Prepared remarks
Good day and thank you for standing by. Welcome to the OneSpan Second Quarter 2026 Earnings Conference Call. Please be advised that today's conference is being recorded. I would now like to hand the conference over to your first speaker today, Joe Maxa, VP of Investor Relations. Please go ahead.
Thank you, Operator. Hello, everyone. Thank you for joining the OneSpan Second Quarter 2026 Earnings Conference Call. This call is being webcast and can be accessed on the Investor Relations section of OneSpan's website at investors.onespan.com. Joining me on the call today is Victor Limongelli, our Chief Executive Officer; and Jorge Martell, our Chief Financial Officer. This afternoon, after market close, OneSpan issued a press release announcing results for our second quarter of 2026. To access a copy of the press release and other investor information, please visit our website. Following our prepared comments today, we will open the call for questions. Please note that statements made during this conference call that relate to future plans, events, or performance, including the outlook for full year 2026 and other long-term financial targets are forward-looking statements. These statements involve risks and uncertainties and are based on current assumptions. Consequently, actual results could differ materially from the expectations expressed in these forward-looking statements. I direct your attention to today's press release and the company's filings with the U.S. Securities and Exchange Commission for a discussion of such risks and uncertainties. Also note that certain financial measures that may be discussed on this call are expressed on a non-GAAP basis and have been adjusted from a related GAAP financial measure. We have provided an explanation for and reconciliations of these non-GAAP financial measures to the most directly comparable GAAP financial measures in the earnings press release and in the investor presentation available on our website. In addition, please note that all growth rates discussed on this call refer to a year-over-year basis unless otherwise indicated. The date of this conference call is August 4, 2026. Any forward-looking statements and related assumptions are made as of this date. Except as required by law, we undertake no obligation to update these statements as a result of new information or future events or for any other reason. I will now turn the call over to Victor.
Thank you, Joe. Hello, everyone. Thank you for joining us today. We had a strong second quarter, including subscription revenue growth of 11% and solid profitability with an adjusted EBITDA margin of 28%. Before reviewing our results in more detail, I'd like to spend a few minutes discussing our recently launched DigipassONE authentication platform, which represents an important milestone in OneSpan's evolution. DigipassONE unifies the innovations from our Nok Nok Labs and Build38 acquisitions with OneSpan's existing capabilities, delivering a single integrated platform solution. DigipassONE includes four components: DigipassONE Authenticate, DigipassONE Verify, DigipassONE Protect and DigipassONE Insights. First and foremost, DigipassONE Authenticate builds on the foundation of the world's broadest suite of authentication functionality, including passkeys, FIDO2 security keys, hardware tokens, mobile authenticators and software authenticators, to deliver secure phishing-resistant login and transaction signing. Banks and other high-value, high-trust customers gain the flexibility to support different users, devices and authentication preferences through a unified platform. DigipassONE Verify expands the platform with our new capabilities for verifiable credentials and digital wallets. Verifiable credentials are designed to improve onboarding, authentication and trust by enabling cryptographically secure and tamper-proof identity verification. DigipassONE Protect strengthens the offering with our mobile application shielding technology. Delivered via both SDKs and post-compilation app wrapping, it protects mobile apps against tampering, abuse and runtime threats, promoting reliability and trustworthiness for users. Last but not least, DigipassONE Insights ties it all together with telemetry and analytical insights across authentication flows and application protection signals so that customers can better react to imminent threats or challenging operating environments. Looking ahead, over the next few years, we expect consumers to begin using agents to conduct banking and other high-value transactions, and we further expect that the development of this new channel for customer interaction will augment, not replace, the existing channels of in-person, online and mobile. In other words, in the future, banks will continue to engage with their customers across branches, websites and mobile apps while adding a new category of agent-driven banking interactions. DigipassONE provides the foundation to help banks and other high-value, high-trust businesses authenticate customers, verify intent, and protect transactions across both existing and emerging channels. We see the shift to agent-driven interactions in the future as an opportunity to extend our offering and further strengthen our value to our customers. Stepping back, the launch of DigipassONE is a key milestone in a broader platform strategy that strengthens our ability to innovate, deepen customer relationships, address new market opportunities and support long-term growth. Turning to our Digital Agreements business, where we focus on delivering secure, seamless agreement workflows purpose built for financial services and other highly regulated industries. We