Build38
Build38 (now Build38 by OneSpan) provides SDK-based Runtime Application Self-Protection and AI-powered mobile application security to financial institutions, healthcare, automotive, and digital identity enterprises, protecting over 250 million endpoints globally through its RASP and cloud threat intelligence platform.
- Company typePrivate
- Founded2019
- HeadquartersMunich, Germany
- Headcount51–100
- GTM typeB2B
- OfferingSoftware
What Build38 does
Build38, founded in 2019 as a spin-off from Giesecke+Devrient (G+D), is a Munich-based mobile application security company with operations in Barcelona that provides SDK-based Runtime Application Self-Protection (RASP) for enterprise mobile applications. The company's core technology embeds security mechanisms directly into mobile apps to defend against tampering, hooking, repackaging, data theft, key compromise, and API abuse, augmented by an AI-powered active hardening engine that adapts protection to real-time device and threat conditions. Supporting its core RASP product are the Traceboard console for no-code security policy management, a Mobile Threat Visibility Dashboard, and a Cloud Threat Intelligence Platform fed by telemetry from over 250 million protected endpoints across 10,000+ catalogued device models and 4 geo-redundant cloud locations.
Build38's primary customer segment is financial institutions, including named enterprise accounts such as La Caixa (a top 10 global bank with 8 million protected users) and Verimi (a top European digital identity app), with secondary expansion into healthcare, automotive, and digital identity verticals including EUDI wallet implementations. The company sells through a B2B enterprise sales motion with subscription and recurring licensing revenue, and was backed by €16 million in total funding including a €13M Series A led by Tikehau Capital in February 2023. In Q1 2026, Build38 was acquired by OneSpan Inc. (NASDAQ: OSPN) for $34.6 million, and its technology now powers OneSpan's Next-Gen App Shielding product distributed to over 1,000 banking entities worldwide.
Build38 firmographics
Firmographics- Name
- Build38
- Legal name
- Build38
- Website
- https://build38.com
- Company type
- Private
- Founded year
- 2019
- Operating status
- Acquired
- Headcount range
- 51–100 employees
- Short description
- Build38 (now Build38 by OneSpan) provides SDK-based Runtime Application Self-Protection and AI-powered mobile application security to financial institutions, healthcare, automotive, and digital identity enterprises, protecting over 250 million endpoints globally through its RASP and cloud threat intelligence platform.
- Ownership category
- akta.pro rank
Build38 industry classification
Industry- Product category
- Mobile Application Security
- NAICS
- Software Publishers (5132)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Runtime Application Self-Protection & In-App Detection (HDADACAI)
- akta.pro secondary industry
- Mobile Application Security (App Shielding, Anti-Tamper) (HDADACAL)
Keywords
Where Build38 is headquartered
LocationHeadquarters
- HQ city
- Munich
- HQ country
- Germany
- HQ region
- Europe
Offices2 records
Markets served
Build38 business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Infrastructure, Marketing or Sales, Operations
Revenue model
- Mobile Application Security Solutions: SDK-based mobile app security platform providing threat protection, application shielding, and threat intelligence to enterprises. Revenue derived from licensing and subscription model for protection of mobile applications.
- Acquisition by OneSpan: Build38 was acquired by OneSpan Inc. in Q1 2026 for $34.6 million, integrating into OneSpan's cybersecurity portfolio as Next-Gen App Shielding solution
Go-to-market motion1 record
Distribution channels2 records
Marketing channels3 records
Build38 product offering
Product offeringCore offering
Build38 provides a mobile application protection platform that embeds SDK-based Runtime Application Self-Protection (RASP), AI-powered active hardening, and a cloud threat intelligence platform directly into mobile applications. The solution defends against tampering, hooking, repackaging, data theft, key compromise, and API abuse for financial institutions, healthcare, automotive, and digital identity providers.
Product overview
Build38 (now integrated into OneSpan as 'Build38 by OneSpan') is a next-generation mobile application protection company offering a unified platform that combines three layers of protection: SDK-based Runtime Application Self-Protection (RASP), AI-powered active hardening, and a cloud threat intelligence platform. The core product — OneSpan Next-Gen App Shielding — is the primary offering, delivering in-app protection that embeds defenses directly into mobile applications. Supporting modules include the Traceboard console (for no-code security policy management by non-developer teams), the Mobile Threat Visibility Dashboard (for centralized SIEM/SOC integration via REST and streaming APIs), and the Cloud Threat Intelligence Platform (providing real-time threat telemetry across 250+ million endpoints). The solution protects against tampering, hooking, repackaging, data theft, key compromise, and API abuse.
Differentiator
Problem solved
Functional benefit
Products and services
- OneSpan Next-Gen App Shielding (formerly Build38) A next-generation mobile application protection platform (formerly Build38) that provides AI-powered in-app protection across the full mobile app lifecycle. Combines SDK-based Runtime Application Self-Protection (RASP), AI-powered active hardening, and cloud threat intelligence to defend against tampering, hooking, repackaging, data theft, key compromise, and API abuse, protecting over 250 million endpoints. Targeted at financial institutions, healthcare, automotive, and digital identity providers.
