OneSpan

The business was founded in 1991 on hardware authentication tokens, and the models sit on top of a portfolio that predates them by decades. Strip them out today and most of what the company sells remains intact. That includes the authenticators, the multi factor stack and the application shielding, along with the developer toolkit, the identity checks and the electronic signature product. The inference layer is real and separately purchasable rather than decorative.

The mechanism has a sound shape. The model produces a score, rules the institution defines decide what happens, and the resulting action is proportionate rather than binary, since higher risk raises the authentication requirement instead of blocking outright. Alerts route to a fraud analyst through a single case management interface, so a person remains in the loop on the flagged population. No threshold, default policy or floor is published. The action space is described as customer defined, with nothing stating what the vendor will not allow, and step up friction applied to a legitimate customer has no described appeal.

Predictive models are tuned per channel and decide in real time whether a payment proceeds. There is no documentation, validation approach or drift policy, and no accuracy or detection figures. The headline claim is a familiar one among fraud vendors: fewer false positives, with no baseline and no rate. That leaves open what happened to the true positives. A model tuned to reduce analyst workload and a model tuned to catch fraud are not the same model, and nothing published distinguishes them.

A named customer engagement has a described scope: an Italian bank whose authentication was modernized for the revised European payments directive. There is also a large and specific installed base claim from a listed company. No outcome is attached to the named customer, and the quantified claims about the inference product are directional. The strongest quote in the launch material comes from an industry analyst rather than from a bank, and an analyst endorsing a category is not evidence about a product.

Nothing published says whether signals collected from one institution's customers inform models serving another. The question has force because the value of behavioral and device risk modeling rises with cross institutional exposure, so the commercial incentive to pool is strong. A vendor sitting inside the mobile applications of half the largest banks in the world is in a powerful position to do it. Silence here is not neutral.

The exposure is highly personal for a fraud product, and no privacy posture is published. The risk engine consumes device integrity signals, behavioral biometrics and transaction and beneficiary history on identified banking customers, which is continuous behavioral profiling of individuals. Nothing states how long those signals are retained, who may access them or what constrains their reuse.

No certification or trust portal is reflected here, and that is more likely a gap in this profile than a real absence. A listed security vendor selling authentication to half the largest banks in the world will hold attestations. It very likely also holds hardware and cryptographic certifications specific to authenticator devices. Those device level scheme certifications, alongside the usual organizational ones, would most likely sit on a dedicated certifications or compliance page.

Unlicensed and unsupervised as a firm. The product is built against named regulatory requirements, including European strong customer authentication and a central bank mandate in the Gulf with a stated compliance deadline, and the company publishes regulatory commentary from a named executive. All of that is product positioning and subject matter expertise rather than standing, and the bank remains the party answerable to supervisors.

No fairness testing or governance disclosure. The exposure is real and under discussed for this product category: adaptive authentication decides who is asked for additional proof, so model output translates directly into unequal friction between customers, and behavioural biometrics profile how a specific person holds and uses a device. Systematically higher challenge rates for particular groups would be invisible to the customer and unmeasured in anything published.

No recourse route and no allocation of responsibility. A customer wrongly scored as high risk experiences repeated challenges or a blocked payment with no explanation, no visibility of the score and no route to contest it, and the bank rather than the vendor carries the relationship and the regulatory exposure.

Machine learning and data modeling are described generically, with no model, provider, architecture or version named. Vendors that build their own detection models often disclose little about the supply chain, since nothing external forces the disclosure that a licensing relationship would.

The platform is positioned as open, working alongside a bank's existing controls rather than replacing them. It offers a mobile developer toolkit and application shielding embedded into the bank's own app, and the risk engine consumes signals from the online and mobile channels it protects. No named core banking, payments or case management system is identified, so integration is described by the surfaces it touches rather than by named counterparties.

The adaptive authentication product is described as a cloud service, and the wider portfolio has historically been available in both hosted and customer run forms. Nothing published states region, residency, tenancy or the choice between them. That is a live question for a vendor whose customers include banks in Europe and the Gulf operating under different data localization expectations.

OneSpan publishes no price, tier or unit for the risk or authentication products. The electronic signature line has historically been sold with published subscription tiers. If those remain public, at least one product in the portfolio is priced openly even though the inference products are not.

More than 10,000 customers with over half of the hundred largest global banks among them, spanning retail, mobile and corporate banking channels plus insurers and public sector buyers. Segment coverage runs from digital onboarding and identity checks through authentication and transaction fraud to electronic signature and agreement workflow. Geographic reach is global, and it is evidenced by product work against separate regulatory regimes in Europe and the Middle East rather than by a claim of worldwide presence.