believe our combination of white-labeled e-signatures, identity verification and workflow automation provides a meaningful differentiator in the market. In addition, we are investing in AI-enabled capabilities designed to help customers improve efficiency, gain deeper insights from agreement workflows, deliver a better end-user experience, seamlessly integrate with agentic workflows and simplify deployment within existing environments. Turning to our results. As mentioned, we had a solid second quarter, including generating $17 million of adjusted EBITDA or 28% of revenue. We ended the second quarter with annual recurring revenue of $190 million, up 7% year-over-year. Total Q2 revenue grew 1% to $60.5 million, and second quarter subscription revenue grew 11% to $47 million and accounted for 77% of total revenue, up from 70% in last year's Q2. Both business units continued to be solidly profitable at the division level, supporting our Board's commitment to a balanced capital allocation strategy that considers shareholder returns, organic investment and targeted M&A. In the second quarter, we returned almost $8 million to shareholders through dividends and share repurchases. And on an aggregate basis over the last four quarters, the total return to shareholders exceeds $40 million or over $1 per share. The Board has also approved a quarterly dividend of $0.13 per share to be paid in the current quarter, and we'll continue to evaluate additional share repurchase opportunities. In summary, we continue to make progress in building a stronger foundation for future growth. We have expanded our capabilities through targeted acquisitions and internal innovation, both of which are evidenced in the launch of DigipassONE. We remain focused on serving our customers now and investing for the future in order to be able to continue delivering value to them for years to come. With that, I'll turn the call over to Jorge.
Thanks, Victor, and good afternoon, everyone. I'm very pleased to report another strong quarter and continued progress in building a solid foundation for growth. I'm particularly excited about our recent launch of DigipassONE, our platform strategy built to help customers modernize authentication and address other security needs without disrupting existing systems, user experience or business operations. Turning to our results. Annual recurring revenue, or ARR, increased 6.7% year-over-year to $189.7 million, driven by expansion of existing customer contracts, new logos and the acquisition of Build38. Our net retention rate, or NRR, was 103%. Q2 revenue was $60.5 million, an increase of 1% compared to last year's second quarter, driven by 11% growth in subscription revenue, partially offset by a decline in hardware revenue due to the fact that significant hardware revenue had been pulled forward into Q1, which we discussed with you last quarter, as well as a decline in perpetual maintenance revenue as customers continue to move to term licenses. For the quarter, as Victor mentioned, subscription revenue increased to 77% of total revenue, up from 70% in the prior year quarter, while hardware and perpetual maintenance revenues accounted for a combined 23% of total revenue as compared to 30% in last year's Q2. Gross margin was 73.6% compared to 73.5% in Q2 of last year. GAAP operating income was $8.7 million compared to $10.5 million in Q2 2025. The year-over-year change primarily reflects increased operating costs related to our recent acquisitions, including headcount, as well as certain cost-related go-to-market leadership and other organic investments. GAAP net income per share was $0.18 compared to $0.21 in the second quarter of last year. Non-GAAP net income per share was $0.30 compared to $0.34 in last year's Q2. Adjusted EBITDA and adjusted EBITDA margin were $16.9 million and 27.9%, respectively. This is compared to $17.6 million and 29.5% in the same period last year. Next, I will discuss the financial results for our two business divisions, starting with Cybersecurity. Cybersecurity ARR grew 7.4% year-over-year to $123 million, inclusive of the $3 million headwind we discussed last quarter and the acquisition of Build38. Revenue decreased 7.5% to $40.9 million. Subscription revenue grew 2.5% to $27.2 million, driven by customer expansion contracts, new logos as well as revenue from our acquisitions of Nok Nok and Build38, partially offset by lower year-over-year multi-year term license revenue and lower past-due renewal catch-up revenue this quarter compared to last year's second quarter as we continue to improve our on-time renewal performance. As noted, hardware and perpetual maintenance revenue declined as expected. Gross margin for the Cybersecurity division was 73% compared to 74% in the prior year quarter, primarily reflecting incremental third-party license costs and incremental amortization of capitalized software costs from the Build38 acquisition. Operating income was $13.8 million or 34% of revenue compared to $19.8 million or 45% of revenue in last year's Q2. The year-over-year change was driven by the differences in revenue and gross margin just discussed, an increase in operating expenses from acquired companies and increased organic investments. Now turning to Digital Agreements. ARR grew 5.3% year-over-year to $66.7 million. Revenue grew 25.2% to $19.5 million, driven by strong overage revenue, expansion of renewal contracts and new customer additions. We are encouraged by the strong overage revenue because it is a positive indicator of transaction volume growth, which often results in expansion contracts with existing customers due to higher utilization rates. We expect additional