Thank you, operator. Hello, everyone.

Thank you for joining the OneSpan Second Quarter 2026 Earnings Conference Call. This call is being webcast and can be accessed on the Investor Relations section of OneSpan's website at investors.onespan.com.

Joining me on the call today is Victor Limongelli, our Chief Executive Officer, and Jorge Martell, our Chief Financial Officer. This afternoon, after market close, OneSpan issued a press release announcing results for our second quarter of 2026.

To access a copy of the press release and other investor information, please visit our website. Following our prepared comments today, we will open the call for questions.

Please note that statements made during this conference call that relate to future plans, events, or performance, including the outlook for full year 2026 and other long-term financial targets, are forward-looking statements. These statements involve risks and uncertainties, and are based on current assumptions.

Consequently, actual results could differ materially from the expectations expressed in these forward-looking statements. I direct your attention to today's press release and the company's filings with the US Securities and Exchange Commission for a discussion of such risks and uncertainties.

Also note that certain financial measures that may be discussed on this call are expressed on a non-GAAP basis and have been adjusted from a related GAAP financial measure. We have provided an explanation for and reconciliations of these non-GAAP financial measures to the most directly comparable GAAP financial measures in the earnings press release and in the investor presentation available on our website.

In addition, please note that all growth rates discussed on this call refer to a year-over-year basis unless otherwise indicated. The date of this conference call is August 4th, 2026.

Any forward-looking statements and related assumptions are made as of this date. Except as required by law, we undertake no obligation to update these statements as a result of new information or future events, or for any other reason.

I will now turn the call over to Victor.

Thank you, Joe. Hello, everyone.

Thank you for joining us today. We had a strong second quarter, including subscription revenue growth of 11% and solid profitability, with an adjusted EBITDA margin of 28%.

Before reviewing our results in more detail, I'd like to spend a few minutes discussing our recently launched DIGIPASS 1 authentication platform, which represents an important milestone in OneSpan's evolution. DIGIPASS 1 unifies the innovations from our Nok Nok Labs and Build38 acquisitions with OneSpan's existing capabilities, delivering a single integrated platform solution.

DIGIPASS 1 includes four components: DIGIPASS 1 Authenticate, DIGIPASS 1 Verify, DIGIPASS 1 Protect, and DIGIPASS 1 Insights. First and foremost, DIGIPASS 1 Authenticate builds on the foundation of the world's broadest suite of authentication functionality, including passkeys, FIDO2 security keys, hardware tokens, mobile authenticators, and software authenticators to deliver secure, phishing-resistant login and transaction signing.

Banks and other high-value, high-trust customers gain the flexibility to support different users, devices, and authentication preferences through a unified platform. DIGIPASS 1 Verify expands the platform with our new capabilities for verifiable credentials and digital wallets.

Verifiable credentials are designed to improve onboarding, authentication, and trust by enabling cryptographically secure and tamper-proof identity verification. DIGIPASS 1 Protect strengthens the offering with our mobile application shielding technology.

Delivered via both SDKs and post-compilation app wrapping, it protects mobile apps against tampering, abuse, and runtime threats, promoting reliability and trustworthiness for users. Last but not least, DIGIPASS 1 Insights ties it all together with telemetry and analytical insights across authentication flows and application protection signals so that customers can better react to imminent threats or challenging operating environments.

Looking ahead, over the next few years, we expect consumers to begin using agents to conduct banking and other high-value transactions, and we further expect that the development of this new channel for customer interaction will augment, not replace, the existing channels of in-person, online, and mobile. In other words, in the future, banks will continue to engage with their customers across branches, websites, and mobile apps while adding a new category of agent-driven banking interactions.

DIGIPASS 1 provides the foundation to help banks and other high-value, high-trust businesses authenticate customers, verify intent, and protect transactions across both existing and emerging channels. We see the shift to agentic-driven interactions in the future as an opportunity to extend our offering and further strengthen our value to our customers.

Stepping back, the launch of DIGIPASS 1 is a key milestone in a broader platform strategy that strengthens our ability to innovate, deepen customer relationships, address new market opportunities, and support long-term growth. Turning to our digital agreements business, where we focus on delivering secure, seamless agreement workflows purpose-built for financial services and other highly regulated industries, we believe our combination of white-labeled e-signatures, identity verification, and workflow automation provides a meaningful differentiator in the market.

