OneSpan Strategy and Business Model

Executive Overview

OneSpan is a cybersecurity and digital agreements software company focused on helping banks and other regulated organizations secure high-value transactions and document workflows. Headquartered in Boston and founded in 1991 as VASCO Data Security, the company built its original franchise in authentication hardware and banking security, then expanded into e-signature and digital agreement software through acquisitions and product development. Today, management commonly discusses the portfolio in two main solution areas: Security Solutions and Digital Agreements. Those offerings span multi-factor authentication, transaction signing, mobile security, e-signature, workflow orchestration, and related identity-sensitive steps in customer onboarding and document execution.

OneSpan’s strategic position is more specialized than broad horizontal software vendors. Its focus is on compliance-sensitive, trust-heavy workflows where auditability, deployment flexibility, and security matter more than basic electronic signing alone. The company serves customers globally, with particularly strong roots in Europe and North America. The business mix is also changing: management has been working to increase the share of recurring software and cloud revenue relative to legacy hardware and perpetual-license revenue. In FY2023, the latest full year available in company filings at the time of this writing, OneSpan generated about $241 million in revenue.

OneSpan at a Glance

Logo
Common name	OneSpan
Full legal name	OneSpan Inc.
Headquarters	Boston, Massachusetts, United States
Ownership	Public company; no controlling shareholder publicly disclosed
Ticker	OSPN
Exchange	NASDAQ
Market Cap	$502.71M
Revenue (FY2024)	#N/A
Founding / major historical milestones	Founded in 1991 as VASCO Data Security; built a banking authentication franchise; acquired Silanis Technology in 2015 to enter e-signature; rebranded as OneSpan in 2018; acquired Dealflo in 2021 to add workflow and onboarding capabilities
Industry or industries	Cybersecurity software; digital agreements; identity and transaction security
Key products or services	E-signature, digital agreement workflow, authentication, transaction signing, mobile app security, hardware and software authenticators
Geographic footprint	Global, with customers across North America, Europe, and Asia-Pacific; historically strong presence in financial services
Business segments as officially reported	One reportable segment; management also discusses the business in Digital Agreements and Security Solutions solution lines
Company website	https://www.onespan.com/

1. What Is the Strategy of OneSpan?

Based on OneSpan’s FY2023 Form 10-K and 2024 investor communications, the company’s strategy is to evolve from a legacy authentication vendor into a more recurring-revenue software company centered on secure digital agreements and high-assurance transaction security for regulated enterprises. The best way to interpret that strategy is through the Playing to Win framework.

1a. What is the winning aspiration of OneSpan?

OneSpan’s winning aspiration is to be a trusted software and security provider for digital transactions and agreements where failure is costly, regulated, or reputationally damaging. In practical terms, management has framed winning around growing recurring revenue, expanding software and cloud mix, increasing the contribution of Digital Agreements, and improving profitability relative to the company’s legacy hardware-heavy model. The aspiration is not to be the broadest identity platform or the lowest-cost e-signature vendor; it is to be the preferred provider where security, auditability, and compliance are central to the buying decision.
1b. Where does OneSpan play?

OneSpan plays primarily in regulated enterprise workflows, especially financial services. Its products are used in customer onboarding, account opening, loan origination, document execution, secure login, transaction approval, and mobile application protection. Geographically, the company serves customers globally, with especially established positions in Europe and North America. It also plays across deployment models: cloud, hybrid, and on-premises. That matters because many banks and regulated customers still require deployment flexibility that newer cloud-only vendors may not always match.
1c. How does OneSpan plan to win?

OneSpan’s plan to win is to combine security depth with digital agreement workflow capabilities. In Digital Agreements, it aims to compete on higher-assurance and more regulated use cases rather than only on commodity e-signature. In Security Solutions, it seeks to defend and modernize its installed base by moving customers toward software, subscription, mobile, and passwordless approaches. A key part of the strategy is cross-sell: using long-standing relationships in banking and regulated industries to sell a broader set of digital agreement and identity-related solutions. The company’s ability to support complex compliance needs and mixed deployment environments is an important differentiator.
1d. What capabilities must OneSpan have in place?

