OneSpan Inc. (‘OneSpan’) operates as a global cybersecurity and e-signature company.
The company delivers solutions in two key areas: advanced secure authentication and digital agreements. The company’s secure authentication solutions protect devices, users, and applications with robust multi-factor and passwordless authentication, and other fraud prevention technologies. The company’s digital agreements solutions combine identity verification, electronic signatures, and digital workflows to st...
OneSpan Inc. (‘OneSpan’) operates as a global cybersecurity and e-signature company.
The company delivers solutions in two key areas: advanced secure authentication and digital agreements. The company’s secure authentication solutions protect devices, users, and applications with robust multi-factor and passwordless authentication, and other fraud prevention technologies. The company’s digital agreements solutions combine identity verification, electronic signatures, and digital workflows to streamline agreements, enhance compliance, and accelerate business processes. It empowers organizations to automate and secure both customer-facing and revenue-generating processes, supporting a wide range of use cases—from simple transactions to complex workflows requiring elevated security. Trusted by global blue-chip enterprises, including more than 60% of the world’s 100 largest banks, OneSpan processes millions of digital agreements and billions of secure authentication transactions in more than 100 countries annually.
The company offers its products primarily through a subscription licensing model and provides multiple deployment options, including cloud-based and on-premises solutions. The company’s solutions are sold worldwide through its direct sales force, as well as through distributors, resellers, systems integrators, and original equipment manufacturers.
The company outsources portions of its cloud infrastructure to third-party hosting providers, principally Amazon Web Services (‘AWS’).
Segments
The company operates under the following two lines of business, which are its reportable operating segments: Security Solutions and Digital Agreements.
Security Solutions: Security Solutions consists of the company’s broad portfolio of software products, software development kits (SDKs), and Digipass authenticator devices that are used to build applications designed to defend against attacks on digital transactions across online environments, devices, and applications. The software products and SDKs included in the Security Solutions segment are on-premises and, to a lesser extent, cloud software products, and include multi-factor authentication and transaction signing solutions, such as mobile application security and mobile software tokens.
Digital Agreements: Digital Agreements consists of solutions that enable the company’s clients to secure and automate business processes associated with their digital agreement and customer transaction lifecycles that require consent, non-repudiation, and compliance. These solutions, which are largely cloud-based, include OneSpan Sign e-signature, OneSpan Notary, and Identity Verification.
Products and Services Portfolio
The company offers a portfolio of security, authentication, identity, electronic signature, and digital workflow products and solutions through its two business segments, Security Solutions and Digital Agreements.
Security Solutions
Cloud Authentication is a quick-to-deploy, cloud-based multi-factor authentication solution that supports a full range of authentication options, including biometrics, push notifications, visual cryptograms for transaction data security, SMS, and hardware authenticators. This allows customers to solve strong authentication problems across different endpoints to best meet their unique requirements through a single provider rather than integrating multiple modalities together. It eliminates costs associated with managing legacy on-premises authentication technology and provides a straightforward upgrade path to more comprehensive capabilities, such as intelligent adaptive authentication.
Mobile Security Suite is a comprehensive software development kit (SDK) and unique single framework that integrates built-in application security to allow for a variety of strong authentication technologies, dynamic linking, WYSIWYS (What-You-See-Is-What-You-Sign), authentication orchestration, and improved authentication user interface. Through a comprehensive library of APIs, customers can extend and strengthen security for applications, deliver user convenience, and streamline the application deployment and lifecycle management process.
Mobile Application Shielding protects mobile applications from attacks by malware, allowing secure usage of mobile applications even in hostile environments (e.g., on jailbroken mobile phones). The technology helps protect mobile application code against malicious code injection, such that if a device becomes infected with malware, the application shielding technology will detect and prevent that code from running.
Authentication Server is a comprehensive, centralized, and flexible authentication platform designed to provide full lifecycle management through a single, integrated system. It enables secure multi-factor authentication for digital transactions and user access, supporting a wide range of authentication methods, including biometrics, one-time passwords, and mobile push notifications. By offering broad access to enterprise resources—from SSL VPNs to cloud-based applications—it enhances security while simplifying authentication management for both administrators and end users.
Authentication Suite is a comprehensive solution designed to protect organizations from cyber threats while offering authentication experiences across channels. With a flexible API-driven backend, support for both hardware and software authenticators, and a robust mobile SDK, the suite provides scalable security for high-volume applications like online banking, e-commerce, and gaming. Organizations can tailor authentication methods to meet their unique security needs, leveraging industry standards and technologies, such as the FIDO and OATH standards, the company’s Digipass technology, and its Cronto visual transaction signing solution for enhanced protection against sophisticated attacks. Its integration capabilities simplify deployment without disrupting existing systems, while built-in mobile authentication licenses enable secure user access across multiple devices.
Digipass Authenticators are the company’s hardware authenticators, consisting of a wide variety of authentication devices, each of which has its own distinct characteristics to meet the needs of its customers. All models of Digipass authenticators are designed to work together so customers can switch devices without making changes to their existing infrastructure, and they are also fully interoperable with its mobile authentication software. The company’s Digipass models range from one-button devices and smart card readers to devices that include more advanced technologies, such as public key infrastructure (‘PKI’) and visual cryptography.
The company’s Digipass authenticators provide proven multi-factor authentication and transaction data signing. The company’s newer Digipass FX family of authenticators are FIDO2-certified phishing-resistant passkeys that enable passwordless authentication, significantly reducing the risk of social engineering. The company’s Digipass FX authenticators use the FIDO2 protocol, employing a private and public key pair system whereby private keys and biometric data never leave the device, thereby avoiding vulnerabilities associated with human error, such as phishing and password reuse.
