OSPN · Research
OneSpan's 12% Quarter Was 8% Without Upfront Licenses. Its E-Signature Unit Is the Part Compounding
Multi-year licenses booked upfront added $2.3M to OneSpan's third quarter. Underneath, the authentication business lost profit this year while Digital Agreements lifted operating income 84.5% to $19.2M in nine months.
- Q3 revenue growth without the multi-year license pull-forward
- 7.9%
- Digital Agreements operating income growth
- 84.5%
- Owner cash
- $32.1M
1. Verdict and what this piece answers
Verdict: watch. The anchor is trailing twelve-month owner cash of $32.1M, meaning operating cash flow less all capex less stock pay, our calculation [1][3].
We set no base value: owner cash was negative $37.6M in fiscal 2023, so OneSpan has only two positive full years [3].
OneSpan printed third-quarter 2026 revenue of $63.9M, up 12%, raised its full-year revenue guide to $254M to $258M from $248M to $252M, and lifted its Adjusted EBITDA guide to $72M to $76M [2]. The headline reads like a turnaround that has become a growth story.
This piece asks two narrower questions. How much of that 12% will repeat?
And which half of the company is actually compounding?
The answers point in opposite directions. The 10-Q says customers moving from single-year to multi-year on-premises term licenses added $2.3M of revenue in the quarter, because OneSpan books that license revenue upfront [1].
Take it out and the quarter grew 7.9%, our calculation, which sits close to annual recurring revenue growth of 9% [1]. Meanwhile the smaller business the market tends to ignore, Digital Agreements, the e-signature unit built around OneSpan Sign, lifted its nine-month operating income 84.5% to $19.2M on 17% revenue growth
2. Rating metrics
| Metric | Value |
|---|---|
| R&D share of revenue | 15.2%, nine months to Sep 30, 2026, our calculation [1]; about 19.9% if the $9.0M rise in gross capitalized software is added back, our calculation [1] |
| GAAP net margin | 13.7%, nine months to Sep 30, 2026 [1]; fiscal 2025 net income of $72.9M included a $23.5M income tax benefit, so the clean figure is lower [3] |
| API quality | 3 of 5, our scoring: documented public REST APIs and SDKs in several languages for OneSpan Sign, with a free developer sandbox, plus integrations with major CRM and document platforms; no public rate limits or agent tool server confirmed |
| Toll-gate score | 1 of 4 pass, 3 partial (section 2b) |
2b. Thesis and the toll-gate test
Superintelligence agents will open accounts, move money and sign contracts on behalf of people. Each of those acts needs proof that a real person authorized it, and a record that holds up in court or in front of a bank regulator.
OneSpan sells exactly those two things: high-assurance authentication for banks, and e-signatures with consent, non-repudiation and compliance built in [1]. The question is whether that position is a toll gate or a feature that open standards and larger platforms will absorb.
| Test | Result | Evidence |
|---|---|---|
| Owns the record | Partial | Digital Agreements keeps the signed agreement, its audit trail and the evidence of consent, which customers rely on for non-repudiation [1]. In Cybersecurity, the identity record sits in the bank's own systems; OneSpan supplies the authenticator, not the customer file [1] |
| Owns the connection | Partial | SDKs, app shielding and Digipass devices are embedded inside bank apps and shipped to end users, and are sold through distributors, integrators and equipment makers [1]. But passkeys and FIDO are open standards, which lowers the cost of switching vendors over time [1] |
| Prices close to outcomes | Partial | Digital Agreements grew partly on overage usage fees, so revenue rises with signed transactions [1]. Cybersecurity is sold mostly as term licenses and hardware units, priced per user or device, not per secured transaction [1] |
| R&D on the gate vs features | Pass | The unified DigipassONE platform, the Nok Nok Labs passwordless technology and the Build38 mobile app protection all sit on the authentication gate itself [1][2]; research and development headcount rose 11% to an average 265 in the quarter [1] |
One pass and three partials. The partials are the thesis: OneSpan owns pieces of the trust layer, but it owns the record cleanly only in the smaller business, and it is paid by the license and the device rather than by the transaction it protects.
