0001044777-26-000008
SEC filingRevenue flat at $243M; mix shift to software and tax benefits drove net income up 28%.
OneSpan Inc. helps organizations build secure, seamless, and trusted digital experiences through two solution portfolios: Cybersecurity and Digital Agreements. The company processes over 100 million digital agreements and billions of secure authentication transactions annually, and is trusted by more than 60% of the world’s 100 largest banks. OneSpan offers products primarily through a subscription licensing model with cloud-based and on-premises deployment options.
OneSpan reports financial results under two operating segments: Cybersecurity and Digital Agreements. The Cybersecurity segment, formerly Security Solutions, includes software products, SDKs, and Digipass authenticator devices that defend against attacks on digital transactions. It offers standards-based authentication like FIDO, multi-factor authentication, transaction signing, and mobile application security. The Digital Agreements segment provides cloud-based solutions—OneSpan Sign e-signature, OneSpan Notary, and OneSpan Identity Verification—to automate and secure agreement workflows requiring consent and compliance.
Key Cybersecurity products include Cloud Authentication (multi-factor solution), Digipass S3 Authentication Software (passwordless FIDO authentication), Mobile Security Suite (SDK for strong authentication), Mobile Application Shielding (protects apps from malware), Authentication Server (centralized platform), Authentication Suite (API-driven solution), and Digipass Authenticators (hardware tokens including FIDO2 devices). Digital Agreements products include OneSpan Sign (e-signature), OneSpan Notary (online notary), OneSpan Sign Identity Verification (document and biometric verification), OneSpan Sign Authentication (configurable signer verification), and OneSpan Integration Platform (pre-built integrations for Salesforce, SharePoint, Guidewire).
OneSpan sells globally through a direct sales force and channel partners including distributors, resellers, systems integrators, and OEMs. The majority of revenue derives from financial institutions (traditional banks, credit unions, online-only banks), with additional sales to enterprise, government, healthcare, and insurance. The top 10 customers contributed 18% of total revenue in 2025, down from 20% in 2024 and 22% in 2023. A significant portion of sales is denominated in foreign currencies.
The authentication market is competitive, with main competitors including Gemalto (Thales Group), RSA Security, and Yubico, along with smaller niche providers offering biometric or risk-based solutions. In e-signature, primary competitors are Docusign and Adobe Systems. Competition may intensify with AI enabling rapid development. Competitive factors include solution strength, ease of use, customer support, brand recognition, and total cost of ownership. OneSpan believes it is competitive except on brand recognition.
OneSpan’s strategy focuses on achieving and maintaining operating profitability, which was reached in Q4 2023. The company returned approximately $31.6 million to shareholders in 2025 via dividends and buybacks. To drive future growth, OneSpan is broadening product offerings through acquisitions (Nok Nok Labs in June 2025 for passwordless authentication, and planned acquisition of Build38 for mobile app protection) and partnerships (ThreatFabric for mobile threat intelligence). The company is also strengthening leadership by hiring a new CTO and CRO. A key strategic shift is responding to the mobile-first trend by moving from hardware authentication (Digipass revenue declined from 78% in 2015 to 20% in 2025) to higher-margin software solutions and Digital Agreements.
As of December 31, 2025, OneSpan has 602 employees: 336 in the Americas, 231 in EMEA, and 35 in Asia Pacific. By function, 108 are in cost of goods sold, 167 in sales and marketing, 239 in research and development, and 88 in general and administrative. The company emphasizes competitive compensation, employee engagement, hybrid workplace, diversity (30% female overall and at manager level), training, and low voluntary turnover (5.8% in 2025).
Total revenue was essentially flat at $243.2M for fiscal 2025, compared to $243.2M in 2024. The stability masked divergent segment trends: Cybersecurity revenue declined 2% due to lower hardware volumes from the mobile-first trend and reduced perpetual maintenance, partially offset by growth in term license and cloud subscriptions. Digital Agreements revenue grew 7% on higher cloud subscription revenue from expansions and new logos.
Gross profit increased 3% to $179.4M, with gross margin improving to 74% from 72%. The expansion was driven by a favorable mix shift toward higher-margin software and the absence of a $1.5M intangible write-off that affected the prior year. Cybersecurity gross margin rose 1 point to 74%, while Digital Agreements gross margin jumped 4 points to 72%.
Operating expenses increased modestly by 1% to $130.9M, with higher sales & marketing and R&D costs (each up 5%) partially offset by lower G&A and restructuring charges. Operating income grew 8% to $48.4M, yielding an operating margin of 19.9% versus 18.4% in 2024.
Net income surged to $72.9M from $57.1M, a 28% increase. The improvement was amplified by a $23.5M income tax benefit (compared to $10.6M in 2024), primarily from the release of a valuation allowance on Canadian deferred tax assets.