Digital Agreements
OneSpan Sign supports a broad range of e-signature requirements from simple to complex, and from the occasional agreement to processing tens of thousands of transactions. OneSpan Sign provides multiple public cloud deployment options to meet global data residency needs. The solution is also available in a Federal Risk and Authorization Management Program (‘FedRAMP’) SaaS-level compliant cloud, allowing the U.S. government agencies to implement e-signatures in the cloud and meet General Services Administration (‘GSA’) security requirements.
Customers can fully ‘white label’ and configure OneSpan Sign to reinforce their brand for a seamless signing experience. Each step of the digital agreement workflow can be customized, from authentication to e-signing and secure digital storage. OneSpan Sign also provides comprehensive and secure electronic evidence for strong legal protection by capturing all actions that took place during the agreement process. This reduces the time and cost of gathering evidence and demonstrating legal and regulatory compliance. E-signature capabilities can be a critical component of the account opening and onboarding processes, providing a secure and user-friendly way to execute legally binding agreements.
OneSpan Notary is an online notary solution developed for organizations with in-house notaries. It includes live electronic signature, two-way secured videoconferencing, and strong identity proofing options, such as ID Verification and Knowledge-based Authentication (‘KBA’). It also simplifies the notarization process with guided workflows, the ability to upload eNotary Seal, recording, eJournaling, and audit trail capabilities in a single solution. OneSpan Notary is currently available for use in 30 U.S. states.
OneSpan Identity Verification gives banks and other financial institutions access to a wide range of identity verification services—all through a single API integration. This includes identity document (e.g., driver’s license, passport, etc.) capture and real-time authenticity verification, as well as facial comparison (‘selfie’) and liveness detection (the ability to detect whether a digital interaction is with a live human being) to establish that the individual presenting the identity document is the same person whose picture appears on the authenticated identity document. Starting January 1, 2024, the company began presenting OneSpan Identity Verification in the Digital Agreements segment to reflect the greater alignment of this solution with its Digital Agreements product portfolio.
OneSpan Integration Platform is a modern platform that enables organizations to easily integrate e-signatures powered by OneSpan Sign into well-known applications, such as Microsoft Apps, Google Workspace, Salesforce, and Workday. These pre-built integrations allow organizations to manage an efficient, modern digital agreement process. Unlike traditional API-based e-signature implementations that demand significant time and budget, the OneSpan Integration Platform offers a cost-effective, easy-to-deploy solution that addresses cross-departmental needs while enabling robust security and compliance.
Intellectual Property and Proprietary Rights and Licenses
The company holds patents in the U.S. and in other countries, which cover multiple aspects of its technology. These patents expire between 2026 and 2040. In addition to the issued patents, the company has several patent applications pending in the U.S., Europe, and other countries. Many of the company’s issued and pending patents are related to its Digipass product line.
The company furthermore has registrations for most of its trademarks in most of the markets where it sells the corresponding products and services, as well as registrations of the designs of many of the company’s Digipass devices, primarily in the European Union (‘EU’) and China.
‘OneSpan’ and other trademarks, trade names, or service marks of the company or its subsidiaries.
Research and Development
For the year ended December 31, 2024, the company incurred expenses, net of software capitalization, of $32.4 million for research and development.
Production
The company’s Digipass authentication devices are manufactured by third-party manufacturers at several independent factories in Southern China and one within the European Union, in Romania. The company maintains local personnel in China to conduct quality control and quality assurance procedures. Periodic visits to the factories are conducted by its personnel for quality management, assembly process review, and supplier relations.
Digipass devices are made primarily from commercially available electronic components, including microprocessors purchased from several suppliers. The company purchases microprocessors and arranges for shipment to its third-party manufacturers for assembly and testing in accordance with its design specifications. The microprocessors are the most important components of the devices which are not commodity items readily available on the open market.
The company’s software solutions are produced in-house or developed by third parties and sold under license.
Competition
The company’s main competitors in its identity verification and authentication markets are Gemalto (a subsidiary of Thales Group), RSA Security, and Yubico. There are also many other companies in adjacent areas, such as mobile device management (‘MDM’), threat protection, and identity and access management (‘IAM’), that offer competing services.
The company’s primary competitors for electronic signature solutions are DocuSign and Adobe Systems.
Sales and Marketing
The company’s solutions are sold worldwide through its direct sales force, as well as through distributors, resellers, systems integrators, and original equipment manufacturers. The company’s sales staff coordinates sales activity through both its sales channels and those of its partners, making direct sales calls either alone or with the sales personnel of its partners. The company’s sales staff also provides product education seminars to sales and technical personnel of resellers and distributors, and to potential end users of its products.
Customers and Markets
The majority of the company’s revenue is derived from financial institutions, which include traditional banks, credit unions, and online-only banks. The company also sells to the enterprise market segment, government, healthcare, and insurance industries in select regions around the globe.
The company’s top 10 customers contributed 20% of its total worldwide revenue in 2024.
Government Regulation
The company is subject to complex and evolving global regulations in the various jurisdictions in which its products and services are used. Also, because banking and financial services is its largest industry target market, the government regulations affecting the company’s customers in this area, such as the European Union Digital Operations Resilience Act, have a significant indirect effect on its business.
History
The company was founded in 1991. It was incorporated in 1997. The company was formerly known as VASCO Data Security International, Inc. and changed its name to OneSpan Inc. in 2018.