Quantifiable outcome
- Protects over 250 million endpoints globally
- +2 more outcomes
Companies that use Build38
Customer profileNamed customers3 records
Segments4 records
Ideal customer profiles4 records
Build38 technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
AI capability3 records
Feature4 records
Build38 partnerships and signals
Strategic signalPartnerships
Two partnerships are on record, tiered flagship and core.
- OneSpanflagshipBuild38 was acquired by OneSpan in Q1 2026 for $34.6 million. The acquisition integrates Build38's RASP technology into OneSpan's App Shielding portfolio, expanding mobile security offerings to over 1,000 banking entities globally. Build38 technology now powers OneSpan's Next-Gen App Shielding solution.
- Giesecke+Devrient (G+D)coreBuild38 was spun off from Giesecke+Devrient (G+D), a security technology company. This parent company relationship provided foundational expertise in security technologies for digital identity and mobile applications.
Scale indicators7 records
Recent moves6 records
Expansion highlights6 records
Build38 competitors and assessment
Company assessmentBroad incumbents
- Lookout: Lookout provides mobile security including mobile threat defense and app risk analysis, comparable to Build38's mobile threat intelligence and SDK-based protection for enterprise customers.
- OneSpan: OneSpan is the acquirer of Build38 and a broader cybersecurity incumbent in digital banking authentication, transaction signing, and mobile app security — directly comparable as the parent platform now offering Build38's RASP as Next-Gen App Shielding.
- Digital.ai: Digital.ai offers application security, including mobile app shielding and runtime protection, alongside broader DevOps and security tooling — a broader incumbent with overlapping capabilities to Build38's RASP.
Direct peers
- Promon: Promon is a direct competitor providing mobile application shielding and RASP technology, focused on protecting Android and iOS apps against reverse engineering, tampering, and malware — the same core problem Build38 addresses with its SDK-based RASP.
- Approov (by CriticalBlue): Approov provides mobile app attestation and runtime API protection, directly overlapping with Build38's RASP and API abuse prevention capabilities for financial services and digital identity customers.
- Verimatrix (formerly Inside Secure): Verimatrix offers mobile application protection and code obfuscation tools used in banking, fintech, and media, competing with Build38 in the app shielding and anti-tamper space.
- Appdome: Appdome provides no-code mobile app shielding and threat defense, a comparable approach to Build38's SDK and no-code deployment options for protecting mobile banking and fintech apps.
- Guardsquare: Guardsquare offers DexGuard and iXGuard for mobile app protection and runtime application self-protection, directly competing with Build38's RASP SDK in the same banking and high-security customer segments.
Emerging players
- Nok Nok Labs: Nok Nok Labs focuses on passwordless and FIDO-based authentication; it was acquired by OneSpan (June 2025) and now sits alongside Build38 in OneSpan's mobile security portfolio, addressing adjacent authentication problems for the same banking customers.
- Zimperium: Zimperium provides mobile threat defense (MTD) and runtime mobile security, partially overlapping with Build38's threat intelligence and in-app protection capabilities for enterprise mobile fleets.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat4 records
Key risks5 records
Key highlights6 records
Customer concentration
Build38 social profiles
Digital presenceBuild38 financial estimates
Financial estimateRevenue estimate
Valuation estimate
Build38 leadership team
Management profileNumber of profiles
Profiles1 record
Build38 funding detail
Funding detailFunding overview
Funding rounds4 records
Investors5 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Build38 M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Build38
What does Build38 do?
Build38 provides a mobile application protection platform that embeds SDK-based Runtime Application Self-Protection (RASP), AI-powered active hardening, and a cloud threat intelligence platform directly into mobile applications. The solution defends against tampering, hooking, repackaging, data theft, key compromise, and API abuse for financial institutions, healthcare, automotive, and digital identity providers.
Is Build38 a public or private company?
Build38 is a private company. It is classified as corporate owned and is currently acquired.
When was Build38 founded?
Build38 was founded in 2019. It employs 51 to 100 people.
Where is Build38 based?
Build38 is headquartered in Munich, Germany, in the Europe region.
How does Build38 make money?
Two revenue lines are on record. Mobile Application Security Solutions are the primary driver. The others are acquisition by OneSpan.
Who are Build38's main competitors?
Broad incumbents on record are Lookout, OneSpan and Digital.ai. Direct peers are Promon, Approov (by CriticalBlue), Verimatrix (formerly Inside Secure), Appdome and Guardsquare. Emerging players are Nok Nok Labs and Zimperium.
Does Build38 have an API?
Yes. Build38/OneSpan provides REST and streaming APIs that allow security teams to feed live mobile threat telemetry into existing SIEM, SOC, and backend systems. The APIs enable real-time visibility into mobile app threats and coordination between security teams and backend systems. Developer documentation is at docs.onespan.com.
What industry is Build38 in?
Build38's product category is Mobile Application Security. Its primary akta.pro industry code is HDADACAI, Runtime Application Self-Protection & In-App Detection, with a secondary code of HDADACAL, Mobile Application Security (App Shielding, Anti-Tamper). Its NAICS code is 5132 and its SIC code is 7372.