overages in the third quarter of 2026 but not to the same extent as in Q2. As a reminder, overages are not included in ARR or NRR. Gross margin improved to 74.7%, up from 71.4% in the prior year period, primarily reflecting higher revenue, including overage revenue. Operating income was $7 million or 35.7% of revenue compared to $2.9 million or 18.4% of revenue in the same period last year. The strong improvement in operating income was primarily driven by revenue growth, higher gross margin and a modest decline in operating expenses, primarily reflecting higher internal software capitalization costs. Turning to our balance sheet. We ended the second quarter with $43.3 million in cash and cash equivalents and $5 million outstanding under our credit facility compared to $49.8 million in cash and cash equivalents and no outstanding debt at the end of the first quarter. During the quarter, our primary cash outflows included $4.8 million for our quarterly dividend, $2.9 million to repurchase approximately 230,000 shares of common stock and $3 million for capitalized software development costs. Operating cash flow was a modest outflow of $0.1 million, primarily reflecting normal net working capital fluctuations. By geographic region, revenue in the second quarter of 2026 was 46% from the Americas, 35% from EMEA and 19% from Asia Pacific compared to 40%, 39% and 21% from the same regions in the second quarter of 2025, respectively. The year-over-year changes in revenue by region primarily reflect growth in Digital Agreements and cybersecurity software in the Americas, which is consistent with our investment strategy and plan; lower cybersecurity hardware and software revenue in EMEA partially offset by growth in Digital Agreements; and lower hardware revenue in Asia Pacific, partially offset by an increase in cybersecurity software. Now turning to some modeling notes and our outlook. We are pleased with our second quarter results and the progress we've made in positioning the company for long-term growth. For the full year 2026, we are increasing our revenue guidance primarily to reflect higher volumes and consumption in our e-signature business that is expected to result in incremental contract overages, along with an increase in expected hardware revenue in the second half of the year, primarily Q4, due to increased hardware bookings in the first half of the year as compared to our plan. Our current hardware revenue forecast calls for about one-third of the second half hardware revenue to be recognized in Q3, which is consistent with the last couple of years showing Q3 as the seasonally lowest of the four quarters, followed by a much stronger fourth quarter. More specifically, for the full year 2026, we expect total revenue to be in the range of $248 million to $252 million as compared to our previous guidance range of $244 million to $249 million. We expect software and services revenue to be in the range of $202 million to $204 million as compared to our previous guidance range of $201 million to $204 million. We expect hardware revenue to be in the range of $46 million to $48 million as compared to our previous guidance range of $43 million to $45 million. We expect ARR to be in the range of $194 million to $198 million, and we expect adjusted EBITDA to be in the range of $67 million to $71 million as compared to our previous guidance range of $64 million to $68 million. That concludes my remarks. I will now turn the call back to Victor.
Thanks, Jorge. To recap, we are pleased with our second quarter results and the progress we continue to make across the business. We are serving our customers with mission-critical solutions, investing in areas where we see meaningful growth opportunities and maintaining the financial discipline that enables us to return capital to shareholders. We believe OneSpan is becoming a stronger and more focused company, and we remain committed to creating long-term value for our customers and shareholders. Jorge and I will now be happy to take your questions.
Questions and answers
Our first question comes from Gray Powell from U.S. Bank.
Maybe a couple on my side and more of a high-level question. So just thinking out over the next year or two, as hardware becomes a smaller component of the business, how should we think about the potential for growth to improve on a sustainable basis? And then just more specifically, what are the two or three things that need to happen for OneSpan to sustainably get revenue growth back into the mid- to high-single digits on an organic basis?
Yes, thanks, Gray. So I think you're familiar with this. We've certainly talked about it in the past, and you can see it in the numbers. Over time, our software business has been growing, and we had an offset, a negative offset from the hardware business for quite some time. And we felt like if we could get the hardware business stable, maybe have some revenue coming from the newer security keys as well as stabilization in the overall hardware business, that growth would show up as a result of the software growth. So you've seen it in the subscription revenue numbers and in the ARR numbers. We've been having solid software growth, and we expect that to continue. Obviously we're not giving guidance for next year, but we have some exciting things happening in terms of our product portfolio, the new DigipassONE platform, and we have emerging technologies with DigipassONE Verify as well, as well as new hires that we've announced on the go-to-market side, new head of marketing, new channel leader, et cetera. So we are taking all those steps to build for additional growth and get those targets that you're talking about.
