OneSpan’s business model transformation is well underway, with recurring software now the dominant revenue driver and a unified platform (DigiPass One) enabling cross-sell and deeper customer penetration. The company’s differentiation is strongest in regulated verticals where compliance, integratio…
OneSpan (OSPN) Q2 2026: Subscription Revenue Rises to 77% of Mix, Platform Strategy Drives Cross-Sell Focus
OneSpan’s Q2 showcased a pivotal mix shift as subscription revenue reached 77% of total, underscoring the company’s transition toward recurring, software-centric growth. The launch of DigiPass One, a unified authentication platform, signals a platform-led cross-sell strategy aimed at deepening wallet share within the high-trust banking vertical. Management’s tone and guidance upgrades point to confidence in sustainable ARR expansion, even as hardware and perpetual revenue headwinds persist.
Summary
- Subscription Mix Transformation: Recurring revenue now dominates, reflecting a strategic pivot away from hardware.
- Platform Unification: DigiPass One integrates acquisitions and legacy assets, targeting cross-sell into existing banking customers.
- Guidance Raised on Digital Agreements Strength: Upbeat outlook driven by overage momentum and improved hardware bookings.
Business Overview
OneSpan provides digital identity security and agreement workflow solutions, primarily to financial institutions and regulated industries. The company generates revenue through two segments: Cybersecurity, which offers authentication, app protection, and hardware security tokens, and Digital Agreements, which delivers e-signature, identity verification, and workflow automation. Revenue is increasingly subscription-based, with hardware and perpetual licenses forming a shrinking minority of the mix.
Performance Analysis
Q2 marked a decisive shift in OneSpan’s revenue composition as subscription revenue grew 11% year-over-year and now constitutes 77% of total revenue, up from 70% a year ago. Total revenue growth was modest, reflecting ongoing headwinds from hardware and perpetual maintenance, but the recurring base continues to expand, with annual recurring revenue (ARR) up 7% to $190 million. Adjusted EBITDA margin remained robust at 28%, though operating income and net income per share saw slight declines, primarily due to acquisition-related costs and strategic investment in go-to-market and R&D.
Segment results reveal diverging growth patterns. The Cybersecurity division’s ARR increased 7%, but reported revenue declined 7.5% as hardware and perpetual license sales softened. In contrast, Digital Agreements posted a 25% revenue jump, propelled by strong transaction overages and expansion contracts, supported by a healthy margin improvement. Notably, overage revenue in Digital Agreements is viewed as a leading indicator for future ARR expansion, signaling increased customer engagement and utilization.
- Subscription Revenue Outpaces Legacy Decline: The acceleration in recurring software mitigates headwinds from hardware and perpetual maintenance erosion.
- Digital Agreements Overage Surge: Transaction-driven overages point to rising platform adoption and future expansion potential.
- Hardware Stabilization Emerges: FIDO2 security keys and improved bookings provide visibility, with hardware now positioned for flattening rather than persistent decline.
Geographically, Americas revenue share rose to 46%, reflecting strategic focus, while EMEA and APAC both saw hardware softness but some offset from software and agreement growth. Cash flow was modestly negative, reflecting dividend payments, share repurchases, and continued investment in software development.
Executive Commentary
"DigiPass One unifies the innovations from our Knock Knock Labs and Build38 acquisitions with OneSpan's existing capabilities, delivering a single, integrated platform solution. ... We see the shift to agentic-driven interactions in the future as an opportunity to extend our offering and further strengthen our value to our customers."
Victor Limongelli, Chief Executive Officer
"Annual recurring revenue, or ARR, increased 6.7% year-over-year to $189.7 million, driven by expansion of existing customer contracts, new logos, and the acquisition of Bill 38."
Jorge Martell, Chief Financial Officer
Strategic Positioning
1. Platform Unification and Cross-Sell Enablement
DigiPass One, the new authentication platform, is the cornerstone of OneSpan’s cross-sell strategy. By integrating acquired technologies and legacy assets into a single suite—Authenticate, Verify, Protect, and Insights—the company is positioned to offer banks and regulated customers a unified solution for authentication, app shielding, and verifiable credentials. This approach aims to deepen customer penetration and increase attach rates, leveraging OneSpan’s established client base.
2. Recurring Revenue Emphasis and Mix Shift
The migration from hardware and perpetual licenses toward subscription and term-based models is accelerating. Management highlighted that hardware’s drag on growth is diminishing, and with new security key products, the segment could stabilize. The recurring revenue focus not only improves visibility but also enhances margin structure and long-term customer value.
