OneSpan Inc. Q1 FY2026 earnings call

• Acquisitions: Completed acquisition of Build 38 which enhances mobile application security offering; acquisition of Knock Knock Labs has led to ARR increase of about 20% in less than 10 months since closing. - R&D: Investing in internal R&D, including in digital agreements business to integrate AI - driven capabilities. - Revenue composition: Subscription revenue now includes term maintenance revenue; hardware now comprises only 16% of overall revenue. - Geographic revenue: Q1 2026 revenue was 43% for EMEA, 38% from Americas, 19% from Asia Pacific.

Cybersecurity: ARR grew 16.5% year over year to $124.6 million in Q1. Revenue increased 1.7% to $48.5 million. Subscription revenue grew 6.6% to $35.3 million. Hardware revenue declined 4.3%. Gross margin was 74% compared to 76% in prior year quarter. Operating income was $20.8 million, or 43% of revenue. Digital agreements: ARR grew 9.9% year over year to $67.5 million. Revenue grew 11.2% to $17.4 million. Growth margin improved to 72.5% from 70.3% in prior year period. Operating income was $5.3 million, or 30.4% of revenue.

• Affirming full year 2026 guidance for revenue and adjusted EBITDA. - Raising guidance for ARR. - Expecting total revenue in range of $244 - $249 million for 2026, software and services revenue in range of $201 - $204 million, hardware revenue in range of $43 - $45 million, ARR in range of $194 - $198 million, and adjusted EBITDA in range of $64 - $68 million. - Anticipating second quarter ARR headwind of approximately $3 million from two contracts not expected to renew.

• Forward - looking statements involve risks and uncertainties as actual results could differ materially. - Secular shift away from consumer banking hardware tokens could impact business. - Middle East situation could potentially impact business, though Gulf region is a small part of revenue.

Q: When will we start to realize returns from operations in 2026 and when can we anticipate acceleration in top line and when will we get back to rule of 40?

A: Progress has been made on Rule of 40 metrics, but no exact date for reaching 40. Progress seen in ARR and subscription growth.

Q: What was the knock - knock ARR and O38 ARR as of end of Q1 and impact of Middle East conflict?

A: Novnost ARR was $9.7 million, Bill 38 ARR was $2.8 million. Gulf region is 4% of revenue, EMEA is a smaller portion, optimistic about EMEA and cautiously watching Middle East.

Q: Where is strongest pull with Knock Knock within installed base and upsell opportunity?

A: Strongest in North America with Japan strength, opportunity for upsell as passwordless becomes more prevalent.

Q: Main purpose of Build 38 acquisition?

A: Broadens the offering, SDK - based implementation enables telemetry and broader cybersecurity solution.

Q: Size of shortfall from non - renewing contracts in second quarter and confidence in raising ARR guidance?

A: One account is about $2 million, confidence from growth seen so far, pipeline, and seasonality with more business closed in Q4.

Q: Number of FIDO2 customers buying both Knock Knock backend software and tokens and synergistic sale?

A: Not too many currently, opportunity to cross - sell, knock - knock offering has advantages like device - bound keys.

Q: Plan for hardware over next 12 months?

A: Consumer banking tokens expected to continue decline, FIDO2 security piece could offset decline if grown, focus on growing subscription and ARR