10-K: OneSpan Navigates Mobile Shift with Strategic Acquisitions

OneSpan Inc. reported flat total revenue for 2025, driven by a strategic shift towards higher-margin software solutions and key acquisitions, while returning $31.6 million to shareholders.

Summary

• Total revenue for the fiscal year ended December 31, 2025, was $243.180 million, remaining flat compared to $243.179 million in 2024.
• Net income increased to $72.904 million in 2025, up from $57.082 million in 2024.
• Operating income rose to $48.446 million in 2025 from $44.805 million in 2024.
• Gross profit increased to $179.354 million (74% gross margin) in 2025, compared to $174.576 million (72% gross margin) in 2024.
• Adjusted EBITDA grew to $77.649 million in 2025 from $73.373 million in 2024.
• Annual Recurring Revenue (ARR) increased by 11% to $186.9 million at December 31, 2025, from $167.7 million in 2024.
• Net Retention Rate (NRR) was 104% at December 31, 2025, a decrease from 106% in 2024.
• The company is undergoing a strategic shift from physical Digipass tokens to higher-margin software solutions, with Digipass revenue declining from 78% of total revenue in 2015 to 20% in 2025.
• OneSpan acquired Nok Nok Labs, Inc., a provider of passwordless software authentication solutions, in June 2025 for $19.2 million (cash consideration of $14.7 million).
• A definitive agreement was entered into in December 2025 to acquire Build38 GmbH, a leader in mobile application protection solutions, for $38.8 million, with closing expected by March 2026.
• A strategic investment of $11.7 million was made in ThreatFabric Holding B.V., a mobile threat intelligence and fraud detection provider, in October 2025.
• The company returned approximately $31.6 million to shareholders in 2025 through quarterly dividends and share repurchases.
• A quarterly cash dividend of $0.13 per share was declared on February 26, 2026, representing an 8.3% increase.
• The restructuring plan, which included the elimination of approximately 345 positions, was substantially completed and terminated as of December 31, 2025.
• Cash and cash equivalents decreased to $70.499 million at December 31, 2025, from $83.160 million at December 31, 2024.
• A $100.0 million revolving credit facility was established in June 2025, with no borrowings outstanding as of December 31, 2025.

Sentiment

Score: 7

Explanation: StockSavvy.ai views this as a moderately positive report, reflecting improved profitability and strategic moves towards software, despite flat overall revenue and a slight dip in NRR. The increased dividend and completed restructuring are strong signals of operational health and strategic execution.

Positives

• Net income significantly increased to $72.904 million in 2025 from $57.082 million in 2024.
• Operating income improved to $48.446 million in 2025 from $44.805 million in 2024.
• Total gross margin increased to 74% in 2025 from 72% in 2024, primarily driven by an increase in higher-margin software revenue and a decrease in hardware revenue.
• Adjusted EBITDA grew to $77.649 million in 2025 from $73.373 million in 2024.
• Annual Recurring Revenue (ARR) experienced an 11% year-over-year growth, reaching $186.9 million at December 31, 2025, boosted by subscription contracts and new customer logos.
• The company successfully completed its restructuring plan as of December 31, 2025, leading to cost optimization and improved operating profitability.
• Strategic acquisitions of Nok Nok Labs and the planned acquisition of Build38, along with an investment in ThreatFabric, are enhancing and broadening the company's software offerings and positioning for future growth.
• The company returned $31.6 million to shareholders in 2025 through quarterly dividends and share repurchases.
• The quarterly cash dividend was increased by 8.3% to $0.13 per share, declared on February 26, 2026.
• Cash provided by operating activities remained strong at $59.454 million in 2025.
• A significant income tax benefit of $23.542 million was recorded in 2025, primarily due to the release of a valuation allowance for the Canadian entity's deferred tax assets.

