Executive Summary / Key Takeaways

• OneSpan Inc. (OSPN) is undergoing a strategic transformation, shifting from its legacy hardware authentication business to a higher-margin, software-centric model, with software now comprising over 80% of its total business. This pivot is driving strong profitability and cash generation.
• The company is actively enhancing its product portfolio through targeted M&A and internal R&D, notably with the acquisition of Nok Nok Labs for FIDO2 passwordless authentication and a strategic investment in ThreatFabric for mobile threat intelligence. These initiatives are crucial for future growth, particularly in 2026.
• Despite a recent downward revision in full-year 2025 revenue and ARR guidance due to persistent hardware headwinds and lower net expansion activity in Security Solutions, OneSpan maintains its strong Adjusted EBITDA outlook, underscoring its operational efficiency.
• OneSpan boasts a robust financial services customer base, including over 60% of the world's 100 largest banks, providing a significant cross-sell opportunity for its expanded software offerings.
• The company is committed to a balanced capital allocation strategy, returning capital to shareholders through quarterly dividends and share repurchases, while also funding organic investments and strategic acquisitions.

Setting the Stage: OneSpan's Evolution in Digital Security

OneSpan Inc. (OSPN), founded in 1991 as VASCO Data Security International, Inc., has a long-standing presence in the digital security industry, particularly in authentication. Historically, the company was a dominant provider of hardware authentication devices, such as Digipass tokens, widely adopted by financial institutions in EMEA and APAC for consumer banking. However, the digital landscape has undergone a profound shift towards mobile-first authentication, leading to a secular decline in demand for traditional hardware tokens. This trend has prompted OneSpan to strategically reorient its business model.

The company's overarching strategy is to transition into a leading software-centric provider of advanced secure authentication and digital agreements, emphasizing profitable growth and enhanced value for its global customer base. This transformation gained significant momentum in 2024, as OneSpan focused on optimizing its cost structure and improving operational efficiency, laying a solid foundation for future growth.

Technological Edge: Powering Secure Digital Interactions

OneSpan's core strength lies in its comprehensive suite of digital security solutions, designed to protect devices, users, and applications against sophisticated cyber threats. The company's technology portfolio spans advanced multi-factor authentication (MFA), transaction signing, mobile application security, e-signatures, and identity verification.

A key differentiator is OneSpan's flexible deployment options, offering both cloud-based and on-premises solutions, which is particularly appealing to large financial institutions that often have stringent regulatory and infrastructure requirements. For instance, its Security Solutions segment provides multi-factor authentication and mobile application shielding software, crucial for defending against account takeover attacks.

In a significant move to bolster its technological leadership, OneSpan acquired Nok Nok Labs Inc. in June 2025. This acquisition brought FIDO2 passwordless software authentication solutions, known as S3, into OneSpan's portfolio. The S3 product offers extreme scalability, capable of supporting millions of users, and delivers excellent performance with respect to latency. It also features a robust management console for easy administration and flexible deployment options (cloud or on-premise), catering to diverse customer needs. This integration, combined with OneSpan's internally developed FIDO2 security keys, positions the company to offer a comprehensive and future-ready authentication portfolio, crucial as Passkeys are expected to become a global standard. The FIDO2 security keys are anticipated to be a more meaningful revenue contributor in 2026 and could help offset the decline in traditional consumer banking tokens.

Furthermore, in October 2025, OneSpan made a strategic investment in ThreatFabric, a Dutch company specializing in mobile threat intelligence, malware risk detection, and behavioral analytics. This partnership aims to enhance OneSpan's fraud prevention capabilities, allowing it to offer a more comprehensive suite of solutions to its advanced authentication customers. The ThreatFabric products are expected to contribute to growth in 2026.

The "so what" for investors is clear: these technological advancements and strategic integrations are not merely incremental improvements. They are foundational to OneSpan's competitive moat, enabling it to address evolving cyber threats and maintain its relevance in a rapidly changing security landscape. By expanding into FIDO2 and mobile threat intelligence, OneSpan aims to secure higher-value, recurring software revenue streams, thereby improving its gross margins and long-term growth prospects.

Competitive Landscape and Positioning

OneSpan operates in a competitive digital security market, facing both direct and indirect rivals. Its primary direct competitors include established players like Okta (OKTA), Cisco (CSCO) (via its Duo Security acquisition), and Ping Identity (PING), all offering identity and access management, and multifactor authentication solutions.

