The InCred Model: Fintech Agility Meets Measured AI Adoption and Risk-Aware Growth

India’s fintech ecosystem is growing at breakneck speed — with innovation often outpacing regulation and security controls. For Ashwin Sekar, Chief Product & Technology Officer at InCred, the answer isn’t to slow innovation down, but to reinforce it with systems designed for scale, resilience, and trust.

“Secure innovation is not about restricting creativity,” Sekar emphasizes. “It’s about building guardrails that let teams innovate freely without breaking the system. Good intentions can’t scale. Strong frameworks can.”

A Data-Driven Security Strategy Powered by Six Golden Signals

InCred anchors its cybersecurity maturity to “six golden signals” — live metrics designed to measure and enhance security posture without impeding velocity:

• Security incidents — frequency, severity, and root cause
• Compliance readiness — alignment with regulatory frameworks
• Risk management — continuously updated risk register and mitigation matrix
• Control effectiveness — evaluating real-world performance of tools and policies
• Employee awareness — behavioural resilience against phishing and social engineering
• Incident response — speed and quality of detection, containment, and recovery

“We’ve evolved from a reactive model to a formal, measurable, and continuously monitored posture,” Sekar says. “This framework is what helps us stay fast — and safe.”

The same discipline applies to DevSecOps and SDLC: automated security scans, static and dynamic testing, and mandatory deployment gates ensure vulnerabilities are caught before they reach production.

To prevent infrastructure misconfigurations, Terraform and automated provisioning enforce consistency. “Automation enables agility,” Sekar notes. “And it keeps reliability intact.”

A microservices architecture and pod-based operating model allow teams to experiment rapidly and independently: “We encourage smart risk-taking — but inside clearly defined guardrails.”

Securing the Data That Builds Customer Trust

With financial data at its core, InCred applies multi-layered protection across the data lifecycle:

• Full encryption at rest using AWS KMS
• TLS 1.2 for secure transport
• PII encryption at database level with default masking in applications
• Granular, role-based least-privilege access

“Data protection is never ‘done’,” Sekar adds. “We continuously upgrade, monitor, and evolve — because trust is earned daily.”

Generative AI: Opportunity with Oversight

GenAI introduces efficiency — and entirely new exploit paths.

“Prompt injection, data leakage, insecure integrations — these are very real risks,” Sekar warns.

InCred enforces strict controls:

• Standardised on one enterprise-grade GenAI provider
• Contract terms preventing model training on customer data
• Blocked access to ungoverned public GenAI tools
• Architecture council review for every GenAI initiative

“No AI component bypasses governance,” he says. “Same framework. Same discipline.”

Automated Defence and Always-On Monitoring

Cyber defence at InCred is built for continuous vigilance:

• CrowdStrike for AI-powered endpoint protection
• Netskope for traffic inspection and zero-trust enforcement
• AWS security telemetry to detect cloud anomalies
• A 24×7 SOC, driven by SIEM intelligence, to investigate and contain threats

“It’s an arms race,” Sekar remarks. “Standing still means falling behind.”

The DPDP Act: Scaling Compliance Without Slowing Delivery

With the DPDP Act reshaping India’s data accountability, InCred is proactively preparing:

• External gap assessments underway
• Focus on consent management enhancements
• Strengthening DLP, classification, and monitoring controls

“With a strong foundation already in place, adapting to regulatory change becomes continuous evolution — not disruption,” he says.