Negatives

• Total revenue remained flat year-over-year at $243.180 million in 2025.
• Cybersecurity revenue decreased by $4.5 million, or approximately 2%, in 2025, mainly due to lower volumes of Digipass hardware devices sold.
• Revenue from Digipass devices has seen a substantial decline, from 78% of total revenue in 2015 to 20% in 2025, reflecting a secular shift away from physical authentication.
• The Net Retention Rate (NRR) decreased to 104% at December 31, 2025, from 106% in 2024, indicating a slight reduction in revenue expansion from existing customers.
• Cash and cash equivalents decreased by $12.661 million, from $83.160 million in 2024 to $70.499 million in 2025.
• Foreign exchange transaction losses increased to $1.6 million in 2025 from $0.9 million in 2024.
• Other expense, net, increased significantly to $1.069 million in 2025 from $0.125 million in 2024, largely driven by increased foreign exchange transaction losses and lower foreign government subsidies.
• Cybersecurity operating income decreased by $10.1 million, or 11%, in 2025, primarily due to higher sales and marketing and research and development expenses.

Risks

• Challenges in achieving revenue growth objectives, particularly with an anticipated modest decrease in Digipass authenticator token revenue in 2026, requiring significant growth in software solutions to compensate.
• Acquisitions or other strategic transactions, such as the planned acquisition of Build38, may not achieve intended benefits and could disrupt operations due to integration difficulties, customer uncertainty, loss of key employees, or unforeseen liabilities.
• New product offerings and enhancements may not keep pace with customer needs or achieve sufficient customer acceptance, potentially impacting competitive position and financial results, especially if competitors integrate advanced technologies like generative AI more quickly.
• A significant portion of sales is concentrated among a limited number of customers (top 10 customers contributed 18% of revenue in 2025), making the company vulnerable to the loss of substantial sales from any one of them.
• The markets for cybersecurity and digital agreements solutions are highly competitive, with larger competitors possessing greater financial, technical, marketing, and brand resources, potentially hindering the ability to attract and retain customers.
• Inability to enhance brand recognition and maintain brand reputation could adversely affect business, potentially leading to difficulties in attracting new customers and reduced pricing power.
• Security breaches or cyberattacks could expose the company to significant liability, damage its business and reputation, and harm its competitive position, especially with evolving AI-driven attack methods and reliance on third-party service providers.
• International operations (79% of 2025 revenue and 54% of operating expenses outside the U.S.) expose the company to risks such as geopolitical conflicts, compliance costs with foreign regulations (e.g., GDPR, EU Data Act), trade policies, and foreign currency exchange rate fluctuations.
• The Digipass authenticator business relies on a complex global supply chain and a limited number of suppliers, making it vulnerable to disruptions from geopolitical disputes, tariffs, natural disasters, and component shortages, potentially leading to increased costs or inventory losses.
• The sales cycle for products is often long (typically 9 to 18 months in financial services), leading to substantial upfront expenses for sales that may not materialize or be delayed, causing fluctuations in financial results.
• Real or perceived malfunctions and errors in products could result in warranty and product liability risks, economic damages, and reputational harm, potentially leading to customer dissatisfaction or regulatory audits.
• Inability to retain key employees and successfully hire and train qualified new employees could hinder the achievement of business objectives and competitive standing.
• Financial results may fluctuate significantly from period to period due to various factors, making it difficult to project future results and potentially causing the stock price to decline if expectations are not met.
• The company may be unable to maintain or increase its level of profitability, having operated at a loss in many past years, including a net loss of $29.8 million in 2023.
• The $100.0 million revolving credit facility contains financial covenants and restrictions that could limit operational flexibility and adversely affect financial condition if not complied with.
• Dependence on third-party hosting providers (e.g., Amazon Web Services) and other technology vendors for cloud infrastructure and services creates vulnerability to service interruptions, delays, and security breaches.
• Potential for additional tax liabilities and limitations on the ability to use net operating losses (NOLs) due to changes in ownership (Section 382 of the Internal Revenue Code) or insufficient future taxable income.
• Provisions in various agreements potentially expose the company to substantial liability for intellectual property infringement and other losses, including indemnification obligations and claims related to data usage or AI.
• Failure to protect proprietary technology and intellectual property rights could substantially harm business and operating results, especially in countries with weaker IP protection laws.
• Use of open-source software in products, and increasingly generative AI coding tools, could subject the company to litigation or other actions if licenses are violated or third-party intellectual property rights are infringed.
• Significant government regulation of technology imports and exports, including U.S. export controls and tariffs, could negatively impact revenue and increase costs.
• Cryptographic technology in products could become less effective if codes are broken or subject to additional government regulation, potentially leading to a decline in demand.
• International and domestic laws and regulations relating to data privacy, protection, access, sharing, portability, and use (e.g., GDPR, EU Data Act, state privacy laws, biometric data regulations) could have a material adverse impact on operations and increase compliance costs.
• Compliance with public company requirements, including maintaining effective disclosure controls and internal control over financial reporting, is costly and any failure could adversely affect investor confidence.
• Business in certain countries and transactions with foreign governments increase risks associated with anti-corruption laws (e.g., FCPA, U.K. Bribery Act).
• Numerous laws, regulations, and customer/product certification requirements (e.g., NIS2, DORA, REACH, RoHS, FIPS, FIDO) governing product design, production, distribution, and sale could result in unanticipated costs or operational disruptions.
• The company may require additional capital to support business objectives, and this capital might not be available on acceptable terms, or at all, especially given global financial market volatility.
• The company's stock price has been and will likely continue to be volatile due to various factors, including operating results, market valuations, and geopolitical events.
• A small group of shareholders (Blackrock, Vanguard, Legal & General, Ameriprise) control a substantial amount of common stock, potentially influencing or preventing a change of control.
• Provisions in the corporate charter and Delaware law make a takeover of the company more difficult, potentially limiting the price investors might be willing to pay for common stock.
• Actions of activist stockholders could be costly, time-consuming, and divert management attention, potentially harming reputation and business opportunities.
• Economic uncertainties or downturns could materially adversely affect business through reduced demand, increased costs, and customer financial difficulties.
• Catastrophic events such as natural disasters, cyberattacks, war, or pandemics may disrupt business operations and lead to system interruptions, reputational harm, and data security breaches.