To execute this strategy, OneSpan needs strong capabilities in cryptography, authentication, digital signing, workflow software, secure cloud operations, systems integration, and regulated-industry sales. It also needs disciplined customer-success capabilities to protect renewals and migrate legacy customers to newer offerings. Because the company still supports a meaningful installed base of legacy authentication products, it must maintain both innovation capabilities and lifecycle-management capabilities at the same time. That dual requirement is one reason execution discipline matters so much.
1e. What management systems does OneSpan require?

OneSpan needs management systems that track recurring revenue, renewal performance, sales efficiency, product-mix change, gross-margin progression, and operating profitability. It also needs strong security and compliance governance, because secure software development, uptime, and auditability are part of the product promise. Finally, capital-allocation discipline matters. OneSpan’s strategy depends on investing in growth products while managing legacy businesses for cash, and on using acquisitions selectively rather than trying to build every adjacent capability internally.

2. What Are the Current Strategic Initiatives of OneSpan?

OneSpan’s recent public messaging points to several concrete strategic initiatives.

Expand the Digital Agreements platform. OneSpan has been building out more than basic e-signature. The company has emphasized agreement workflows that include document preparation, secure signing, virtual collaboration, and identity-sensitive steps that matter in regulated industries such as lending, account opening, and insurance processes.
Increase recurring and cloud-based revenue. A major theme of the company’s transformation has been shifting the revenue base away from one-time hardware and perpetual-license sales toward subscriptions, cloud services, maintenance-like recurring streams, and transaction-based software consumption.
Modernize Security Solutions. OneSpan continues to support its legacy authentication franchise, but management has been steering customers toward mobile-first, software-based, and passwordless approaches where appropriate. This is strategically important both for retention and for improving revenue quality.
Cross-sell into the installed customer base. OneSpan’s long relationships with banks and regulated enterprises are a strategic asset. The company’s current approach appears designed to use those relationships to sell additional digital agreement and workflow capabilities, not just stand-alone authentication products.
Focus on regulated and high-assurance use cases. Rather than chasing the broadest possible e-signature market, OneSpan has focused on use cases where security, audit trail, identity assurance, and deployment control create a more defensible niche.
Use selective capability-building M&A. Prior acquisitions such as Dealflo added workflow and onboarding functionality, and in 2024 OneSpan announced an acquisition of Nok Nok Labs to strengthen passwordless authentication. The pattern suggests targeted capability expansion rather than large-scale consolidation.
Preserve profitability while investing in growth. OneSpan’s public communications have also emphasized operational discipline. That is typical of a company managing a transition from legacy security revenue to a more software-led model.

3. What Is the Business Model of OneSpan?

OneSpan sells software and security products that help enterprises secure digital transactions and complete sensitive agreements. Customers are not buying generic productivity software; they are buying trust, compliance support, and reduced fraud or operational risk in specific workflows.

What customers actually buy: Customers buy e-signature capability, digital agreement workflow, authentication, transaction signing, mobile security, and related tools that help verify, approve, and document high-value interactions. In some cases, they also buy implementation services, integration work, support, or hardware authenticators.

Recurring versus one-time revenue: The company’s recurring or repeat-driven revenue comes from subscriptions, cloud services, software maintenance and support, transaction-based usage, and renewals. One-time revenue tends to come from hardware device sales, certain perpetual or term license arrangements, and professional services tied to deployment. A central strategic objective has been to increase the recurring share.

How pricing power works: OneSpan has more pricing power in security-critical and compliance-sensitive deployments than in commoditized signing tools. Pricing is supported by switching costs, integration into customer workflows, regulatory requirements, and the cost of failure. That said, some parts of the market, especially basic e-signature, are competitive and can limit price realization.

Why the business mix matters: Software subscriptions and cloud services generally produce better revenue visibility and often better gross margins than hardware-heavy or license-heavy sales. Legacy authentication products may still generate useful cash, but a mix shift toward Digital Agreements and cloud security is strategically important because it can improve valuation quality, not just revenue growth.