3. Growth
| Measure | Value | Change |
|---|---|---|
| Q3 2026 total revenue | $63.9M | +12.0% [1] |
| Q3 2026 revenue excluding the $2.3M multi-year license effect | $61.6M | +7.9%, our calculation [1] |
| Q3 2026 subscription revenue | $51.5M | +16.0% [2] |
| Nine-month total revenue | $190.3M | +5.6% [1] |
| Trailing twelve-month revenue | $253.2M | our calculation [1][3] |
| Fiscal 2025 total revenue | $243.2M | flat against fiscal 2024 [3] |
| ARR, Sep 30, 2026 | $195.5M | +8.5% from $180.2M [1] |
| Full-year 2026 revenue guide | $254M to $258M | raised from $248M to $252M [2] |
| Full-year 2026 ARR guide | $197M to $201M | raised from $194M to $198M [2] |
Three adjustments explain the gap between the 12% quarter and the 5.6% nine months. First, timing: the multi-year license shift moved revenue into the quarter that will not recur in the same contracts next year [1].
Second, currency: a weaker dollar against the euro added $3.2M of revenue over nine months [1]. Third, acquisitions: Build38 contributed subscription revenue since Feb 27, 2026, an amount the 10-Q calls not material and does not quantify [1].
The steady measure is ARR, up 8.5%, and the full-year guide implies fourth-quarter revenue of roughly $63.7M to $67.7M, our calculation [1][2]. Management itself says the business is best evaluated over a longer term because orders and renewals are lumpy [1].
4. What OneSpan sells and how fast it ships
Cybersecurity is the bigger business, with $44.9M of third-quarter revenue [1]. It sells software, SDKs and Digipass authenticator devices that banks and other regulated companies build into their apps to defend logins and transactions [1].
The products include multi-factor authentication, transaction signing, which shows a customer exactly what payment they are approving, FIDO passkeys and mobile application security [1]. Hardware still matters: Digipass devices brought in $10.5M in the quarter, up 7.4%, our calculation, helped by higher shipments in Asia Pacific, and the company guides hardware to $46M to $48M for the year [1][2].
Over nine months, hardware fell 6.7% to $32.5M [1].
Digital Agreements is the cloud business, with $19.0M of third-quarter revenue [1]. It includes OneSpan Sign e-signature, OneSpan Notary for remote online notarization and Identity Verification [1].
Its customers are mostly banks, insurers and lenders that need a signature to survive an audit, not just a click. Almost all of the segment's revenue, $18.98M of $19.00M, is subscription
5. How each segment makes money
| Segment, nine months to Sep 30 | 2026 | 2025 | Change |
|---|---|---|---|
| Cybersecurity revenue | $134.4M | $132.3M | +1.6% [1] |
| Cybersecurity operating income | $53.1M | $60.6M | -12.4% [1] |
| Cybersecurity sales and marketing | $26.5M | $21.4M | +23.8% [1] |
| Digital Agreements revenue | $55.9M | $48.0M | +16.5% [1] |
| Digital Agreements operating income | $19.2M | $10.4M | +84.5% [1] |
| Digital Agreements segment margin | 34.3% | 21.7% | our calculation [1] |
| Corporate and other costs | $39.5M | $35.1M | +12.5% [1] |
This table is the core of the piece. Cybersecurity grew revenue 1.6% over nine months while its sales and marketing rose 23.8% and research and development rose 15.4%, our calculations, so segment profit fell $7.5M [1].
Some of that is deliberate: OneSpan is hiring into two acquisitions and a new platform launch [1]. Some of it is mix: hardware revenue fell, and perpetual maintenance keeps shrinking as customers move to term contracts [1].
The third quarter looked better, with Cybersecurity operating income up 11.2% to $18.5M, but that quarter carried the $2.3M multi-year benefit [1].
Digital Agreements is the opposite story. Revenue rose 16.5% on overage usage fees, expansions and new customers, while its own sales and marketing fell slightly and its research and development fell 8.5%, our calculation [1].
Gross margin rose to 74% from 71%, helped by lower cloud infrastructure costs [1]. The result is $8.8M of extra segment profit in nine months, more than the $7.5M Cybersecurity lost
6. Retention and the proxy we use
OneSpan discloses a net retention rate defined as year-over-year ARR growth from the same set of customers [1]. It was 105% at Sep 30, 2026, up from 103% a year earlier, which the 10-Q attributes to more contracts expanding in value and lower churn and contraction [1].
