Incorporated: 1984 as VASCO Corp.
NAIC: 541512 Computer Systems Design Services; 511210 Software Publishers
SIC: 7373 Computer Integrated Systems Design; 7379 Computer Related Services Nec; 7372 Prepackaged Software
VASCO Data Security International, Inc., designs and markets hardware and software identity authentication products for private enterprise networks and public networks, such as the Internet. The company's products, as well as those of its competitors, often are referred to as "security tokens." The company's main line of devices is marketed under the name "Digipass." VASCO primarily serves banking customers, deriving the bulk of its revenue from serving customers based overseas. The company's operational headquarters are located in Brussels, Belgium, where the software to support its product is developed. Next, the software is sent to Samsung Group, the manufacturer of VASCO's chips, before being sent to one of two manufacturers in mainland China, where final assembly takes place.
Origins
VASCO's development during its first 20 years of business traveled along two separate paths. The distinction between the two courses of development represented more than just two eras of existence. VASCO jumped from one path and headed in an entirely different direction, metamorphosing from one company into a distinctly different company, effecting a transformation that made the original VASCO irrelevant to the company bearing the VASCO banner in the 21st century.
The company began operating in 1984 under the name VASCO Corp., an enterprise that provided consulting, training, and software services to corporate clientele and government agencies. Although the company's consulting and technical training business, marketed as VASCO Performance Systems, endured for a decade, the event that caused VASCO Corp. to become VASCO Data Security International, Inc. occurred early in the company's history. In late 1989, the company acquired an option to purchase a majority interest in ThumbScan, Inc., which it exercised at the beginning of 1991. The acquisition led VASCO into the data security business, a signal moment that provided the compass point leading to the company's future. In 1993, ThumbScan was renamed VASCO Data Security, Inc., a wholly owned subsidiary of VASCO Corp. In 1996, all matters related to the company's future strategic orientation were resolved. The metamorphosis was made complete through disposition and acquisition, resulting in the VASCO tracked by analysts and onlookers in the 21st century.
A New VASCO Is Born
VASCO built its future base before it disposed of its past. In early 1996, the company expanded its computer security business by purchasing a 15 percent interest in Lintel Security NV/SA, a company based in Brussels, Belgium, the future operational headquarters of VASCO. The purchase of a minority interest in Lintel Security NV/SA spawned a VASCO subsidiary named Lintel Security, also based in Belgium, that took hold of assets associated with the development of security tokens and security technologies for personal computers and computer networks. In June 1996, VASCO acquired full control over Lintel Security NV/SA for $4.4 million, acquiring a company that figured as one of its competitors. The following month, VASCO paid $8.2 million for Digipass NV/SA, another Brussels-based company that posed a competitive threat to VASCO. Digipass, like Lintel, developed security tokens and security technologies for personal computers and computer networks, but its addition to the VASCO fold was significantly more important. In the years ahead, VASCO's leading product was marketed under the Digipass name. The company's original line of business, the consulting and technical training services business marketing under the name VASCO Performance Systems, was sold in August, one month after the Digipass NV/SA purchase, cutting all ties to the company formed a decade earlier.
VASCO, in a corporate sense, formally acknowledged its metamorphosis through a series of moves between 1997 and 1998. The two Belgian companies, Lintel and Digipass, were combined in 1997 to form VASCO Data Security NV/SA. In July 1997, VASCO Data Security International, Inc. was incorporated as a subsidiary of VASCO Corp., setting the stage for the final step in the company's reorganization plan. In March 1998, the two companies swapped positions through a public offering in which VASCO Data Security International acquired VASCO Corp., making VASCO Corp. a subsidiary of VASCO Data Security International. In October 1998, VASCO Corp. was merged into VASCO Data Security International and ceased to exist.
Wholly committed to operating as a data security provider, VASCO entered the late 1990s at an important juncture in the development of its new industry. The emergence of electronic commerce, and electronic banking in particular, created burgeoning demand for the technology offered by VASCO and its fellow competitors. VASCO approached the market touting its Digipass device, an identity authentication product designed to combat fraud and theft during electronic transactions conducted on private enterprise networks and public networks, such as the Internet. The Digipass, a pocket-calculator sized device, used software capable of generating electronic passwords specific to individuals at specific times and places. When a customer logged onto a secure web site, the Digipass prompted the user to enter a personal identification number and responded by generating a password valid for one-time access to the user's account.
As VASCO dived headlong into identity authentication technology, the company relied heavily on the banking industry for its business. Banking customers accounted for roughly 80 percent of the company's business, and, more specifically, primarily foreign banking customers. The dependence on overseas business, which prompted the company to establish its financial headquarters in the United States and its operational headquarters in Belgium, stemmed from differing attitudes toward security issues in the United States and abroad, particularly in Europe. "Europe has taken more of a comprehensive approach from the beginning and has gotten security taken of, which is why the tokens are more widely used there," an analyst explained in a June 19, 2000 interview with American Banker. Consequently, VASCO's early years were spent trying to promote the acceptance of Digipass in the United States, while deriving 80 percent of its financial sustenance from abroad. A breakthrough moment for VASCO and for the U.S. banking industry occurred in early 1999, when First Union Corp., a $234 billion-in-assets bank based in Charlotte, North Carolina, began deploying the Digipass 300 to its customers, the first time a major U.S. bank had agreed to use the breed of security tokens made by VASCO. The deal, which involved roughly 20,000 units of the Digipass 300, did much to foster acceptance of identity authentication technology in VASCO's home country, an event to be celebrated by the company's leaders. In a January 21, 1999 interview with American Banker, T. Kendall Hunt, VASCO's chairman and chief executive officer, offered his assessment of the significance of the First Union contract. "A very visible, prestigious name like First Union is going to make the road ahead a lot faster," he said, adding, "This is very big for us."