Future Outlook

OneSpan expects revenue from its Digipass authenticator tokens to decrease modestly on a year-over-year basis in 2026, consistent with past trends. The company is focused on driving revenue growth in higher-margin software solutions, specifically through further expansion of its Cybersecurity software solutions and continued growth in its Digital Agreements division. It plans to continue investing in Digipass authenticators, including newer FIDO2 devices, as part of its broad authentication portfolio. The company also anticipates ongoing investments in property, equipment, and infrastructure, and may pursue additional acquisitions and equity investments to support its business objectives.

Management Comments

• Victor Limongelli, President and Chief Executive Officer, certified that the annual report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made not misleading.
• Victor Limongelli also certified that, based on his knowledge, the financial statements and other financial information included in the report fairly present in all material respects the financial condition, results of operations, and cash flows of the registrant.
• Victor Limongelli stated, "We are focused on driving revenue growth in higher-margin software solutions, both through further expansion of our Cybersecurity software solutions and through continued growth in our Digital Agreements division."
• Management believes its internal control over financial reporting was effective as of December 31, 2025, to provide reasonable assurance regarding the reliability of financial reporting.

Industry Context

StockSavvy.ai notes that OneSpan's strategic shift towards higher-margin software and cloud-based solutions aligns with broader industry trends of increasing digital engagement, rapid AI adoption, and an expanding threat landscape. The decline in physical authentication devices (Digipass) reflects the prevalent 'mobile-first' approach in banking and other sectors, where secure, convenient mobile access is prioritized. Acquisitions like Nok Nok Labs (FIDO passwordless authentication) and the planned Build38 acquisition (mobile application protection) position the company to address the growing demand for advanced mobile security and identity solutions. The continued focus on digital agreements also capitalizes on the industry's move towards intelligent, automated, and AI-assisted workflows, moving beyond traditional PDF-based processes.