OneSpan's competitive positioning is particularly strong within the financial services sector, where its specialized solutions for e-signatures and authentication are highly regarded. The company serves over 60% of the world's 100 largest banks, a testament to its deep industry expertise and trusted relationships. This specialization allows OneSpan to offer robust, tailored solutions that meet the stringent compliance and security requirements of regulated industries.

Compared to Okta, which offers a broader, more versatile cloud-based identity platform for general enterprise use, OneSpan's offerings, such as OneSpan Sign and OneSpan Identity Verification, emphasize high-security e-signature and multifactor authentication tailored for financial institutions. OSPN's gross profit margin of 73.87% (TTM) is competitive, though Okta's scalable subscription model often leads to strong overall profitability.

Against Cisco's Duo Security, which leverages Cisco's extensive hardware and networking ecosystem, OneSpan's software-driven authentication solutions for mobile and cloud environments may offer greater agility and ease of integration. While Cisco benefits from superior scale and diversified revenue streams, OneSpan's focused approach on fraud prevention and biometric authentication provides a distinct edge in high-stakes transaction environments.

Ping Identity, another key competitor, specializes in API security and zero-trust models. OneSpan's Cloud Authentication, with its comprehensive multi-factor options and integration of e-signatures, offers a differentiated value proposition in document-heavy industries.

OneSpan's strategy to grow with existing banking customers into the FIDO ecosystem, rather than losing them to competitors, highlights its focus on customer retention and expansion. The company is also expanding its go-to-market capabilities, including a dedicated security sales effort in North America, a historically smaller market for OneSpan, to capture new growth opportunities. While precise, directly comparable market share figures for all niche competitors are not publicly detailed, OneSpan's strong performance in its core segments suggests effective competitive execution.

Business Model and Segment Performance

OneSpan operates through two reportable segments: Security Solutions and Digital Agreements. The company's business model is increasingly driven by subscription revenue, reflecting its strategic shift towards software.

Security Solutions

This segment offers software products, SDKs, and Digipass authenticator devices for multi-factor authentication, transaction signing, and mobile application security. While historically reliant on hardware, the segment is actively transitioning to software and cloud-based solutions.

For the three months ended September 30, 2025, Security Solutions revenue was $40.32 million, a 1% decrease year-over-year. For the nine months ended September 30, 2025, revenue decreased 3% to $132.27 million. This decline was primarily due to lower hardware volumes as customers adopt mobile-first authentication, partially offset by higher multi-year term licenses from existing customers and contributions from the Nok Nok Labs acquisition. Subscription revenue for Security Solutions grew 13% in Q3 2025 and 17% for the nine months ended September 30, 2025. The segment's gross margin remained strong at 74% in Q3 2025 and 75% for the nine months ended September 30, 2025. Operating income for the segment was $16.7 million in Q3 2025, down from $20.2 million in Q3 2024, primarily due to increased sales and marketing and R&D expenses, including those from the Nok Nok acquisition. Annual Recurring Revenue (ARR) for Security Solutions reached $115.5 million as of September 30, 2025, an 11% increase year-over-year.

Digital Agreements

This segment provides cloud-based solutions like OneSpan Sign e-signature, OneSpan Notary, and Identity Verification, designed to automate and secure digital agreement workflows.

Digital Agreements revenue increased 9% to $16.73 million in Q3 2025 and 6% to $47.99 million for the nine months ended September 30, 2025. This growth was largely driven by higher cloud subscription revenue from existing customer expansions and new logos, despite lower term-based maintenance revenue due to the transition to cloud subscription licenses. Subscription revenue for Digital Agreements grew 11% in Q3 2025 and 10% for the nine months ended September 30, 2025. The segment maintained a gross margin of 72% in Q3 2025 and improved to 71% for the nine months ended September 30, 2025, from 68% in the prior year. Digital Agreements delivered a record high segment operating income of $4.2 million in Q3 2025, up from $3.4 million in Q3 2024, driven by higher gross profit and lower operating expenses. ARR for Digital Agreements grew 8% year-over-year to $65 million as of September 30, 2025.

Financial Health and Performance Trends

OneSpan's financial performance in 2025 reflects its ongoing transformation, balancing investments in growth with a strong focus on profitability and cash generation. For the nine months ended September 30, 2025, total revenue was $180.265 million, a slight decrease from $182.008 million in the prior year. However, the software business, now over 80% of total revenue, delivered double-digit subscription revenue and ARR growth.

Gross profit for the nine months ended September 30, 2025, increased 3% to $133.061 million, with the overall gross margin improving to 74% from 71% in the prior year. This improvement was primarily driven by an increase in software revenue and a favorable hardware customer mix, despite lower overall hardware revenue. Operating income for the nine months ended September 30, 2025, was $35.915 million, compared to $32.999 million in the prior year. Net income for the same period was $29.361 million, up from $28.294 million.

