OneSpan
OneSpan (Nasdaq: OSPN), formerly VASCO Data Security, provides hardware and software authentication, transaction signing, and mobile app shielding used by a majority of the world's largest banks.
Visit Website ↗ + Add to CompareOverview
OneSpan (Nasdaq: OSPN) is a publicly traded identity security and digital agreement company built on the legacy of VASCO Data Security, one of the earliest vendors of hardware authentication tokens for banking. The company’s core cybersecurity business today centers on strong customer authentication, transaction signing, mobile app shielding (runtime application self-protection for banking apps), and fraud/risk analytics, sold predominantly to banks and other regulated financial institutions that need to authenticate high volumes of transactions without relying solely on SMS one-time passcodes.
OneSpan’s scale is its main asset: the company states it processes billions of secure authentication transactions annually across 120-plus countries and counts more than 60% of the world’s 100 largest banks as customers. Its Digipass hardware and software tokens and its Cronto/Mobile Security Suite line for app shielding and fraud detection have been embedded in bank authentication flows for years, giving it a large, sticky installed base that is hard for newer identity vendors to displace in regulated financial environments. In 2026 the company introduced DigipassONE, a unified authentication platform folding transaction signing, digital credentials, and analytics into shared platform services, alongside early-access work on digital wallet credential issuance shown at Identiverse 2026.
Separately from cybersecurity, OneSpan also runs a Digital Agreements business (e-signature and identity verification for agreement workflows), which is a distinct product line from its authentication/fraud business; this profile is scoped to OneSpan’s identity and authentication security offering rather than the e-signature business.
Innovation Matrix Assessment
OneSpan shipped DigipassONE and previewed digital-credential/wallet issuance at Identiverse 2026, showing active platform consolidation, but as a mature public company its release cadence is measured and incremental rather than startup-fast.
The company reports processing billions of authentication transactions annually across 120+ countries for a customer base that includes more than 60% of the world's 100 largest banks, a scale of production operations that few identity vendors can claim, corroborated by its own SEC filings and long operating history since the VASCO era.
As a public company (Nasdaq: OSPN) OneSpan doesn't have startup-style funding momentum; growth signal instead comes from steady product news (DigipassONE launch, Identiverse 2026 digital-credentials debut) rather than headline-grabbing raises or triple-digit growth, so this is scored as stable rather than high-momentum.
OneSpan is largely defending and modernizing an incumbent hardware/software-token authentication position (its Digipass line dates to the VASCO era) rather than introducing a structurally new approach; DigipassONE is a platform consolidation of existing capabilities more than a disruptive architecture.
Deployment at more than 60% of the world's 100 largest banks over a multi-decade track record is a strong real-world efficacy signal for its core authentication and transaction-signing use case, though this is based on OneSpan's own customer-count disclosure rather than an independent audit.
Strong customer authentication and transaction signing remain directly relevant to fraud prevention and regulatory requirements (e.g., PSD2-style strong customer authentication) in banking and financial services, though OneSpan's relevance is concentrated in that vertical rather than broad enterprise IAM.
Why CISOs Should Care
For CISOs in banking and financial services, OneSpan offers a proven, regulator-tested authentication and transaction-signing layer with a multi-decade deployment track record across the largest global banks, reducing vendor and integration risk versus a newer entrant.
What Makes It Different
OneSpan's differentiation is depth and scale in regulated financial-services authentication (hardware tokens, transaction signing, mobile app shielding) built on a 30+ year track record, versus newer IAM vendors that lead with broad workforce or customer identity platforms but lack that banking-specific pedigree.
The Matrix Verdict
62/100 — INCREMENTAL INNOVATOR
A financially stable, publicly traded incumbent with real scale and a defensible niche in bank-grade authentication; it is evolving (DigipassONE, digital credentials) rather than disrupting, and CISOs should evaluate it primarily as a proven, lower-risk choice for regulated transaction authentication rather than a cutting-edge IAM platform.
Editorial Note: Claims vs. Verified Findings
Independently verified: public-company status (Nasdaq: OSPN), 1991 founding as VASCO Data Security, and current Boston HQ are confirmed via SEC filings and financial data providers. Vendor-sourced and not independently audited: the specific claims of processing 'billions' of transactions annually and serving 'more than 60%' of the top 100 global banks come from OneSpan's own marketing materials and were not cross-verified against an independent customer census.
Sources
Alternatives to OneSpan
Teleport
An identity-based infrastructure access platform issuing short-lived cryptographic identities for humans, machines, and AI agents in place of…
SpecterOps
Identity attack-path security specialist behind BloodHound, the widely used open-source tool for mapping Active Directory and Entra ID…
Socure
AI-driven identity verification and fraud platform used by banks, fintechs, and government agencies to validate identities during digital…
Keyfactor
Machine identity and PKI management platform helping enterprises secure certificates, keys, and post-quantum cryptography readiness at scale.
Astrix Security
Non-human identity security platform that discovers and governs API keys, OAuth tokens, service accounts, and AI-agent credentials across…
CyberArk
The market-leading privileged access management vendor, extending from vaulted human credentials into machine identity and secrets management.