OneSpan Inc. Q3 FY2026 earnings call

• Overall Performance: Q3 2026 saw 12% total revenue growth and 12% operating income growth. The company achieved a 'Rule of 42' performance level, up from Rule of 12 in 2023.
• Product Launches (Cybersecurity): Launched the DigiPass One platform, integrating Authenticate, Protect, Verify, and Insights. DigiPass One Verify is scheduled for early next year to support European Digital Identity Regulation requirements by December 2027.
• Product Innovations (Digital Agreements): Enhanced OneSpan Sign with AI-assisted document validation, redesigned UX, and advanced identity verification to serve financial services verticals.
• Customer Metrics: Company-wide Gross Retention Rate (GRR) reached 91%. Net Retention Rate (NRR) was 105%. ARR grew 8.5% YoY to $195.5 million.
• Strategic Acquisitions: Build38 acquisition expanded mobile application protection capabilities, contributing ~1.5 percentage points to ARR growth.
• Shareholder Returns: Paid a quarterly dividend of $0.13 per share. Returned $55 million to shareholders since the start of last year via dividends and buybacks.

Cybersecurity: Revenue was $44.9 million, a 11.3% year-over-year increase. Subscription revenue grew 17.4% to $32.5 million, and hardware revenue increased 7% to $10.5 million. This segment contributed approximately 70% of total company revenue. Gross margin was 77%, and operating income was $18.5 million (41% margin).

Digital Agreements: Revenue was $19.0 million, a 13.5% year-over-year increase. This segment contributed approximately 30% of total company revenue. Gross margin improved to 74%, and operating income was $6.9 million (37% margin). Growth was driven by overages from a major banking customer expanding its contract.

• Full Year 2026 Total Revenue: Raised to $254–$258 million (previously $248–$252 million).
• Full Year 2026 Software and Services Revenue: Raised to $208–$210 million (previously $202–$204 million).
• Full Year 2026 Hardware Revenue: Maintained at $46–$48 million.
• Full Year 2026 ARR: Raised to $197–$201 million (previously $194–$198 million).
• Full Year 2026 Adjusted EBITDA: Raised to $72–$76 million (previously $67–$71 million).
• Margin Outlook: Full year gross margin expected slightly above 74%, driven by higher software/services mix in Q4 offsetting lower hardware shipments.

• Seasonality and Timing Risks: Q3 hardware deliveries were higher than expected due to early token requests, leading to an anticipated decline in Q4 hardware contribution.
• Regulatory Compliance: Must prepare for European Digital Identity Regulation requiring digital wallet support by December 2027; delays or ecosystem issues could impact adoption of DigiPass One Verify.
• Sales Cycle Length: Long sales cycles in large banking institutions may delay revenue recognition from new product launches like DigiPass One.
• Integration Costs: Increased operating expenses related to Build38 integration and organic go-to-market investments partially offset margin improvements.
• Concentration Risk: Significant reliance on expansion from existing large customers rather than new logos, particularly in the cybersecurity segment.

Q: Gray Powell asked about the sustainability of Q3's strong net new ARR in Cybersecurity and whether recent results indicate a durable improvement after past one-time issues.

A: CEO Victor Limongelli stated confidence in the business trajectory, citing the launch of the DigiPass One framework as a key driver for improved Gross Retention Rates. He noted that while two components (Verify and Insights) are not yet released, the preparatory work positions the division for faster growth, though specific 2027 guidance remains premature due to long bank sales cycles.

Q: Rudy Kessinger inquired about the breadth of ARR growth drivers, specifically asking if it was concentrated in new products versus legacy offerings, and when acceleration might occur.

A: CFO Jorge Martell clarified that ARR growth was primarily driven by expansion of existing legacy licenses and transaction volumes, with only minor contributions from Build38 and partner products. He emphasized that land-and-expand strategies with existing large banks remain the core growth engine, as acquiring new logos in top-tier banks is difficult due to market saturation.

Q: Anya Soderstrom asked about Q4 seasonality and the split between growth from existing customers versus new logos.

A: Martell indicated Q4 growth is expected to be consistent with Q3, factoring in lingering churn effects from pre-acquisition periods. He explained that Cybersecurity ARR growth is largely expansion-driven with minimal new logo contribution, whereas Digital Agreements sees slightly more new logo activity (20-30%), but overall strategy focuses on deepening penetration with existing clients.

Q: Catherine Trebnick asked if Passkeys cannibalize DigiPass hardware sales and how AI features are priced in Digital Agreements.

A: Limongelli explained that hardware and passkeys coexist based on use cases; hardware remains preferred in corporate environments across Europe and APAC for high-security desktop authentication, while passkeys suit retail/mobile contexts. Regarding AI features, they are currently bundled to differentiate the product, though future pricing models for enhancements remain TBD.