ARR growth of 8.5% against 105% net retention implies new customers and acquisitions added roughly 3.5 points, our reading [1]. Because ARR includes term licenses recognized upfront and maintenance, we also watch Digital Agreements subscription revenue, which grew 13.6% in the quarter, as the cleaner proxy for the cloud book [2].
7. Operations
OneSpan is a people business: direct compensation and benefits make up 50% to 60% of operating expenses [1]. Average research and development headcount rose 11% to 265 in the third quarter, sales, marketing and support headcount rose 4% to 176, and general and administrative headcount was 90 [1].
Most of the research hiring came with the acquisitions [1].
Gross margin rose to 76% from 74% in the quarter [1]. Product and license margin jumped to 81% from 75% on a richer hardware mix and more multi-year license revenue, while services and other margin slipped to 72% from 73% on third-party license costs and amortization of acquired and internally built software [1].
Operating expenses rose 17% in the quarter and 12% over nine months, against revenue growth of 12% and 5.6% [1]. Operating income was $9.2M in the quarter, up 12%, but $32.8M over nine months, down 8.7% [1].
Capital spending is now mostly software. Gross capitalized software on the balance sheet rose to $35.6M from $26.6M during 2026 [1], and the 10-Q notes that higher internal software capitalization partly offset research and development growth
8. Free cash flow and owner cash
| Owner cash | FY2023 | FY2024 | FY2025 | 9M 2025 | 9M 2026 | TTM |
|---|---|---|---|---|---|---|
| Operating cash flow | -$10.7M | $55.7M | $59.5M | $46.9M | $44.6M | $57.2M |
| Capex incl. capitalized software and intangibles | $12.6M | $9.3M | $9.1M | $6.1M | $9.7M | $12.7M |
| Stock pay | $14.3M | $9.0M | $11.2M | $9.6M | $10.8M | $12.4M |
| Owner cash | -$37.6M | $37.4M | $39.2M | $31.2M | $24.1M | $32.1M |
Sources [1][3]; owner cash and the trailing figures are our calculation. Owner cash fell 22.8% over nine months, our calculation, because capex rose by $3.6M and stock pay by $1.2M while operating cash flow slipped $2.3M [1].
Working capital was not the main driver: deferred revenue fell $16.1M over nine months, a normal seasonal pattern because many renewals bill in the fourth quarter, and it fell even more, $22.0M, in the same period of 2025 [1]. Interest income on cash shrank to near zero, so there is nothing material to strip out of 2026 [1].
Stock pay took 21.7% of trailing operating cash flow, our calculation, low for a software company [1][3].
Where the cash went in 2026: $14.7M of dividends, $8.3M of buybacks and $34.6M for Build38, against $44.6M of operating cash flow and $9.7M of capex [1]
9. Balance sheet and capital allocation
Net cash is about $46.4M, our calculation [1]. The revolver, signed with MUFG on Jun 23, 2025, runs to Jun 23, 2030, is secured by substantially all assets and carries a net leverage covenant [1].
On May 7, 2026 the board replaced the old buyback with a new $50.0M program; $2.9M was used under it and $47.1M remained at Sep 30, 2026 [1]. Shares outstanding fell to 36.8M from 37.4M [1].
The quarterly dividend continues, payable Dec 4, 2026 [2]. The $5.0M draw is small, but with the dividend, buyback and acquisition together exceeding owner cash this year, OneSpan funded part of its shareholder returns from its cash pile; we treat that as a drawdown, not a surplus.
10. Acquisitions in the last 24 months
Both were paid in cash, with holdbacks of $2.7M for Nok Nok Labs and $1.9M for Build38 released 18 months after closing [1]. Build38 added $26.0M of goodwill and $2.1M of transaction expenses [1].
OneSpan calls the acquired results not material and discloses no acquired revenue [1]. The effect on owner cash so far is negative: the deals brought headcount and amortization ahead of disclosed revenue, which is part of why Cybersecurity profit fell [1].
The test is whether Build38 and Nok Nok Labs show up as subscription growth in Cybersecurity during 2027.
11. Risks and catalysts
Risks: lumpy revenue from multi-year licenses recognized upfront, which can make next year's comparisons hard [1]; hardware declines as banks move to app-based and passkey authentication [1]; open standards such as FIDO and passkeys reducing the advantage of proprietary authenticators [1]; larger platforms bundling e-signature and identity verification; integration risk on two acquisitions in nine months, with Build38 accounting still provisional [1]; currency, since much revenue is in euros [1]; and leadership turnover, with four chief executives between 2021 and 2025 [4].