In addition, we are investing in AI-enabled capabilities designed to help customers improve efficiency, gain deeper insights from agreement workflows, deliver a better end-user experience, seamlessly integrate with agentic workflows, and simplify deployment within existing environments. Turning to our results, as mentioned, we had a solid second quarter, including generating $17 million of adjusted EBITDA, or 28% of revenue.

We ended the second quarter with annual recurring revenue of $190 million, up 7% year-over-year. Total Q2 revenue grew 1% to $60.5 million, and second quarter subscription revenue grew 11% to $47 million and accounted for 77% of total revenue, up from 70% in last year's Q2.

Both business units continue to be solidly profitable at the division level, supporting our board's commitment to a balanced capital allocation strategy that considers shareholder returns, organic investment, and targeted M&A. In the second quarter, we returned almost $8 million to shareholders through dividends and share repurchases, and on an aggregate basis over the last four quarters, the total return to shareholders exceeds $40 million, or over $1 per share.

The board has also approved a quarterly dividend of 13 cents per share to be paid in the current quarter and will continue to evaluate additional share repurchase opportunities. In summary, we continue to make progress in building a stronger foundation for future growth.

We have expanded our capabilities through targeted acquisitions and internal innovation, both of which are evidenced in the launch of DIGIPASS 1. We remain focused on serving our customers now and investing for the future in order to be able to continue delivering value to them for years to come.

With that, I'll turn the call over to Jorge.

Thanks, Victor, and good afternoon, everyone. I'm very pleased to report another strong quarter and continued progress in building a solid foundation for growth.

I'm particularly excited about our recent launch of DIGIPASS 1, our platform strategy built to help customers modernize authentication and address other security needs without disrupting existing systems, user experience, or business operations. Turning to our results, annual recurring revenue, or ARR, increased 6.7% year-over-year to $189.7 million, driven by expansion of existing customer contracts, new logos, and the acquisition of Build38.

Our net retention rate, or NRR, was 103%. Q2 revenue was $60.5 million, an increase of 1% compared to last year's second quarter, driven by 11% growth in subscription revenue, partially offset by a decline in hardware revenue due to the fact that significant hardware revenue had been pulled forward into Q1, which we discussed with you last quarter, as well as a decline in perpetual maintenance revenue as customers continue to move to term licenses.

For the quarter, as Victor mentioned, subscription revenue increased to 77% of total revenue, up from 70% in the prior year quarter, while hardware and perpetual maintenance revenues accounted for a combined 23% of total revenue, as compared to 30% in last year's Q2. Gross margin was 73.6%, compared to 73.5% in Q2 of last year.

GAAP operating income was $8.7 million, compared to $10.5 million in Q2 2025. The year-over-year change primarily reflects increased operating costs related to our recent acquisitions, including headcount, as well as certain cost-related go-to-market leadership and other organic investments.

GAAP net income per share was 18 cents, compared to 21 cents in the second quarter of last year. Non-GAAP net income per share was 30 cents, compared to 34 cents in last year's Q2.

Adjusted EBITDA and adjusted EBITDA margin were $16.9 million and 27.9%, respectively. This is compared to $17.6 million and 29.5% in the same period last year.

Next, I will discuss the financial results for our two business divisions, starting with Cyber Security. Cyber Security ARR grew 7.4% year-over-year to $123 million, inclusive of the $3 million headwind we discussed last quarter and the acquisition of Build38.

Revenue decreased 7.5% to $40.9 million. Subscription revenue grew 2.5% to $27.2 million, driven by customer expansion contracts, new logos, as well as revenue from our acquisitions of Nok Nok and Build38, partially offset by lower year-over-year multi-year term license revenue and lower past-due renewal catch-up revenue this quarter compared to last year's second quarter as we continue to improve our on-time renewal performance.

As noted, hardware and perpetual maintenance revenue declined as expected. Gross margin for the Cyber Security division was 73%, compared to 74% in the prior year quarter, primarily reflecting incremental third-party license costs and incremental amortization of capitalized software costs from the Build38 acquisition.