What drives margins and cash generation: Gross margin depends on software mix, hardware content, hosting and third-party service costs, and professional-services utilization. Operating margin depends heavily on R&D discipline and go-to-market efficiency because enterprise software selling costs can be meaningful. Cash generation is helped by the relatively low capital intensity of software, renewal revenue, and the ability to manage legacy products for cash while investing selectively in newer offerings.

4. What Products and/or Services Does OneSpan Sell?

OneSpan’s portfolio can be understood in two broad solution families that management frequently highlights.

Digital Agreements

E-signature: Enterprise-grade electronic signing for regulated workflows.
Agreement workflow and orchestration: Tools that help move documents and approvals through structured business processes, especially onboarding and high-assurance customer journeys.
Secure collaboration and document execution: Offerings such as virtual-room functionality for complex transactions and multi-party coordination.
Identity-sensitive workflow steps: Depending on the workflow, this can include verification, approval, and audit controls around who is signing and when.

Security Solutions

Multi-factor authentication: Hardware and software authenticators used to validate users.
Transaction signing: Security tools designed to verify specific high-risk transactions, particularly in banking and financial services.
Mobile security: Software to harden mobile applications and secure app-based transactions.
Passwordless and modern authentication capabilities: A strategic area as enterprises look to reduce dependence on passwords and older authentication methods.

Historically, Security Solutions appears to have been the company’s economic base and installed-customer foundation. Digital Agreements appears to carry greater strategic importance for growth because it broadens OneSpan beyond authentication and increases exposure to recurring workflow software.

5. What Are the Key Competitors or Peers of OneSpan?

OneSpan does not compete against one company across its entire portfolio. Its competitive set changes by product category.

DocuSign: The most visible e-signature and agreement-cloud competitor, especially in enterprise document workflows.
Adobe: Adobe Acrobat Sign is a major enterprise e-signature offering with strong document ecosystem advantages.
Entrust: Competes in digital identity, authentication, digital signing, and credential-related security.
Thales: Through its identity and security portfolio, including SafeNet, Thales competes in authentication and enterprise security infrastructure.
HID Global: A significant identity and access player spanning credentials, authentication, and secure identity infrastructure.
Okta: Primarily a cloud identity platform; more workforce- and enterprise-access-oriented than OneSpan, but adjacent in authentication and passwordless use cases.
Ping Identity: Competes in customer and workforce identity, including modern authentication and access management.
Signicat: A notable European digital identity and signing player, particularly relevant in regulated and cross-border workflows.
Jumio: More focused on identity verification and onboarding, but relevant where OneSpan competes in high-assurance customer journeys.

The most important competitive reality is that OneSpan sits between categories. It is neither a pure-play e-signature vendor nor a broad identity platform. Its defensible niche is where digital agreements and security controls intersect.

6. What Is the Marketing Strategy of OneSpan?

OneSpan’s marketing strategy appears to be enterprise-focused, compliance-oriented, and highly targeted. This is not a consumer brand business and not a classic self-serve software motion. Marketing is primarily designed to support complex B2B buying decisions in regulated industries.

Core elements of the marketing approach include:

Account-based and vertical marketing: Financial services is the natural center of gravity, so messaging is tailored to banking, lending, onboarding, and fraud-sensitive workflows.
Thought leadership and trust messaging: Security, digital trust, compliance, and operational risk reduction are more important themes than lifestyle or broad brand awareness.
Field and partner marketing: For enterprise software sold through direct sales teams, technology partners, and integrators, co-marketing and field support matter more than mass-market performance advertising.
Product and use-case education: Buyers often need to understand how identity, authentication, workflow, and e-signature fit together in an end-to-end process. That makes demos, webinars, case studies, and solution education important.

Marketing seems to be a supporting capability rather than the company’s primary differentiator. OneSpan’s advantage is more likely to come from product fit, regulatory credibility, and installed customer relationships than from superior brand spending.

7. What Are the Key Customer Segments of OneSpan?

OneSpan’s customer base is concentrated in enterprise and regulated markets rather than broad small-business or consumer channels.

