OSPN

• New Product Launch: OneSpan launched DigiPass 1, its unified integrated authentication and security platform that combines capabilities from the Knock Knock and Build38 acquisitions with the company's existing technologies. The platform has four core modules: DigiPass 1 Authenticate (phishing-resistant authentication supporting passkeys, FIDO2, hardware and mobile tokens), DigiPass 1 Verify (verifiable credentials and digital wallet identity verification), DigiPass 1 Protect (mobile app shielding against tampering and runtime threats), and DigiPass 1 Insights (cross-platform telemetry and threat analytics). The platform positions the company to support the emerging shift to agentic-driven banking interactions, which management expects to be an incremental new channel that does not replace existing digital and physical customer touchpoints.
• Core Financial Results: Total Q2 2026 revenue grew 1% year-over-year to $60.5 million. Subscription revenue grew 11% to $47 million, and now represents 77% of total revenue, up from 70% in Q2 2025. End-of-quarter total ARR was $189.7 million, up 6.7% year-over-year, with a net retention rate of 103%. Adjusted EBITDA was $16.9 million, with an adjusted EBITDA margin of 27.9%. Both segments are solidly profitable at the division level.
• Capital Allocation and Shareholder Returns: The company maintains a balanced capital allocation strategy, prioritizing organic investment, targeted M&A, and shareholder returns. In Q2 2026, OneSpan returned ~$8 million to shareholders via dividends and share repurchases. Total shareholder return over the prior four quarters exceeded $40 million (over $1 per share). The board approved a quarterly dividend of 13 cents per share for the current quarter, and will continue evaluating additional share repurchase opportunities.
• Operational Improvements: The company has made new go-to-market hires, including a new head of marketing and new channel leader, to support accelerated growth. Renewal processes have become more proactive, reducing the amount of lumpy past-due catch-up revenue compared to prior years.

Management raised full-year 2026 guidance driven by higher-than-expected contract overages in the digital agreements business and stronger first-half hardware bookings than originally planned:

• Total revenue guidance increased to a range of $248 million to $252 million, up from the prior range of $244 million to $249 million
• Software and services revenue guidance is maintained at a range of $202 million to $204 million, from the prior range of $201 million to $204 million
• Hardware revenue guidance increased to a range of $46 million to $48 million, up from the prior range of $43 million to $45 million
• ARR guidance is set to a range of $194 million to $198 million
• Adjusted EBITDA guidance increased to a range of $67 million to $71 million, up from the prior range of $64 million to $68 million
• Management expects seasonal recognition patterns for second-half hardware revenue, with roughly one-third of second-half hardware revenue recognized in Q3 (the seasonally weakest quarter) and the majority recognized in the stronger Q4. Management also expects additional digital agreement overage revenue in Q3 2026, but at a lower level than the Q2 2026 overage.

OneSpan operates two core business segments: 1. Cybersecurity: Annual Recurring Revenue (ARR) grew 7.4% year-over-year to $123 million. Total segment revenue decreased 7.5% year-over-year to $40.9 million. Subscription revenue grew 2.5% to $27.2 million, with this growth driven by customer expansions, new client wins, and revenue from the Knock Knock and Build38 acquisitions, partially offset by lower multi-year term license and past-due renewal catch-up revenue. Gross margin was 73% (down from 74% year-over-year), and operating income was $13.8 million, equal to 34% of total segment revenue. This segment contributed 67.6% of total Q2 2026 revenue. 2. Digital Agreements: ARR grew 5.3% year-over-year to $66.7 million. Total segment revenue grew 25.2% year-over-year to $19.6 million, driven by strong overage revenue from higher transaction utilization, contract expansions, and new customer additions. Gross margin improved to 74.7%, up from 71.4% year-over-year. Operating income was $7 million, equal to 35.9% of total segment revenue. This segment contributed 32.4% of total Q2 2026 revenue. By region: 46% of revenue came from the Americas, 35% from EMEA, and 19% from Asia Pacific, compared to 40%, 39%, and 21% respectively in Q2 2025.

Forward-looking statements, including full-year 2026 guidance, are based on current assumptions and are subject to material risks and uncertainties that could cause actual results to differ materially from expectations. Key risks disclosed in SEC filings and the earnings press release include:

• Sustained decline in legacy hardware revenue that could outpace software revenue growth
• Uncertain customer budget allocation and adoption timelines for new product capabilities such as DigiPass 1 Verify, which are tied to 2027 European digital identity regulatory requirements
• Integration and execution risks associated with future targeted M&A activity
• Fluctuations in working capital and overage revenue, which are not included in ARR or net retention rate metrics and can create quarterly volatility

Q: As hardware becomes a smaller segment of the business, what needs to happen for OneSpan to achieve sustainable mid-to-high single-digit organic revenue growth, and what early customer feedback have you seen on DigiPass 1, including potential ASP uplift and net retention improvements? / A: OneSpan's software business has delivered consistent solid growth, which has been offset by declining hardware revenue for years. Stabilizing hardware through growth in FIDO2 security keys will allow overall software growth to flow through to the top line. The new DigiPass 1 platform creates meaningful cross-sell opportunities to OneSpan's large existing customer base for the new app shielding (DigiPass 1 Protect) and verifiable credentials (DigiPass 1 Verify) capabilities, which will drive higher attach rates, increased ASPs, and improved retention to boost software growth. Early customer interest has been positive, just weeks after launch.

Q: What specific use cases is DigiPass 1 Verify targeting, and when will this capability contribute meaningfully to revenue? / A: DigiPass 1 Verify supports cryptographically secure verifiable identity credentials for digital wallets, which is driven by upcoming European digital identity regulation requiring banks to accept regulated digital wallets by the end of 2027. This capability is a natural complementary add-on to OneSpan's core authentication offering, improving secure onboarding and customer interactions globally. The company is currently running proof-of-concepts with customers in H2 2026, and does not yet have full visibility into 2027 customer budgets for this capability, but early POC interest is encouraging.

Q: What is driving the strong Q2 2026 overage revenue in the digital agreements segment, and is this a broad-based trend? What is driving the stronger-than-expected second half hardware revenue guidance? / A: Even after excluding the above-expectation Q2 overages, digital agreements still delivered double-digit year-over-year revenue growth. Overage revenue stems from customers exceeding their contracted transaction volume commitments, and acts as a leading indicator of future ARR growth, as higher utilization typically translates to expanded contracts. Q2 overages were concentrated in a small number of large customers, but the overall trend of higher transaction volumes is positive. Higher hardware guidance reflects stronger first-half 2026 bookings than planned, and growth in FIDO2 security keys, particularly in the corporate banking segment where hardware tokens remain popular. FIDO2 growth is offsetting declines in legacy hardware, and may lead to a stable or even growing hardware business rather than the long-term decline previously expected.

Q: What is OneSpan's current appetite for additional targeted M&A, and when will tangible results from the recent go-to-market leadership changes be seen? / A: OneSpan will continue pursuing opportunistic, prudent targeted M&A that aligns with its core product and platform strategy, after successful integrations of the Knock Knock and Build38 acquisitions that have now been combined into DigiPass 1. The company will not pursue reckless acquisitions, and will focus on opportunities that strengthen its existing security and digital agreement offerings. Tangible execution improvements from the new go-to-market and marketing leadership are already visible, most recently in the smooth launch of DigiPass 1. Material revenue impact from these changes is expected to be mostly seen in 2027, given the 9-12 month sales cycle for most of OneSpan's enterprise deals.