Operating income was $13.8 million, or 34% of revenue, compared to $19.8 million, or 45% of revenue, in last year's Q2. The year-over-year change was driven by the differences in revenue and gross margin just discussed and increase in operating expenses from acquired companies and increased organic investments.

Now turning to Digital Agreements. ARR grew 5.3% year-over-year to $66.7 million.

Revenue grew 25.2% to $19.5 million, driven by strong overage revenue, expansion of renewal contracts, and new customer additions. We are encouraged by the strong overage revenue because it is a positive indicator of transaction volume growth, which often results in expansion contracts with existing customers due to higher utilization rates.

We expect additional overages in the third quarter of 2026, but not to the same extent as in Q2. As a reminder, overages are not included in ARR or NRR.

Gross margin improved to 74.7%, up from 71.4% in the prior year period, primarily reflecting higher revenue, including overage revenue. Operating income was $7 million, or 35.7% of revenue, compared to $2.9 million, or 18.4% of revenue, in the same period last year.

The strong improvement in operating income was primarily driven by revenue growth, higher gross margin, and a modest decline in operating expenses, primarily reflecting higher internal software capitalization costs. Turning to our balance sheet, we ended the second quarter with $43.3 million in cash and cash equivalents and $5 million outstanding under our credit facility, compared to $49.8 million in cash and cash equivalents and no outstanding debt at the end of the first quarter.

During the quarter, our primary cash outflows included $4.8 million for our quarterly dividend, $2.9 million to repurchase approximately 230,000 shares of common stock, and $3 million for capitalized software development costs. Operating cash flow was a modest outflow of $0.1 million, primarily reflecting normal networking capital fluctuations.

By geographic region, revenue in the second quarter of 2026 was 46% from the Americas, 35% from EMEA, and 19% from Asia Pacific, compared to 40%, 39%, and 21% from the same regions in the second quarter of 2025, respectively. The year-over-year changes in revenue by region primarily reflect growth in Digital Agreements and Cyber Security software in the Americas, which is consistent with our investment strategy and plan, lower Cyber Security hardware and software revenue in EMEA, partially offset by growth in Digital Agreements, and lower hardware revenue in Asia Pacific, partially offset by an increase in Cyber Security software.

Now turning to some modeling notes and our outlook. We are pleased with our second quarter results and the progress we've made in positioning the company for long-term growth.

For the full year 2026, we are increasing our revenue guidance, primarily to reflect higher volumes and consumption in our e-signature business that is expected to result in incremental contract overages, along with an increase in expected hardware revenue in the second half of the year, primarily Q4, due to increased hardware bookings in the first half of the year as compared to our plan. Our current hardware revenue forecast calls for about one-third of the second half hardware revenue to be recognized in Q3, which is consistent with the last couple of years, showing Q3 as the seasonally lowest of the four quarters, followed by a much stronger fourth quarter.

More specifically, for the full year 2026, we expect total revenue to be in the range of $248 million to $252 million, as compared to our previous guidance range of $244 million to $249 million. We expect software and services revenue to be in the range of $202 million to $204 million, as compared to our previous guidance range of $201 to $204 million.

We expect hardware revenue to be in the range of $46 to $48 million, as compared to our previous guidance range of $43 to $45 million. We expect ARR to be in the range of $194 million to $198 million.

We expect adjusted EBITDA to be in the range of $67 to $71 million, as compared to our previous guidance range of $64 million to $68 million. That concludes my remarks.

I will now turn the call back to Victor.

Thanks, Jorge. To recap, we are pleased with our second quarter results and the progress we continue to make across the business.

We are serving our customers with mission-critical solutions, investing in areas where we see meaningful growth opportunities, and maintaining the financial discipline that enables us to return capital to shareholders. We believe OneSpan is becoming a stronger and more focused company, and we remain committed to creating long-term value for our customers and shareholders.

Jorge and I will now be happy to take your questions.

Great. Thanks for taking the question.

Maybe a couple on my side. More of a high-level question, I guess.