Banks and financial institutions: The company’s historic core. Use cases include authentication, transaction security, account opening, loan workflows, and secure document execution.
Insurance companies: Relevant for policy issuance, claims, and signed workflows that require strong audit trails.
Healthcare and life sciences organizations: Relevant where document execution and identity-sensitive workflows require compliance controls.
Government and public-sector entities: A natural fit for high-assurance identity and document workflows, though likely not the largest segment.
Other regulated enterprises: Any enterprise with sensitive transactions, strong compliance requirements, or elevated fraud risk can fit the portfolio.

The customer mix appears diversified across enterprise accounts, but the business is meaningfully oriented toward financial services. That concentration is strategically useful because it supports domain expertise, yet it also means bank technology budgets and risk appetites matter disproportionately.

8. What Is the Sales Model of OneSpan?

OneSpan uses a consultative enterprise sales model. Large customers typically buy through direct sales teams supported by solution engineers, professional services, and customer-success resources. Sales cycles can be long because the products often sit inside regulated workflows, touch sensitive customer data, or require systems integration.

The company also uses channel and partner routes where appropriate. Those can include technology alliances, regional partners, and implementation partners that help embed OneSpan into broader transformation or compliance projects. In some cases, partner relationships matter because customers are buying a workflow, not just a stand-alone tool.

The channel structure affects growth in several ways:

Direct sales improves customer intimacy and is important for large banks and complex deployments.
Partner-led sales can improve reach and lower acquisition cost in certain geographies or solution categories.
Renewals and expansions are strategically important because recurring revenue quality depends on customer retention and cross-sell.

For consultants, this sales structure creates opportunities in segmentation, account planning, partner strategy, sales-process redesign, and customer-success optimization.

9. In What Geographies Does OneSpan Operate?

OneSpan operates globally. Its principal executive offices are in Boston, and the company has long-standing operational roots in Europe because of its history in banking security. Its customer base spans North America, Europe, and Asia-Pacific.

From a practical standpoint, Europe and North America appear to be the most important regions. Europe matters because many of OneSpan’s historic banking relationships and legacy authentication deployments were built there. North America matters because it is a large software and enterprise-security market and includes the company’s current headquarters and important go-to-market activity. Asia-Pacific is relevant as a served market, especially for financial institutions and high-assurance digital banking use cases, though likely smaller in absolute scale.

Like many mid-sized enterprise software companies, OneSpan is globally present without needing a massive physical footprint everywhere. What matters more than office count is the ability to support regulated customers across sales, implementation, hosting, and compliance requirements.

10. Who Are the Owners of OneSpan?

OneSpan is a publicly traded company listed on NASDAQ under the ticker OSPN. As of recent SEC filings in 2024, no controlling shareholder was publicly disclosed. Ownership appears to be primarily institutional, with large asset managers such as BlackRock and The Vanguard Group among notable shareholders in public filings. As with many smaller public software companies, the shareholder base can also include active or value-oriented investment firms, but control remains dispersed.

11. How Is OneSpan Organized?

OneSpan appears to be managed as a single reportable segment for financial reporting purposes, even though management and investors often discuss the business in two solution lines: Digital Agreements and Security Solutions.

At a practical level, the company is organized around:

Product families: Digital Agreements and Security Solutions.
Functional teams: Product management, R&D, sales, marketing, services, support, and corporate functions.
Regional go-to-market coverage: Sales and customer coverage across the Americas, Europe, and Asia-Pacific.
Global subsidiaries: The U.S.-listed parent operates through international subsidiaries that support sales, development, and delivery.

This structure is typical for a mid-sized enterprise software company with both legacy products and newer growth platforms. The organizational challenge is balancing focus: protecting the installed base while building a faster-growing software franchise.

12. How Does OneSpan Operate?

Day to day, OneSpan operates as a specialized software and security vendor. Its value creation depends on building and maintaining trusted applications, selling them into regulated workflows, integrating them into customer environments, and then retaining and expanding those accounts over time.

The operating model typically includes:

Product development: Building and maintaining authentication, transaction security, e-signature, and workflow software.
Security and compliance: Managing secure development, system reliability, and auditability, which are central to the product promise.
Enterprise selling: Running long-cycle sales processes with large institutions and regulated buyers.
Implementation and integration: Connecting OneSpan solutions to customer applications, business processes, and identity environments.
Customer support and renewals: Ensuring uptime, support quality, and ongoing contract renewals or migration to newer platforms.
Legacy product fulfillment: For hardware authentication products, coordinating manufacturing and delivery through supply partners.