Cybersecurity segment revenue declined $4.5M (-2%) to $177.7M, as hardware revenue fell 17% to $49.1M. However, subscription revenue grew 13% to $90.9M, underscoring the transition to recurring software models. Segment operating income decreased 11% to $80.0M due to higher sales and R&D investments.
Digital Agreements segment revenue rose $4.5M (+7%) to $65.5M, with cloud subscriptions increasing 11%. Operating income nearly tripled from $5.6M to $16.0M, driven by gross margin expansion and opex discipline.
Management highlighted several strategic initiatives: the acquisition of Nok Nok Labs (closed June 2025), a partnership with ThreatFabric, and a new CRO to drive go-to-market. The restructuring plan was terminated as of December 2025, with substantially all workforce reductions completed. ARR grew 11% to $186.9M, and NRR was 104%, signaling healthy expansion within the customer base. No explicit forward guidance was provided, but the focus on higher-margin software and cost discipline implies continued margin expansion.
As of December 31, 2025, OneSpan held $70.5 million in cash and cash equivalents, down from $83.2 million at year-end 2024. The company had no borrowings outstanding under its $100.0 million revolving credit facility (entered into June 23, 2025), with only $0.4 million in outstanding letters of credit. Total shareholders' equity increased to $271.8 million from $212.5 million, driven by net income of $72.9 million and favorable foreign currency translation. Inventory remained relatively flat at $10.5 million.
Total purchase commitments for software agreements were $11.9 million as of December 31, 2025, with terms ranging from 1 to 3 years. The company also disclosed $106.1 million in remaining performance obligations (RPO), representing future revenue expected from unsatisfied performance obligations, with $62.8 million expected to be recognized in 2026. Operating lease liabilities totaled $8.4 million, with maturities extending through 2030 and beyond. The company recorded a $0.3 million accrual for loss contingencies.
OneSpan returned approximately $31.6 million to shareholders in 2025 through dividends and share repurchases. The company repurchased 1,006,376 shares for $13.1 million at an average price of $12.99 per share, leaving $36.9 million remaining under the $50.0 million authorization (effective May 9, 2024). Quarterly dividends of $0.12 per share totaled $14.3 million in 2025; a subsequent dividend of $0.13 per share (an 8.3% increase) was declared on February 26, 2026. Capital expenditures were $9.0 million (3.7% of sales), primarily for internal-use software capitalization ($8.0 million). No debt was issued or repaid during the period.
Cybersecurity segment revenue declined 2.5% year-over-year to $177.7 million, while Digital Agreements revenue grew 7.4% to $65.5 million. Cybersecurity operating income was $80.0 million (45.0% margin), and Digital Agreements operating income was $16.0 million (24.4% margin). Geographically, EMEA contributed 42% of total revenue ($102.6 million), Americas 39% ($95.7 million), and APAC 19% ($44.9 million). Subscription revenue (cloud and on-premises) was the largest category at $156.1 million, followed by hardware products at $49.1 million.
OneSpan faces significant challenges in achieving revenue growth. Total revenue was flat in 2025 compared to 2024, and the company expects Digipass hardware revenue to decline modestly in 2026. Growth depends on software revenue from Cybersecurity and Digital Agreements divisions, which is subject to competition, long sales cycles, and integration risks from recent acquisitions (Nok Nok Labs, planned Build38).
The acquisitions of Nok Nok Labs (June 2025) and Build38 (expected March 2026) introduce risks including integration difficulties, cross-selling challenges, customer uncertainty, and potential impairment of goodwill ($113.6M net book value at year-end 2025).
The Digipass authenticator business relies on contract manufacturers in China and Romania. U.S. tariffs on Chinese imports, potential retaliatory tariffs, and geopolitical tensions (including Taiwan, Hong Kong, and EU trade disputes) could disrupt supply or increase costs. The company is evaluating moving production from China to Romania, but this transition itself poses disruption risks.
OneSpan is subject to an expanding web of regulations: GDPR (fines up to 4% of global revenue), DORA, NIS2, EU Data Act, and U.S. state privacy laws (e.g., California, Illinois Biometric Information Privacy Act). Compliance requires significant investment in technology, personnel, and contractual changes. Non-compliance could result in fines, litigation, and reputational harm.
As a cybersecurity company serving banks, OneSpan is an attractive target. AI-driven attacks, model manipulation, and data poisoning are emerging threats. Past security incidents have not been material, but future incidents could cause significant liability, reputational damage, and loss of customers. The company relies on third-party hosting (AWS) and faces risks from service interruptions.
Customer concentration is notable: top 10 customers contributed 18% of 2025 revenue. The company has a $100M revolving credit facility with financial covenants that restrict investments, dividends, and indebtedness. Foreign exchange fluctuations could impact results, as 79% of revenue is from outside the U.S. and the company does not hedge currency exposure.