Just thinking out over the next year or two, as hardware becomes a smaller component of the business, how should we think about the potential for growth to improve on a sustainable basis? Then just more specifically, what are the two or three things that need to happen for OneSpan to sustainably get revenue growth back into the call it mid to high single digits on an organic basis?

Thanks, Gray. I think you're familiar with this.

We've certainly talked about it in the past and you can see it in the numbers. Over time, our software business has been growing, and we had an offset, a negative offset, from the hardware business for quite some time.

And— Yep. —we thought if we could get the hardware business stable, maybe have some revenue coming from the newer security keys, as well as stabilization in the overall hardware business, that that growth would show up.

Overall growth would show up as a result of the software growth. You see it in the subscription revenue numbers, you see it in the ARR numbers, we've been having solid software growth and we expect that to continue.

Obviously, we're not giving guidance for next year, but we have some exciting things happening in terms of our product portfolio, the new DIGIPASS 1 platform, and we have emerging technologies with DIGIPASS 1 Verify, as well as new hires that we've announced on the go-to-market side, a new head of marketing, new channel leader, etc. We are taking all those steps to build for additional growth and get those targets that you're talking about.

That's helpful. Then just, I guess, a separate question.

Look, I know DIGIPASS 1 has only been out a couple of weeks. Anything you can see in early feedback or customer interest?

Then just trying to think through what kind of ASP uplift you think that could create for the platform and the potential for net retention rates to improve off of current levels?

Yeah. If you think about the platform, we had a very strong authentication offering, which we strengthened considerably about a year ago, a little over a year ago, when we bought Nok Nok and added the passkey capability.

We had that strong authentication platform, and we have been providing app shielding, what we're calling DIGIPASS 1 Protect, for some time, but now we own the technology with the acquisition of Build38. Those are cross-sell opportunities going to all of the banks that we have and adding app shielding and a new capability that we're developing, DIGIPASS 1 Verify.

Those are cross-sell opportunities. If you think about how to increase revenue growth rates, you're either selling existing things to new customers, or new things to existing customers, or newer or existing things to new customers as well.

The easiest path there is going to be a cross-sell, to sell new things to existing customers, and that's what we're trying to do to drive up the attach rate with DIGIPASS 1 Protect, to start down the path of an attach rate with DIGIPASS 1 Verify, since that's new. Both of those give us an opportunity because we do have this great customer base built up over many years, and that's where we see the most straightforward way to increase the software growth rates.

Understood. Thank you.

Oh, thanks for taking my question. Exploring the agent-driven interactions as incremental to the channel, I know you just released this product, any specific use cases that your marketing team has identified that you're going after, like high-value payments, dispute resolution?

Then what are you actually seeing in the budget for '26, or should we really think of this more like a '27 item? Then, Gray already grabbed my question on the ASP, thanks, Catharine.

Then, well, let me change it to go ahead. Catherine, just to— Go ahead.

To clarify, are you asking about DIGIPASS 1 Verify?

Yes.

That's a new capability. We're doing POCs with customers in the second half of the year.

We released an early release version of that in June, and we expect to be learning a lot more about budgets as we go through the process. I think you know this, but in general— But— Oh, go ahead.

Sorry.

No, no, I'm just trying to figure out what use cases you'd be targeting with that and how different that is from what you're currently selling.

If you think about what it's doing, there is a European Digital Identity regulations. The countries have to have wallet specifications done by the end of the year.

Obviously, that's going to be many, many different wallets. You have Google and Apple as well.

Then banks are going to have to accept them by the end of '27. We see this as just such a great complement to our authentication offering because people are going to in a cryptographically tamper-proof way prove their identity, which is, obviously, super important in onboarding and, in general, authentication.

We see this as an add-on that a lot of banks, well, first of all, in Europe there're going to be regulatory drivers behind it, but also in other markets, it's going to be a super helpful way to make for more secure interactions with your customers. Now, in terms of budgets for it, there are regulatory drivers in '27.

Probably over half of our bookings come between September and Labor Day and the end of the year, we're heading into our busy season in terms of sales, and I would say we don't have a clear read on 2027 budgets from our customers yet because we're focused, as you might imagine, very much on closing 2026 business. The POCs and the interest we're seeing from customers are a good sign.