The main operational complexities are not factory-style manufacturing issues. They are software reliability, customer integration difficulty, migration from legacy products, and the need to serve highly regulated customers that often move slowly and require customized deployment choices.

13. What Are the Growth Opportunities for OneSpan?

The most plausible growth opportunities for OneSpan are closely tied to its installed base and to the overlap between digital security and digital agreements.

Cross-sell Digital Agreements into existing security accounts. This is likely the most strategically attractive opportunity because OneSpan already has trusted relationships in regulated environments.
Migrate legacy authentication customers to cloud and subscription offerings. That can improve revenue quality and defend customer relationships as authentication methods evolve.
Expand in high-assurance workflows. Lending, account opening, wealth management, insurance documentation, and other regulated journeys remain fertile areas for secure agreement automation.
Broaden passwordless and modern authentication capabilities. Enterprise demand is shifting away from passwords and hardware-only methods toward more flexible, standards-based approaches.
Selective tuck-in acquisitions. Capability-driven M&A can help OneSpan fill gaps in identity, workflow, or trust infrastructure faster than internal development alone.
Partner-led expansion. More effective use of system integrators, technology partners, and channel partners could widen reach without fully rebuilding the sales model.

The main constraints are also clear: intense competition in e-signature and identity, long enterprise sales cycles, budget pressure at financial institutions, and the execution challenge of managing legacy products while investing in newer software categories.

14. What Is the History of OneSpan?

OneSpan traces its roots to 1991, when the company was founded as VASCO Data Security. The business originally became known for authentication products, especially strong-authentication devices and security tools used by banks and financial institutions.

1991: Founded as VASCO Data Security, with an early focus on security and authentication technologies.
1990s to 2000s: Built a position in banking security, especially around authentication and transaction protection.
2015: Acquired Silanis Technology, a significant step into enterprise e-signature and digital agreements.
2018: Rebranded from VASCO Data Security to OneSpan, reflecting a broader digital-trust and transaction-security strategy.
2021: Acquired Dealflo, adding workflow and onboarding capabilities that fit the company’s digital agreement expansion.
2020s: Continued repositioning toward recurring software, cloud delivery, and broader digital agreement workflows while still managing its authentication installed base.

The broad arc of OneSpan’s history is a strategic transition: from a narrower authentication vendor to a more diversified provider of secure digital agreements and transaction security.

15. What Are the Key Brands Owned by OneSpan?

Branding matters at OneSpan, but mainly as a solution architecture for enterprise buyers rather than as a consumer-facing brand system.

OneSpan: The master brand covering the company’s secure digital agreements and transaction-security positioning.
OneSpan Sign: The company’s core enterprise e-signature offering, especially relevant in regulated workflows.
DIGIPASS: A long-standing authentication brand associated with hardware and software authenticators.
Cronto: A transaction-signing and visual security technology used in banking and high-assurance approval flows.
Virtual Room: A digital-agreements capability relevant for more complex or collaborative transaction workflows.

In strategic terms, the OneSpan master brand is more important than any one product label because the company is trying to sell an integrated trust and workflow story, not a collection of unrelated tools.

16. What Is the Technology Strategy of OneSpan?

Technology is central to OneSpan’s competitiveness because the product itself is trust infrastructure. The company’s technology strategy appears to rest on four pillars: secure architecture, deployment flexibility, integration, and category convergence.

Secure architecture matters because OneSpan sells into workflows where identity, approval, and non-repudiation are core requirements. That means encryption, authentication controls, audit trails, and resilient cloud or on-premises operation are not add-ons; they are the product.

Deployment flexibility is also important. Many buyers in banking and regulated industries still want options that range from cloud to hybrid to more controlled enterprise environments. Supporting that range helps OneSpan compete where cloud-only vendors may face resistance.