3. Regulatory and Agentic Channel Readiness
Emerging European digital identity regulations and the rise of agent-driven banking interactions are shaping OneSpan’s roadmap. DigiPass One Verify is being positioned to capitalize on regulatory mandates for digital wallets and verifiable credentials, with pilot programs underway and broader adoption anticipated as compliance deadlines approach.
4. Targeted M&A and Integration Execution
Recent acquisitions (Knock Knock Labs, Build38) have been successfully integrated, strengthening both product and talent bench. Management remains open to further “targeted M&A,” with a disciplined focus on strategic fit and operational integration, signaling a willingness to augment organic growth with selective deals as opportunities arise.
Key Considerations
Q2’s results reinforce OneSpan’s ongoing business model transformation and operational focus, but also surface key areas for investor scrutiny as the company pivots toward a platform-led, software-first trajectory.
Key Considerations:
- Cross-Sell Momentum: DigiPass One’s unified offering is designed to drive incremental revenue from the installed base, but execution on attach rates and upsell remains a watchpoint.
- Digital Agreements Overages: Sustained overage growth signals rising transaction volume, but normalization is expected in H2, making it critical to convert overages into durable ARR expansion.
- Hardware Headwind Moderation: FIDO2 key adoption and improved bookings may stabilize hardware, reducing its drag on consolidated growth rates.
- Go-to-Market Realignment: New leadership in marketing and channel strategy is expected to yield tangible results in 2027, but impact on near-term sales cycles will be limited.
Risks
Key risks include execution on cross-sell and upsell into the existing customer base, especially as new platform components are rolled out and require customer adoption. Hardware demand, while stabilizing, remains cyclical and exposed to large order timing. Regulatory-driven wallet adoption could be slower or more fragmented than anticipated, especially outside Europe. Finally, integration risk from recent and potential future acquisitions could strain operational focus if not tightly managed.
Forward Outlook
For Q3 2026, OneSpan expects:
- Hardware revenue to account for roughly one-third of second-half hardware revenue, with Q3 seasonally lowest.
- Digital Agreements overage revenue to moderate from Q2 levels but remain above historical run rates.
For full-year 2026, management raised guidance:
- Total revenue: $248 million to $252 million (up from $244 million to $249 million prior).
- Software and services revenue: $202 million to $204 million.
- Hardware revenue: $46 million to $48 million.
- ARR: $194 million to $198 million.
- Adjusted EBITDA: $67 million to $71 million (up from $64 million to $68 million).
Management cited confidence in digital agreements transaction momentum and improved hardware bookings visibility as drivers of the guidance raise, while cautioning that overage revenue is inherently variable and hardware remains subject to delivery timing.
- Subscription and platform cross-sell to drive ARR growth.
- Hardware bookings visibility supports outlook stabilization.
Takeaways
OneSpan’s Q2 demonstrates a business in transition, with recurring software now the clear engine of growth and a platform-led strategy poised to unlock deeper customer penetration.
- Mix Shift to Recurring: Subscription and ARR gains are now outweighing legacy declines, improving revenue quality and predictability.
- Platform and Cross-Sell Execution: DigiPass One’s integration and cross-sell focus are central to future growth, but attach rate realization will be key to sustaining momentum.
- Watch Overage Conversion and Hardware Stabilization: Investors should monitor whether strong overages in digital agreements translate into durable ARR, and if hardware can remain flat or modestly accretive to growth.
Conclusion
OneSpan’s Q2 results underscore a successful pivot toward a subscription-driven, platform-led business model, with management’s guidance raise reflecting confidence in both digital agreements momentum and hardware stabilization. The next phase of value creation will depend on cross-sell execution and regulatory-driven adoption, with new go-to-market leadership and product integration setting the stage for potential acceleration in 2027.
Industry Read-Through
The rapid mix shift toward subscription revenue at OneSpan mirrors broader security and SaaS industry trends, where recurring models and platform unification are increasingly favored by both customers and investors. The company’s focus on agent-driven workflows and verifiable credentials aligns with regulatory and technological shifts in digital identity across banking and fintech. Hardware stabilization, aided by FIDO2 security keys, suggests that even legacy segments can find a role in a modernized product suite if integrated thoughtfully. Other cybersecurity and workflow automation providers should note the importance of cross-sell readiness and the operational discipline required to successfully integrate acquisitions and deliver on platform promises.