Okay. That's helpful. And then just, I guess, a separate question. So look, I know DigipassONE has only been out a couple of weeks. Anything you can say on early feedback or customer interest? And then just trying to think through what kind of ASP uplift you think that could create for the platform and the potential for net retention rates to improve off of current levels.
Yes, so if you think about the platform, we had a very strong authentication offering, which we strengthened considerably about a year ago, a little over a year ago when we bought Nok Nok and added the passkey capability. So we have that strong authentication platform, and we have been providing app shielding, what we're calling DigipassONE Protect for some time, but now we own the technology with the acquisition of Build38. So those are cross opportunities going to all the banks that we have and adding app shielding and a new capability that we're developing, DigipassONE Verify. So those are cross opportunities. If you think about how to increase revenue growth rates, you're either selling existing things to new customers or new things to existing customers or new or existing things to new customers as well, but the easiest path there is going to be a cross-sell: to sell new things to existing customers. And that's what we're trying to do, to drive up the attach rate with DigipassONE Protect, to start down the path of an attach rate with DigipassONE Verify since that's new. And both of those give us an opportunity because we do have this great customer base built out over many years, and that's where we see the most straightforward way to increase the software growth rates.
Our next question comes from Catharine Trebnick from Rosenblatt.
You frame the agent-driven interactions as incremental in the channel. I know you just released this product. So any specific use cases that your marketing team has identified that you're going after, like high-value payments, dispute resolution? And then what are you actually seeing in the budget for '26? Or should we really think of this more like a '27 item? And Gray already grabbed my question on the ASP.
So Catharine, to clarify, are you asking about DigipassONE Verify?
Yes.
Yes, so that's a new capability. We're doing POCs with customers in the second half of the year. We released an early release version of that in June, and we expect to be learning a lot more about budgets as we go through the process.
But...
So if you think about what it's doing, there is a European digital identity regulation. The countries have to have wallet specifications done by the end of the year. Obviously, that's going to be many, many different wallets. You have Google and Apple as well. Banks are going to have to accept them by the end of '27. So we see this as a great complement to our authentication offering because people are going to, in a cryptographically tamper-proof way, prove their identity, which is obviously very important in onboarding and in authentication. So we see this as an add-on that a lot of banks, particularly in Europe, will be driven to adopt by regulation, but also in other markets it's going to be a helpful way to enable more secure interactions with customers. Now in terms of budgets for it, there are regulatory drivers in '27. Most of our bookings come between September and the end of the year. So we're heading into our busy season in terms of sales. I would say we don't have a clear read on 2027 budgets from our customers yet because we're focused, as you might imagine, on closing 2026 business. But the POCs and the interest we're seeing from customers are a good sign.
Our next question comes from Erik Suppiger from B. Riley Securities.
Congrats on a good quarter and getting DigipassONE out. Just following up on Catharine's question. What adoption — what are the use cases for banks that are using AI agents for banking? And then I'm just curious on the Digital Agreements side, was the overage associated with a particular account? Or is this more of a broader trend? It seemed like it was a particularly strong quarter and you're talking about some strength in Q3. So what's driving that?
Yes, so I'll let Jorge answer the overage question, Erik. But let me talk about AI agents. If you think about mobile banking apps, the most common activities that are undertaken by customers are straightforward: checking their balance, sending money to a friend or making a payment, monitoring transactions. We think that agents will handle many of those routine activities. This will be a new channel for banks, not a replacement for branches, websites or mobile apps. Over the next four to five years, banks will interact with customers across branches, web, mobile and agentic workflows. The ability for a bank to accept those agentic workflows, for a consumer to have an agent that they use to act on multiple accounts, and for the bank to authenticate that the agent is authorized and to verify intent requires work. We believe that channel is coming, and our breadth of offerings — passkeys, app shielding, transaction protection — positions OneSpan to cover multiple digital channels without customers needing multiple vendors.