Integration is another critical element. OneSpan’s products need to fit into customer applications, onboarding flows, mobile apps, and enterprise systems. APIs, workflow connectivity, and product interoperability therefore matter as much as front-end features.

Category convergence is the longer-term theme. OneSpan’s strategic logic is that authentication, transaction security, identity-sensitive workflows, and digital agreements should work together. If the company executes well, its technology stack becomes more valuable as a combined platform than as separate point products.

17. What Is the R&D Strategy of OneSpan?

R&D is important at OneSpan because the company competes in software categories where trust, regulatory fit, and product depth matter. The company appears to be directing development toward areas that can improve recurring revenue quality and strengthen solution breadth in regulated workflows.

Key R&D priorities likely include:

Digital Agreements functionality: Improving workflow, usability, collaboration, and end-to-end agreement execution for enterprise customers.
Modern authentication: Advancing mobile, software-based, and passwordless authentication capabilities.
Security hardening: Maintaining the cryptographic, security, and audit features that underpin the company’s value proposition.
Integration and platform capabilities: Making it easier for customers and partners to embed OneSpan products into larger digital journeys.

A notable R&D challenge is portfolio balance. OneSpan must continue supporting legacy authentication products that customers still rely on while investing in newer cloud and digital-agreement capabilities. In that sense, part of the R&D strategy is not only innovation, but intelligent resource allocation across an uneven portfolio.

18. What Major Acquisitions Has OneSpan Made?

Acquisitions have played an important but selective role in OneSpan’s strategic repositioning. The company does not appear to rely on serial M&A as its core model. Instead, it has used deals to add capabilities that support the shift from authentication-only products toward broader digital trust workflows.

Silanis Technology (2015): This was a major strategic deal. Silanis brought enterprise e-signature capability, which later became a foundation of OneSpan Sign and the broader Digital Agreements push.
Dealflo (2021): Dealflo added workflow, onboarding, and agreement-orchestration capabilities, helping OneSpan move further upstream into customer journeys rather than competing only at the point of signature.
Nok Nok Labs (announced in 2024): OneSpan announced this acquisition to strengthen passwordless authentication and standards-based identity capabilities. Strategically, it fits the company’s effort to modernize Security Solutions and stay relevant as authentication methods evolve.

The pattern is consistent: OneSpan uses M&A to fill capability gaps in adjacent trust layers, not to assemble a sprawling conglomerate. The strategic question is whether those acquired capabilities can be integrated into a clearer, more scalable platform story.

19. How Companies Like OneSpan Leverage Independent Consultants through Umbrex

Companies like OneSpan often need specialized consulting support, but not always a full consulting team with Big Four or top-strategy-firm overhead. Umbrex has built a global community of more than 8,000 independent management consultants based in over 50 countries, including alumni of McKinsey, Bain, BCG, and other leading firms. For a company like OneSpan, that model is especially relevant when management needs targeted expertise in strategy, pricing, growth, operations, organization, finance, technology, ERP, and AI during a software-transition phase.

Representative projects Umbrex consultants could support for a company like OneSpan include:

Designing a cross-sell strategy to expand Digital Agreements adoption within OneSpan’s existing banking and regulated-enterprise customer base.
Reworking pricing and packaging across hardware, software, subscription, and transaction-based offerings to improve recurring revenue quality.
Building a migration playbook to move legacy authentication customers toward cloud, mobile, and passwordless solutions with minimal churn.
Conducting a segment-by-segment growth diagnostic for regulated industries such as banking, insurance, and healthcare.
Redesigning the go-to-market model for enterprise accounts, including account-based marketing, partner roles, and sales coverage.
Supporting post-merger integration for tuck-in acquisitions in identity, workflow, or authentication, including operating-model and product-roadmap alignment.
Rationalizing the product portfolio to clarify where OneSpan should invest, harvest, partner, or exit in legacy versus growth categories.
Improving customer-success and renewal operations to raise retention, increase expansion revenue, and strengthen ARR predictability.
Developing an international expansion plan that prioritizes the right regions, channels, and regulated use cases rather than broad undifferentiated growth.
Creating an AI and automation roadmap for internal operations or customer-facing workflows, while keeping governance and compliance requirements front and center.