Great. Very good.

Thank you.

Thanks for taking the question and congrats on a good quarter and getting DIGIPASS 1 out. Just following up on Catherine's question, what are the use cases for banks that are using AI agents for banking?

Then I'm just curious on the Digital Agreements side, was the overage associated with a particular account, or is this more of a broader trend? It seemed like it was a particularly strong quarter, and you're talking about some strength in Q3, what's driving that?

I'll let Jorge answer the overage question, but let me talk about AI agents. If you think about mobile banking apps, the most common activities that are undertaken by customers are things that are pretty straightforward: checking their balance, sending money to a friend or payment for something, monitoring transactions that have hit or not hit their account.

We think that agents will do not all of it, right? I think this is going to be a new channel for banks, not everything will happen with agents.

If you fast-forward four or five years, then banks are interacting with customers in their physical branches—some people still go into those, a few people at least—through websites on a laptop or desktop, through a mobile banking app, which is very, very common today, but also through agentic workflows. Now, the ability for a bank to accept those agentic workflows, for a consumer to have an agent that they use to hit multiple different accounts and for the bank to be able to authenticate that this agent is authorized to act on behalf of this consumer and to verify intent, there's work to be done on those things, but I think that channel is absolutely coming.

One of the things that we offer to banks and other high-trust, high-value customers is this breadth of offering. We're not offering just passkeys, or just protection for their mobile banking app, but across the ways that you interact with your customers, you don't need multiple vendors for this customer interaction.

You can use OneSpan and cover Well, we don't cover branches, I guess, but you can cover all of the digital channels.

I can jump in and address the Digital Agreements overage question, Erik. Thanks for the question.

Look, I think we were very happy in terms of how DA performed for the quarter, 25% growth. Even if you exclude the overages, which were about year-over-year higher by 2 and change million, you still get to a growth, Erik, of double-digit, 11.3%, which is pretty encouraging.

Again, take a step back and think about how are these overages generated, they're generated because our clients are overutilizing the volume of transactions that they committed, which is a good thing. Arguably, you can think about overages as a leading indicator for ARR, if you would, because often happens that overages then translate to higher expansion contracts, now part of ARR.

At this point, if it's an overage, it's not part of ARR, it's not part of NRR and all those metrics, but you can think about overages as a leading indicator for ARR and then a leading indicator for revenue. We feel good about that, obviously happy with the performance, and, yeah, it did come from, I would say, a couple of customers primarily, Erik.

We normally have our run rate of overages for the full year, I'll talk full year now, probably about a million to a million-five. I think this year we're obviously going to exceed that amount.

For the second half of the year, it's going to be much less than that we recognized so far in the first half, but nonetheless, we feel good about overages. We like overages not only because it's revenue, but is a leading indicator for activity in our platform.

Okay. Then real quick on—

That's very helpful. Yep.

One last one on the hardware. It looks like you're looking for a pretty strong second half.

Is that driven by FIDO2, or is there anything that's incrementally picking up in the second half within the hardware?

I can Go ahead, Jorge.

Just real quickly. We increased our guidance for hardware from $44 million midpoint to now $47 million, Erik.

The primary reason for that is I guess couple of things. One is we saw better activity or higher activity compared to our plan bookings-wise in the first half of the year, which gives us confidence in terms of when these orders are going to get delivered.

The earlier we have the bookings, the higher likelihood that those bookings will get delivered in-year. For that reason, have better visibility and then increase our guidance as well.

Go ahead, Vic.

I was going to say the FIDO2 security keys, we see an avenue for that even within banking to make for easier login, primarily not exclusively, but primarily in the corporate banking market, where hardware is a little bit stronger in corporate banking than in consumers. Consumers tend to use a mobile banking app.

Many, many corporate customers, if they're a treasury department or something like that, are doing their online banking in front of a big screen, where a hardware device is not inconvenient. They keep it in their desk drawer, and then they use it when it's time to log in and time for a transaction signing as well.

We see the FIDO token opportunity there as well looking ahead to '27, which is one of the reasons we feel better than we have in the past about hardware, about being able to have that be a flattish business rather than a declining business. Obviously, we haven't given '27 guidance, but it's encouraging what we've seen in '26 on the hardware side.

