William Bartram, General Manager at PCA Cyber Security
Cash is expected to account for just 4% of payments by 2035. As more transactions move through connected payment terminals, self-service checkouts and unattended devices, businesses are becoming increasingly dependent on technology that may remain deployed for years. This makes the security of those devices throughout their operational lifecycle increasingly important.
Most SMEs (e.g. small merchants) do not have the specialist knowledge, tools, or capacity to assess vulnerabilities affecting the payment devices they rely on every day. Nor should they be expected to manage those risks alone. Instead, they depend on manufacturers, payment service providers (PSPs), and acquirers to understand which devices are affected, communicate the risk and manage security throughout each device’s lifecycle.
The question for smaller businesses is how they can be confident that the devices processing everyday transactions remain secure long after deployment.
Certification cannot be the end of the process
PCI PTS certification remains one of the foundations of payment security. It provides assurance that a device has met the relevant security requirements set by PCI SSC and undergone rigorous testing before entering the market.
However, any kind of certification reflects a device’s security at a particular point in time. During its lifecycle, vulnerabilities may be disclosed in third-party software components, firmware-signing mechanisms may come under scrutiny, configurations can drift from their original state, and new attack techniques can appear that were not anticipated during certification.
A device considered secure when deployed may therefore require ongoing vulnerability monitoring and maintenance. If affected devices cannot be identified, remediation slows, exposure is harder to assess, and risk is pushed further down the chain.
Manufacturers, PSPs, and acquirers each hold part of the information needed to respond to new risks. If it is not shared effectively, demonstrating that deployed devices remain secure becomes harder.
Lifecycle management cannot stop at deployment
Effective lifecycle management requires manufacturers to maintain accurate records of deployed devices, understand which firmware and software versions are operating in the field, and assess newly disclosed vulnerabilities against those assets.
Visibility must extend beyond individual devices to wider portfolios, where shared dependencies and recurring vulnerabilities may create broader patterns of risk.
When a vulnerability is disclosed, manufacturers need to establish which products and device versions are affected and what action is required. PSPs and acquirers then rely on that information to identify affected devices across their estates and determine whether updates or other remediation measures are necessary.
A device-centric view connects vulnerability intelligence with product architecture, software components, and software bills of materials. This helps organisations establish whether a vulnerability affects a device, assess exposure and prioritise the response.
Accountability must extend across the ecosystem
The burden of payment-device security cannot sit with SMEs alone. Retailers and other small operators depend on information flowing through the wider payments ecosystem.
Manufacturers must understand how vulnerabilities affect their products, while PSPs and acquirers need visibility into where those products are deployed and what remediation is required. Security depends on these organisations communicating risk and coordinating action.
This shared responsibility is becoming more important as legislation moves towards ongoing product security. The EU Cyber Resilience Act (CRA) reflects a broader shift away from one-off assurance and towards an expectation that connected products remain secure after deployment.
Since 11 September 2026, manufacturers of products with digital elements made available in the EU have been required to submit an early warning within 24 hours of becoming aware of an actively exploited vulnerability or severe security incident. The CRA’s wider product-security obligations will apply from December 2027.
Organisations responsible for product security will increasingly need to demonstrate that they understand where devices are deployed, which vulnerabilities affect them, how remediation is being managed and whether the action taken has addressed the underlying exposure.
Building confidence in cashless payments
Payment devices can remain in service for years, but the risks affecting them do not stand still. Confidence therefore requires certification to be combined with continuous visibility of deployed devices, their software components, and newly disclosed vulnerabilities.
For businesses, the priority should be working with providers that can demonstrate strong lifecycle-security practices. As cashless payments become more common, confidence will depend not only on whether a device was secure when certified, but on whether the organisations responsible for it can show which risks affect it, what action has been taken and whether the underlying security issue has been addressed.