, operating systems fall behind on updates, and compliance status changes. If those changes aren’t continuously monitored, organisations are left making security decisions based on outdated information.
AI doesn’t create this problem; it exposes it faster. As attacks become quicker and more convincing, the ability to continuously assess device trust and compliance becomes just as important as detecting the attack itself.
TechGraph: Every additional security control introduces some level of friction, particularly in industries where speed is critical. How do security leaders strike the right balance between strengthening endpoint security and maintaining the seamless payment experience users now expect?
Sriram Kakarala: Security and user experience should not be treated as competing priorities. Well-designed security should enable business operations rather than slow them down.
The key is adopting controls that work in the background. Automated policy enforcement, secure device provisioning, application management, remote configuration, and continuous compliance checks help organisations strengthen security without adding unnecessary steps for frontline employees.
Security leaders should also focus on standardisation. The more consistent the device configuration across the organisation, the easier it becomes to maintain both security and operational efficiency.
Ultimately, security should be part of the operational workflow, not a checkpoint that slows it down. When devices are consistently managed and compliant, organisations can strengthen security without compromising the speed and simplicity that digital payments demand.
TechGraph: Compliance requirements around digital payments continue to evolve, but attackers rarely wait for regulations to catch up. How does Scalefusion help enterprises move beyond compliance checklists and build endpoint security strategies that remain effective against evolving threats?
Sriram Kakarala: Compliance provides an important baseline, but it should never be mistaken for a complete security strategy. Regulations define minimum expectations, while attackers continuously adapt to find new ways in.
At Scalefusion, our approach begins with unified endpoint management, giving IT teams complete access over corporate devices and ensuring they’re configured and managed consistently.
From there, Zero Trust Access ensures that only trusted users on managed and compliant devices can access business applications and corporate data.
The final layer is continuous compliance and security, where device trust is validated, endpoint compliance is enforced, and risks are identified before they become security incidents.
This approach helps organisations move beyond meeting compliance requirements to maintaining a security posture that continuously adapts as devices, users, and threats evolve.
TechGraph: Looking ahead, digital payments will increasingly extend beyond smartphones to kiosks, retail terminals, logistics devices, and other connected endpoints. What changes do you expect this shift to bring, and what should enterprises prioritise today to ensure endpoint hygiene scales alongside India’s expanding digital payments ecosystem?
Sriram Kakarala: The future of digital payments is increasingly device-agnostic. Payment experiences will extend across self-service kiosks, retail terminals, handheld logistics devices, digital signage, and a growing range of connected enterprise endpoints.
While this creates new opportunities for businesses, it also significantly increases the number of devices that require consistent security management. Organisations can no longer rely on multiple tools or manual processes to maintain endpoint hygiene at scale.
The priority should be ensuring every connected endpoint is managed through a unified platform that combines device management with secure user access, continuous compliance, and consistent security enforcement across every device, regardless of its type or location.
As digital payments become embedded into more business workflows, endpoint hygiene will become a foundational requirement for operational resilience. Organisations that prioritise proactive device management today will be better positioned to support the next phase of India’s digital payments ecosystem.