I can jump in and address the Digital Agreements overage question, Erik. So we're pretty happy with how Digital Agreements performed for the quarter, with 25% growth. Even if you exclude the overages, which were higher year-over-year by about $2 million, you still get to double-digit growth of about 11.3%, which is encouraging. Overages are generated because clients exceed the transaction volumes they committed to, which is a good thing. You can think of overages as a leading indicator for ARR, because overages often translate into higher expansion contracts. At this point, overages are not part of ARR or NRR. The overages this quarter did come primarily from a couple of customers. Historically, our run rate for overages for the full year is about $1 million to $1.5 million. This year we're going to exceed that amount. For the second half of the year, we expect overages to be much less than we recognized so far in the first half, but we feel good about overages because they indicate activity and can lead to future ARR expansion.
Okay. And then real quick on the hardware. It looks like you're looking for a pretty strong second half. Is that driven by FIDO2? Or is there anything that's incrementally picking up in the second half within the hardware?
Yes, we increased our guidance for hardware from a $44 million midpoint to now $47 million. The primary reason is that we saw higher activity and bookings in the first half of the year compared to our plan, which gives us confidence that orders will be delivered this year. The earlier bookings occur, the higher the likelihood they will be delivered in the year, and that improved visibility supports the increased guidance.
The FIDO2 security keys present an avenue to make login easier, particularly in corporate banking, where hardware has stronger usage than in consumer banking. Corporate users often perform online banking on a desktop and keep a hardware device at their desk for login and transaction signing. We see FIDO token opportunities there and looking into 2027, which is one reason we feel better about hardware being flat rather than declining. While software is the majority of our business, stabilizing hardware helps the overall numbers.
Okay. And it sounds like FIDO2 is offsetting the decline in the legacy hardware products. Is that right?
It's promising on the banking side overall and getting hardware to a flatter trajectory helps the overall business. It was a larger business a decade ago. Getting it to flat or potentially growing would help overall results, even though software remains the overwhelming majority of our business.
Our next question comes from Rudy Kessinger from D.A. Davidson. Please go ahead.
Just one for me. What did renewals look like in the quarter? I know the overage is good. The hardware looks like it's better, but if I look at ARR, if you take a step down quarter-by-quarter, your expansion rate stepped down a couple points quarter-over-quarter as well. So what do renewals look like? Or any color on the quarter-over-quarter declines in those metrics?
Thanks for the question, Rudy. GRR metrics were relatively consistent. Digital Agreements GRR was around 93% and the security business GRR was around 86%, so within the expected bands. As we mentioned previously, we had a sequential hit of about $3 million from Q1 to Q2, and that's already reflected in these numbers. As we go into the second half of the year, we expect sequential increases in both Digital Agreements and security. We are getting more proactive on renewals; the team is doing a great job reaching out to customers to secure renewals earlier, which gives us better timing visibility. Year-over-year, we had less catch-up revenue from past-due renewals, which indicates improvements in renewal timing. Overall, we see healthy renewal rates and improving metrics as renewals occur more timely.
Our next question comes from Anja Soderstrom from Sidoti.
Most of them have been addressed already, but I'm just curious in terms of M&A. You've been quite acquisitive over the past couple of years. What's your appetite for more acquisitions? And what would you be looking for?
We're certainly open to acquisitions that fit into our product strategy. Over the past 13 or 14 months we've made targeted acquisitions and have been pleased with how we've integrated those teams and technology into DigipassONE. We'll continue to be opportunistic and pursue targeted M&A that is prudent and fits our strategy. The integrations with Nok Nok and Build38 have gone well, and that success reinforces that this remains a viable strategy for us. I won't disclose specifics, but we'll continue to look for opportunities that align with our strategic direction.
And how do you see the market developing over the past couple of months? Have valuations come down or come up?
We are not actively bidding on every opportunity each month, so we're not the best barometer for the month-by-month M&A valuation environment. Overall, we were very happy with the technology and talent we acquired in the Build38 transaction in March and the Nok Nok acquisition last summer, and we'll continue to look where it makes strategic sense.
Okay. And also, I'm just curious about the update to your go-to-market leadership and marketing. How is that evolving? And when do you expect to see some tangible results from those changes?
We're already seeing results. The DigipassONE launch benefited from our new head of marketing, so the impact is being felt. Channel and marketing are important, and given typical sales cycles of 9 to 12 months for our customers, the revenue impact will be more visible in 2027 than in 2026. However, in terms of execution and go-to-market effectiveness, we're already seeing positive impact.
This concludes the question-and-answer session. I would now like to turn it back to Joe for closing remarks.
Thank you, everyone, for joining us today. We look forward to updating you again next quarter. Have a nice evening.
Thank you for your participation in today's conference. This does conclude the program and you may now disconnect.