The company's Adjusted EBITDA reached a record $58.208 million for the nine months ended September 30, 2025, representing 32% of revenue, compared to $53.388 million in the prior year. This strong profitability underscores the success of its cost structure optimization efforts initiated in 2024.

OneSpan maintains a robust liquidity position. As of September 30, 2025, cash and cash equivalents stood at $85.554 million. The company generated $46.885 million in cash from operating activities for the nine months ended September 30, 2025. In June 2025, OneSpan secured a $100 million revolving credit facility, which remained largely undrawn with no borrowings outstanding as of September 30, 2025, providing ample financial flexibility for general corporate purposes and strategic M&A. The company's working capital increased to $67.50 million at September 30, 2025, from $64.60 million at December 31, 2024.

OneSpan is committed to returning capital to shareholders, having paid quarterly cash dividends of $0.12 per share and repurchased 0.40 million shares for $6.30 million during Q3 2025. The Board continues to pursue a balanced capital allocation strategy, weighing shareholder returns against organic investments and targeted acquisitions.

Outlook, Guidance, and Assumptions

For the full year 2025, OneSpan has updated its revenue guidance to a range of $239 million to $241 million, a revision from its previous range of $245 million to $251 million. This adjustment primarily reflects higher-than-anticipated headwinds in the hardware business, projected to decline approximately 16% from 2024 to a range of $49 million to $50 million, and lower activity in net expansions and new logos within the Security Solutions segment, particularly in EMEA and APAC. Software and services revenue is expected to be in the range of $190 million to $192 million, representing an increase of 3% to 4% in 2025.

The company also updated its full-year 2025 ARR guidance to a range of $183 million to $187 million, down from the previous range of $186 million to $192 million. Despite these revisions, OneSpan is maintaining its Adjusted EBITDA guidance in the range of $72 million to $76 million, underscoring its continued focus on profitability and operational efficiency.

Management emphasizes that 2025 is a foundational year, focused on "putting the pieces in place" to enable future growth. The Nok Nok Labs acquisition is expected to be accretive to Security's operating income and slightly accretive to Adjusted EBITDA in Q4 2025. The strategic investment in ThreatFabric is anticipated to contribute to growth in 2026. OneSpan's long-term goal is to accelerate top-line growth in 2026 and achieve "Rule of 40" performance, driven by its expanded software portfolio and strategic initiatives.

Risks and Challenges

While OneSpan has made significant strides in its transformation, several risks and challenges warrant investor attention:

• Persistent Hardware Decline: The secular shift to mobile-first authentication continues to impact hardware revenue, which is expected to decline further. While hardware is now less than 20% of the business, its continued reduction can create revenue headwinds.
• Economic Headwinds in Europe: The challenging economic environment in Europe, a historically large market for OneSpan's security business, has impacted performance and could continue to do so.
• Customer Contraction and Delays: The company experienced customer contractions and delays in implementing solutions, impacting ARR, highlighting the transactional nature of parts of its business and the potential for lumpiness in results.
• Foreign Exchange Rate Fluctuations: As a global company with significant revenue and expenses outside the U.S., changes in foreign exchange rates, particularly the Euro, can impact financial results.
• Integration of Acquisitions: Successful integration of Nok Nok Labs and leveraging the ThreatFabric partnership are critical for realizing the anticipated growth and cross-sell opportunities.

Conclusion

OneSpan Inc. is in the midst of a significant and deliberate transformation, successfully pivoting from a hardware-dependent past to a software-centric future. The company's strategic focus on enhancing its core authentication and digital agreements offerings through targeted acquisitions like Nok Nok Labs and investments in cutting-edge fraud prevention technologies like ThreatFabric is foundational to its long-term growth narrative. This technological evolution, particularly in FIDO2 and mobile threat intelligence, is not only strengthening its competitive position but also driving improved profitability and robust cash flow generation.

Despite a recent recalibration of its 2025 revenue and ARR guidance, reflecting ongoing hardware headwinds and some softness in security segment expansions, OneSpan's commitment to operational excellence is evident in its maintained Adjusted EBITDA outlook. The company's strong financial health, balanced capital allocation strategy, and deep relationships with global financial institutions provide a solid platform for future expansion. Investors should recognize OneSpan's strategic investments in technology and its disciplined execution as key drivers for accelerating software growth and achieving its "Rule of 40" performance target in the coming years, positioning it as a compelling play in the evolving digital security landscape.