Comparison to Industry Standards

• OneSpan's Net Retention Rate (NRR) of 104% at December 31, 2025, while positive, is below the 120%+ NRR often targeted by leading SaaS companies, suggesting room for improvement in expanding revenue from existing customers compared to high-growth peers.
• The company's strategic pivot from hardware-centric (Digipass) to software-based authentication solutions aligns with industry leaders like Okta and Duo Security (a Cisco company), which primarily offer cloud-native identity and access management (IAM) solutions, reflecting a broader market preference for flexible, mobile-centric security architectures.
• In the electronic signature market, OneSpan Sign competes with significantly larger players such as DocuSign and Adobe Systems, which hold dominant market shares. OneSpan's focus on secure, compliant digital agreements with integrated identity verification aims to differentiate its offerings in this competitive landscape.
• The acquisition of Nok Nok Labs (FIDO software) and the planned acquisition of Build38 (mobile app protection) position OneSpan to compete more directly with specialized cybersecurity firms offering advanced authentication and mobile security, such as Ping Identity (now part of Thoma Bravo) and Zimperium, by enhancing its capabilities in passwordless and in-app security.

Management Changes

Corporate Governance

Legal Proceedings

• The company is subject to certain legal proceedings and claims incidental to its business operations.
• The company does not currently anticipate that these matters, if resolved against it, will have a material adverse impact on its financial results or financial condition.
• An accrual of $0.3 million for loss contingencies related to probable and reasonably estimable losses was recorded as of December 31, 2025.
• No reasonably possible losses for which an estimate can be made were identified as of December 31, 2025.

Stakeholder Impact

• Shareholders: Benefited from $31.6 million returned through dividends and share repurchases in 2025, and a declared 8.3% increase in the quarterly dividend. However, they face potential dilution from future equity financings and risks from stock price volatility.
• Employees: Approximately 345 positions were eliminated as part of the restructuring plan. The company emphasizes competitive compensation, benefits, engagement, a hybrid workplace policy, and professional development, with a low voluntary turnover rate of 5.8% in 2025.
• Customers: Stand to benefit from enhanced product offerings through strategic acquisitions (Nok Nok Labs, planned Build38) and investments (ThreatFabric), providing a wider range of flexible and advanced security solutions. However, they face risks of product malfunctions, security breaches, or service interruptions.
• Suppliers: The Digipass supply chain, heavily reliant on a limited number of manufacturers in China and Romania, is exposed to risks from geopolitical disputes, tariffs, natural disasters, and component shortages, which could impact costs and delivery.
• Creditors: The company has obligations under a $100.0 million revolving credit facility, secured by substantially all tangible and intangible assets, and is subject to financial covenants that could limit operational flexibility.

Next Steps

• Close the acquisition of Build38 GmbH, expected by March 2026, to extend investment in advanced mobile security technologies.
• Continue to invest in Digipass authenticators, including newer FIDO2 devices, as an important component of the broad authentication solution portfolio.
• Drive revenue growth in higher-margin software solutions, both through further expansion of Cybersecurity software solutions and continued growth in the Digital Agreements division.
• Continue to purchase property and equipment to support business growth and invest in infrastructure.
• Potentially make additional acquisitions and equity investments to achieve business objectives and respond to challenges.
• Pay the declared quarterly cash dividend of $0.13 per share on March 27, 2026, to shareholders of record as of March 13, 2026.
• Regularly evaluate alternative manufacturing and supply arrangements for Digipass, including potentially moving more production from China to Romania or other locations, to mitigate supply chain risks.

Key Dates

Recommendation

While OneSpan demonstrated improved profitability, increased Adjusted EBITDA, and a growing Annual Recurring Revenue (ARR) in 2025, the flat total revenue and a slight decline in Net Retention Rate (NRR) indicate ongoing challenges in driving top-line growth and expanding value from existing customers. The strategic acquisitions of Nok Nok Labs and the planned Build38 acquisition are positive steps towards strengthening the software portfolio and addressing the mobile-first trend, but their full impact on revenue growth needs to materialize. The increased dividend signals management's confidence and commitment to shareholder returns. However, given the mixed revenue performance and the need for successful integration and execution of the strategic shift, a 'hold' recommendation is appropriate for a seasoned investor, awaiting clearer signs of accelerated revenue growth and sustained NRR improvement.

Keywords

Cybersecurity, Digital Agreements, Authentication, e-Signature, Fraud Prevention, Mobile Security, FIDO, Passwordless, Identity Verification, SEC Filing, 10-K, Financial Technology, SaaS, Cloud Solutions, Risk Management, Corporate Governance, Software Development, Financial Reporting, OSPN