Catalysts: the DigipassONE Authenticate free trial planned for November 2026 (confirmed plan) [2]; dividend payment on Dec 4, 2026 (confirmed) [2]; settlement of the Build38 working capital adjustment in the fourth quarter of 2026 (confirmed by the 10-Q) [1]; general availability of DigipassONE Verify (date not disclosed) [2]; fourth-quarter 2026 results and 2027 guidance, expected late February 2027 (unconfirmed); release of the Build38 holdback around late August 2027 (confirmed terms)
12. Valuation anchor
We anchor on owner cash, not Adjusted EBITDA. Management guides Adjusted EBITDA to $72M to $76M for 2026, but that measure adds back stock pay and long-term incentive pay of $11.1M over nine months and excludes the capitalized software that now drives capex [2].
Trailing owner cash is $32.1M, less than half of the Adjusted EBITDA guide midpoint, our calculation [1][2]. With fiscal 2023 negative, we have two positive full years plus a trailing figure, short of the three years our method requires before setting a base value.
Against peers in authentication and e-signature, OneSpan ranks low on growth and high on stock-pay discipline: employees take about a fifth of operating cash flow, where many security peers give away more than half.
13. Superintelligence angle
Mixed, with one reason: superintelligence agents raise the number of transactions that need a verified human approval and a defensible signature, which is OneSpan's product, but they also make it easier for platforms and open standards to deliver that proof without a specialist vendor. Transaction signing, where a customer sees and approves the exact payment, becomes more valuable when software initiates the payment [1].
Digital Agreements, which already earns overage fees as signing volume rises, is the side best placed to collect [1]. Cybersecurity's hardware and per-user licenses are the side most exposed to commoditization as passkeys spread.
14. Leadership and control
Victor Limongelli is president and chief executive, and Jorge Martell is chief financial officer [2][4]. Garry Capers, an independent director since April 2021 and a division president at Deluxe, became independent chair in June 2025, and the roles of chair and chief executive are separate [4].
OneSpan has a single class of common stock and no controlling holder [1][4]. As of Apr 8, 2026, the proxy lists BlackRock at 10.0%, Legal and General at 5.6% and Ameriprise at 5.5% [4].
The chief executive received a special performance share grant of up to 300,000 shares in July 2024 [4]. The style is operational: margin discipline first, a dividend and buybacks, then small tuck-in acquisitions to fill product gaps.
15. Questions for the owner and predictions
Questions for the owner. First, should we value Digital Agreements separately, given that it produced 26.6% of segment profit over nine months and is the part growing profit?
Second, how much of Cybersecurity's 2026 cost increase is acquisition build-out that should produce subscription growth in 2027, and how much is permanent? Third, will DigipassONE move pricing from the device and the seat toward the protected transaction?
Fourth, conviction on a 1 to 5 scale: our view is 3. The cash discipline is real and Digital Agreements is compounding, but group owner cash fell this year and the headline growth leaned on timing. The trigger to revisit is fiscal 2026 owner cash above $35M together with ARR growth above 10%.
Predictions to register: fiscal 2026 revenue lands inside the $254M to $258M guide (75%); ARR at Dec 31, 2026 reaches at least $197M (65%); net retention holds at or above 104% at the next print (60%); Digital Agreements full-year operating income rises more than 50% (70%); fiscal 2026 owner cash finishes below fiscal 2025's $39.2M (65%).
Stock Profiles & Comparable Companies
OSPN Stock Profile →More Published Research
View All →Tenable Maps Every Weakness Agents Will Hunt. It Bought Back $516M of Stock on $81M of Owner Cash, and Borrowed the Difference
Tenable owns the exposure record and owner cash is finally positive, but growth is slowing toward 7%, the share count shrank 11.5% on convertible debt, and stockholders' equity turned negative.
SentinelOne Guards the Device Where Agents Run. Owners Lost $291M Last Year, and the Gap Is Widening
Revenue grows near 20% and the products target agent security, but stock pay was 5.6 times operating cash flow, owner cash worsened to -$291.0M, and a new convertible could add 46.1M shares.