It sounds like it's finally the FIDO2 is offsetting the decline in the legacy hardware products, is that right?

It's promising on the banking side overall, and getting hardware to a it was quite a large business a decade ago. Getting it to a flat to potentially even growing if things go really well business really helps the overall numbers, even though, of course, software is the overwhelming majority of our business.

It helps to not to have a decline in a segment.

Very good. Thank you.

Thanks, Erik.

Thank you.

Hey, guys. Great.

Thank you for the question. Just one for me.

What did renewals look like in the quarter? I know the overage is good, the hardware looks like it's better, but if I look at ARR, it took a step down quarter-over-quarter.

Your net expansion rate stepped down a couple of points quarter-over-quarter as well. What did renewals look like, or any color on the quarter-over-quarter declines in those metrics?

I can give you some commentary, Rudy. Thanks for the question.

Look, I think GRR metrics for the businesses were, I'd say, relatively consistent. I think Digital Agreements was in the 93-ish percent, and the GRR for Security business was in the kind of 86-ish percent, Rudy.

Relatively consistent within the band. As we mentioned sequentially, we were going to have a hit of about $3 million just sequential Q1 to Q2, and that's already part of these numbers.

As we go into the second half of the year, we expect to see sequential increases of both DA and Security. Overall, I think I would say healthy renewal rates.

We're getting more proactive. The team is doing a fantastic job at being proactive, reaching out to customers, and trying to secure those renewals as early as possible.

It gives us visibility into the timing. One of the things that you also noticed in my prepared remarks, Rudy, is that year-over-year, we did have less, call it, catch-up revenue from past-due renewals just year-over-year.

That's also an indication that, as we get better at renewals and those renewals are getting timely renewed, then you're not going to see this incremental lumpiness, if you would, because renewals are getting closed past due. That's also another sign that the team is doing great on renewals, and we're improving those metrics.

Thanks, Rudy.

Hi, and thank you for taking my questions. Most of them have been addressed already, but I'm just curious in terms of M&A, you've been quite acquisitive over the past couple of years.

What's your appetite for more acquisitions, and what would you be looking for? We're certainly,

as you can tell by the last 13 or 14 months, open to the idea if it fits into our product strategy, and you can see I'm really happy with the way we were able to take those two and fold it into our overall offering with DIGIPASS 1. You can see how that strengthens the overall business.

We're going to continue to be opportunistic and look for, the term we've used is targeted M&A. We want to be prudent in how we do it and not reckless.

We're definitely going to be looking for things that fit in well and that make sense for us. Then the other thing, really kudos to our team and the teams from Nok Nok and Build38 that joined us because the integrations have gone very well.

We've been able to build a unified team, I think, and retain talent and all those things have been good proof points for us to make us continue to think that that's a viable strategy. In terms of what we would be looking for, I don't want to disclose too much in that area, but you can see, I think, strategically where we're headed.

Things that fit into our overall strategy, we'll continue to look for them.

How do you see the market has developed over the past couple of months? Has valuations come down, or come up, or what do you—

I don't know if we're the right person to ask on the month-by-month M&A market because we're looking, but we're not actively bidding every month on a business. Overall, I think, we were very, very happy with the talent that we acquired, the technology we acquired with the deal earlier this year in March with Build38, as well as last summer with Nok Nok, and we'll continue to look.

Thank you. Also, I'm just curious about the update to your go-to-market leadership and marketing.

How is that evolving, and when do you expect to see some tangible results from those changes?

Look, we're already seeing results. The DIGIPASS 1 launch I don't think would have gone as well, or as smoothly without our new head of marketing.

The impact's already being felt. Channel and marketing are both super important.

Revenue, I think it's fair to say if you think about a 9- to 12-month sales cycle for most of our customers and our deals, I think the impact's more in 2027 than in 2026 in terms of tangible revenue. In terms of execution, we're already seeing an impact.

Thank you. That was all for me.

Thanks, Anja.

Thank you, everyone, for joining us today. We look forward to updating you again next quarter.

Have a nice evening.