Shortly after the landmark First Union contract was secured, VASCO underwent a change in leadership, producing the executive team that would be responsible for tackling the challenges ahead. In a nod to the importance of the company's European business, Mario Houthooft, the leader of Belgium-based VASCO Data Security NV/SA, was named president and chief executive officer of the entire company in mid-1999. Hunt remained chairman, taking on responsibilities related to long-term strategic issues while Houthooft, ten years his junior, assumed day-to-day control over the company, splitting his time between Brussels and suburban Chicago. Looking ahead, Houthooft and Hunt faced two major challenges: increasing the company's presence in the U.S. market, its "Achilles heel," according to the July 5, 1999 issue of Crain's Chicago Business, and increasing the overall size of the company. VASCO, when Houthooft took the helm, was generating $15 million in revenue, more than seven times the total registered four years earlier, in 1994, but hardly a revenue volume to impress analysts and industry pundits. VASCO's main U.S. rival, Bedford, Massachusetts-based RSA Security, controlled 60 percent of the hardware security token market, boasting a revenue volume more than ten times larger than VASCO's, having developed into an industry giant by supplying security tokens used mainly by employees to access corporate systems. VASCO needed to get bigger, not only in the United States, but in any region that offered opportunities for growth. The identity authentication market was emerging, escalating in importance with each passing year. Market dominance depended on the actions of all competitors in the next few years, presenting the overriding challenge facing Houthooft and Hunt as they pursued expansion.
Expansion Entering 2000
Houthooft and Hunt expanded VASCO by stepping up marketing efforts in the United States, by maintaining progress abroad, and by completing acquisitions. The first purchase after the promotion of Houthooft strengthened the company's greatest weakness. In October 1999, VASCO acquired Intellisoft Corp., an Acton, Massachusetts-based supplier of identity authentication products to a number of U.S.-based customers, including John Hancock, 3M, Liberty Mutual, and Allmerica Financial. In August 2000, VASCO acquired Invincible Data Systems, Inc., a privately held security products company with sales and research development operations in Sunnyvale, California. Next, VASCO purchased Indentikey Ltd., completing the purchase in March 2001. Indentikey, a privately held company based in Brisbane, Australia, developed security software for corporations, financial institutions, and government agencies on a global basis.
As VASCO fought for new business during the first years of the 21st century, the company was beginning to show the first signs of developing into a more prominent competitor. The efforts directed toward expansion lifted revenues to nearly $30 million in 2004, but the total was dwarfed by the volume of business generated by its largest competitor, RSA Security, which recorded $310 million in revenue during the year. The company needed to become much larger, and much of its growth potential was located in the largely untapped U.S. market. To reach a higher plateau, VASCO needed the U.S. market to embrace identity authentication technology, something some industry pundits believed was about to occur midway through the century's first decade. "Europe has always been more security conscious than the United States, but the United States is going to catch up," an analyst said in a June 27, 2005 interview with Crain's Chicago Business. "You're going to see their [VASCO's] business in the United States grow with all the security breaches now occurring," the analyst added. "The time is right for VASCO."
Based on the escalating sales of the company's Digipass devices, there was a sense that the company was turning a corner. It took VASCO seven years to deliver its first one million security tokens, but by late 2004 it was selling one million units in a three-month period. In 2005, the company sold more than seven million Digipass units, a record number that more than doubled the total sold in 2004. "We're really starting to accelerate on the retail side," Hunt said in a November 3, 2005 interview with USA Today. In early 2006, a milestone was reached when the company delivered its 20 millionth Digipass device. Hunt, naturally, was excited by the surge in business, but he was mindful that much remained to be completed. "RSA is still the Coca-Cola in this industry and we're the RC Cola," he said in a June 27, 2005 interview with Crain's Chicago Business. In the years ahead, VASCO's success largely would be determined by its ability to elevate its stature substantially and stand eye-to-eye with its largest rival.
Principal Subsidiaries
VASCO Data Security, Inc.; VASCO Data Security Europe S.A.; VASCO Data Security NV/SA; Lintel Security SA/NV; VASCO Data Security Development, Inc.; VASCO Data Security Asia-Pacific Pte Ltd.
Principal Competitors
RSA Security Inc.; ActiveCard Corp.; Litronic, Inc.
Further Reading
Byron, Acohido, "Two Security Token Makers Vie for Consumer Market," USA Today, November 3, 2005, p. 2B.
Domis, Olaf de Senerpont, "Secure Transaction Device for 20,000 1st Union Clients," American Banker, January 21, 1999.
Magee, C. Max, "Demand Grows for Security Company," Daily Herald, February 13, 2005, p. 1.
Murphy, H. Lee, "VASCO Taps into Fraud Fear," Crain's Chicago Business, June 27, 2005, p. 12.
"Tech Bytes: Data Security Merger," American Banker, October 19, 1999, p. 17.
"Tech Bytes: VASCO Data Security Splits Itself in Two," American Banker, January 10, 2000, p. 9.
"VASCO's Key to Domestic Sales," Crain's Chicago Business, January 1, 2001, p. 10.
— Jeffrey L. Covell
