OneSpan Announces Agreement to Acquire Build38 to Advance Next-Generation Mobile App Protection

Key Terms

sdk technical

An SDK (software development kit) is a bundled set of tools, code samples and instructions that lets outside developers build software that works with a company’s platform or product. Think of it as a toolbox and recipe that makes it faster and easier for others to create compatible apps or services. For investors, an SDK matters because widespread developer use can boost product adoption, create new revenue streams and strengthen customer lock‑in, signaling potential future growth.

runtime application self-protection technical

Runtime application self-protection (RASP) is a security technology built into software that watches the program from the inside while it runs and automatically detects and blocks attacks in real time. For investors, RASP matters because it lowers the chance of costly breaches, reduces potential regulatory and remediation expenses, and can be a marketable feature that strengthens customer trust—similar to a security guard inside a building who stops intruders before damage occurs.

authorized push payment financial

An authorized push payment is a bank or electronic transfer that the account holder actively approves to send money to another person or business—like pressing “send” on an instant transfer or wire. It matters to investors because if the payment results from a scam, mistake, or fraud the sender authorized, banks and payment firms can face reimbursements, legal claims, direct losses and reputational harm, all of which can affect earnings and regulatory scrutiny.

The acquisition will expand OneSpan's SDK-based mobile application security capabilities to help financial institutions combat evolving threats

BOSTON--(BUSINESS WIRE)-- OneSpan Inc. (NASDAQ: OSPN) today announced that it has entered into a definitive agreement to acquire Build38, a leader in next-generation mobile application protection solutions, to extend OneSpan’s investment in advanced mobile security technologies. The planned acquisition is expected to enhance OneSpan’s App Shielding offering by adding SDK-based security solutions that integrate in-app, cloud, and AI technologies. These enhancements will provide businesses with unmatched protection against the growing wave of attacks targeting the mobile channel, as well as critical intelligence and telemetry on the mobile devices where the applications are deployed.

Banks and financial institutions face growing pressure to secure digital channels while enhancing customer experience and operational efficiency. This urgency is underscored by the proliferation of AI-driven attacks and the sharp rise in mobile threats, targeting the primary channel through which customers interact with their banks. These trends illustrate the need for multi-layered security solutions that combine in-app, cloud, and AI-driven defenses.

OneSpan plans to integrate Build38’s advanced SDK-based approach to Runtime Application Self-Protection (RASP) to enhance its mobile security portfolio and deliver deeper in-app protection against attacks targeting applications and devices. This will enable OneSpan to deliver a safer, more secure digital experience for customers. Build38 is named as a Sample Vendor in the Gartner® Hype Cycle™ for Application Security, 2025. Build38 is a leading provider in Europe for securing mobile identities, including EUDI wallets, healthcare, and citizen applications. Its deep industry expertise and compliance with some of the world’s most rigorous certifications will complement OneSpan’s strategy to deliver leading security solutions. Together, the companies will set a new benchmark for trust and innovation in mobile identity protection.

“Our goal is to provide leading financial institutions with the most complete protection for their customer interactions—covering strong authentication, transaction signing, application protection, and fraud detection,” said Victor Limongelli, CEO of OneSpan. “Build38’s technology already protects over 250 million endpoints. Its SDK enables banks to incorporate next-generation RASP protection within their mobile apps and provides more comprehensive data about the mobile devices and the threats facing them. As mobile threats surge and the market moves toward embedded security and AI-driven defenses, we believe this acquisition will position us ahead of the curve and validate our strategy to meet the evolving needs of our customers.”

“Build38 was founded to redefine mobile application security through next-generation RASP, combining cloud delivered services and AI innovation,” said Dr. Christian Schläger, CEO of Build38. “Joining OneSpan will allow us to scale this vision globally and deliver best-in-class protection to banks and businesses that demand the highest security standards.”

Today’s news builds on OneSpan’s recent strategic initiatives to accelerate innovation and strengthen its leadership in digital security. In June 2025, OneSpan acquired Nok Nok Labs Inc., advancing passwordless authentication capabilities and reinforcing its position in authentication. In October 2025, OneSpan announced a strategic investment in ThreatFabric to enhance fraud prevention solutions, creating new opportunities to deliver comprehensive protection for financial institutions worldwide.

The planned transaction is currently expected to close by March 2026, subject to regulatory approvals and other customary closing conditions.

Gartner Disclaimer: Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation.

About Build38
Build38 is the leading provider of mobile app security solutions, offering advanced protection for mobile applications across various industries including mobile banking, payments, SoftPOS, fintech, mobile ID, crypto wallets, automotive, and eHealth. With its cutting-edge technology and commitment to innovation, Build38 ensures that mobile apps are secure, resilient, and compliant with industry standards. Founded in 2019 as a Spin-off of Giesecke+Devrient, the company has attracted strategic investments from G+D Ventures, eCAPITAL Entrepreneurial Partners, Criteria Venture Tech, and Tikehau Capital.

About OneSpan
OneSpan provides secure authentication, identity, electronic signature and digital workflow solutions that protect and facilitate digital transactions and agreements. The Company delivers products and services that automate and secure customer-facing and revenue-generating business processes for use cases ranging from simple transactions to workflows that are complex or require higher levels of security. Trusted by global blue-chip enterprises, including more than 60% of the world’s 100 largest banks, OneSpan processes millions of digital agreements and billions of multi-factor authentication transactions in 100+ countries annually.

For more information, go to www.onespan.com. You can also follow @OneSpan on X (Twitter) or visit us on LinkedIn and Facebook.

Forward-Looking Statements
This press release contains forward-looking statements within the meaning of applicable U.S. securities laws, including statements regarding: our proposed acquisition of Build38, which has not yet been completed and is subject to customary closing conditions, including regulatory approvals; the expected timing for completing the acquisition; our plans regarding Build38’s technology and its anticipated contribution to OneSpan’s product portfolio; and the general impact of, and outcomes from, the proposed acquisition of Build38. Forward-looking statements may be identified by words or phrases such as "seek," "believe," "plan," "estimate," "anticipate," “expect," "intend," "continue," "outlook," "may," "will," "should," "could," or "might" and other similar expressions. These forward-looking statements involve risks and uncertainties, as well as assumptions that, if they do not fully materialize or prove incorrect, could cause our results to differ materially from those expressed or implied by such forward-looking statements. Factors that could materially affect our business and financial results include, but are not limited to the factors described in the “Risk Factors” section of our Annual Report on Form 10-K for the year ended December 31, 2024, as updated by the “Risk Factors” section of our subsequently filed Quarterly Reports on Form 10-Q. Our filings with the Securities and Exchange Commission and other important information can be found in the Investor Relations section of our website at investors.onespan.com. We do not have any intent, and disclaim any obligation, to update the forward-looking information to reflect events that occur, circumstances that exist or changes in our expectations after the date of this press release, except as required by law.

Unless otherwise noted, references in this press release to “OneSpan,” “Company,” “we,” “our,” and “us” refer to OneSpan Inc. and its subsidiaries.

View source version on businesswire.com: https://www.businesswire.com/news/home/20260112145094/en/

Media contact:

Nicole Bosgraaf

Director, Brand & Communications

+1-401-219-2131

nicole.bosgraaf@onespan.com



Investor contact:

Joe Maxa

Vice President of Investor Relations

+1-312-766-4009

joe.maxa@onespan.com

Source: OneSpan Inc.