OneSpan: Where should the next product and go-to-market effort go?
Download case PDF (5 pages)Request teacher’s pack
Decision date and information cutoff: 4 August 2026, 4:05 p.m. ET
Case convention: The decision and role below are constructed for class. They do not represent a disclosed OneSpan management or board debate.
The decision
At 4:05 p.m. Eastern on August 4, OneSpan had just released second-quarter results. A conference call was scheduled for 4:30 p.m. The release showed a business growing at different speeds: Cybersecurity revenue fell 7% from the prior-year quarter, while Digital Agreements revenue rose 25%. Total revenue increased 1%. Two weeks earlier, OneSpan had announced DigipassONE, a unified authentication platform that brings together authentication, digital credentials, mobile application protection and analytics. The Verify component had entered early access during Q2. [P1; P2]
For this classroom exercise, assume you have been asked to recommend how OneSpan should pace the next increment of product and go-to-market resources. Should the company focus on commercializing DigipassONE and strengthening Cybersecurity, direct more effort toward Digital Agreements, or stage a portfolio plan with measurable gates? This is a constructed assignment, not a claim that OneSpan had a specific pending budget, management vote or capacity constraint.
Prepare a short decision memo that chooses a policy, identifies the strongest argument against it, and names the evidence that would change your recommendation. Do not assume that the two portfolios share customers, technology, or a sales channel.
One company, two portfolios
OneSpan describes two reportable business lines. Cybersecurity includes software, software development kits and Digipass authenticator devices. The company says its on-premises and cloud products include passkeys, FIDO authentication, multifactor authentication, transaction signing and mobile application security. Digital Agreements includes cloud-based OneSpan Sign e-signature, OneSpan Notary and identity-verification solutions. The company reports both portfolios separately; it does not disclose their customer overlap or whether one creates demand for the other. [P1, Ex. 99.1, lines 263–270]
OneSpan announced DigipassONE on July 22 as a platform to connect authentication, transaction signing, digital credentials, application protection and analytics. The four components are Authenticate, Verify, Protect and Insights. The release described gradual modernization so customers could continue to support existing authentication methods while adopting new ones. OneSpan said Verify entered early access in Q2. These are company descriptions of the offering and product direction; the eligible results release provides no paid-adoption, implementation, attach-rate or renewal data for DigipassONE. [P1, lines 18–20 and 37–46; P2]
The platform announcement followed the March 2 completion of OneSpan's acquisition of Build38, which the company described as a mobile application-protection provider. The Q2 release presents mobile application protection as a DigipassONE component. The public materials available for this exercise do not quantify Build38's standalone contribution or establish the returns from its integration. [P3; P4]
OneSpan says it is trusted by more than 60% of the world's 100 largest banks. In its 2025 Form 10-K, the company names Gemalto (a Thales subsidiary), RSA Security and Yubico as its main authentication competitors, and DocuSign and Adobe Systems as primary competitors in electronic signatures. It also names mobile-device management, threat-protection and identity-and-access-management providers as adjacent competition. OneSpan identifies solution effectiveness, technical features, ease of use, reliability, support, brand, customer base, distribution and total cost of ownership as competitive factors. This is the issuer's description of its competitive set, not independent market-share or product-comparability evidence; the sources provide no like-for-like competitor pricing, adoption or product-economics comparison. [P1, lines 75–85; P5, Item 1, “Competition”]
Results point in different directions
In Q2, Digital Agreements generated less revenue than Cybersecurity but grew faster. Subscription revenue increased overall, and management raised its full-year guidance. At the same time, operating income and Adjusted EBITDA were lower than in the prior-year quarter. The Q2 results do not identify a causal explanation for segment growth or a return on the next sales or engineering dollar. [P1]
Exhibit 1. Selected operating results
USD millions, except growth rates and percentages. Reported quarter ended June 30; year-over-year growth compares with the same quarter of 2025.
| Measure | Q2 2025 | Q2 2026 | Change / note |
|---|---|---|---|
| Total revenue | $59.843 | $60.466 | +1.0% (derived; issuer rounds to +1%) |
| Cybersecurity revenue | $44.235 | $40.928 | −7.5% (derived; issuer rounds to −7%) |
| Digital Agreements revenue | $15.608 | $19.538 | +25.2% (derived; issuer rounds to +25%) |
| Subscription revenue, total | — | $46.7 | +11% (issuer-reported) |
| Annual recurring revenue (ARR) | — | $189.7 | +7% year over year |
| Net retention rate (NRR) | — | 103% | Company-defined |
| Gross profit / margin | $43.967 / 73% | $44.483 / 74% | Margin figures rounded by issuer |
| Operating income | $10.506 | $8.741 | GAAP; reported |
| Net income | $8.342 | $6.781 | GAAP; reported |
| Adjusted EBITDA | $17.638 | $16.895 | Company-defined non-GAAP measure |
Source: OneSpan Q2 2026 results release, Exhibit 99.1, lines 21–35 and 91–139; exact segment values also at lines 271–302; Adjusted EBITDA reconciliation at lines 387–400. Dollar values converted from thousands to millions. Growth rates marked “derived” are calculated from the displayed reported values. ARR and NRR are not GAAP revenue or segment margins. OneSpan defines ARR as approximate annualized value of recurring contracts, including subscription, term-based license, and maintenance/support, excluding one-time fees; NRR is approximate year-over-year ARR growth for the same customer set at prior-year period end (lines 69–71).
Exhibit 2. Segment profitability and corporate costs
USD millions, Q2; segment operating income is reported by OneSpan and excludes separately reported Corporate and Other costs.
| Segment / item | Q2 2025 revenue | Q2 2025 operating income (loss) | Q2 2026 revenue | Q2 2026 operating income (loss) |
|---|---|---|---|---|
| Cybersecurity | $44.235 | $19.799 | $40.928 | $13.819 |
| Digital Agreements | $15.608 | $2.879 | $19.538 | $6.972 |
| Corporate and Other | — | $(12.172) | — | $(12.050) |
| Consolidated | $59.843 | $10.506 | $60.466 | $8.741 |
Q2 2026 gross profit was $29.891 million for Cybersecurity (73% margin) and $14.592 million for Digital Agreements (75%); gross margin rates are rounded. Segment operating income deducts expenses attributed directly to a segment. Corporate costs remain outside the segment figures. These historical measures are not standalone segment cash flows or marginal returns. [P1, Ex. 99.1, lines 263–306 and footnotes 342–351]
Exhibit 3. Cybersecurity revenue by category
USD thousands; Q2 year over year. The comparison uses OneSpan's updated presentation for Q2 2025.
| Category | Q2 2025 | Q2 2026 | Change |
|---|---|---|---|
| Subscription | $26,532 | $27,186 | +$654 |
| Perpetual maintenance and services | $3,688 | $2,303 | −$1,385 |
| Hardware products | $14,015 | $11,439 | −$2,576 |
| Cybersecurity total | $44,235 | $40,928 | −$3,307 |
OneSpan revised its revenue presentation effective January 1, 2026, moving term maintenance revenue into subscription and grouping perpetual maintenance with services. It says the change was presentation-only, did not affect total revenue, operating income or cash flows, and that prior-period results were updated for comparability. Q2 2025 Cybersecurity subscription includes $5.9 million of reclassified term maintenance. The bridge describes reported revenue categories; it does not explain customer demand or identify a specific product, channel or strategic cause. [P1, Ex. 99.1, lines 355–376]
Investment and liquidity context
At June 30, cash and cash equivalents were $43.337 million, compared with $70.499 million at December 31. The balance sheet showed $5 million outstanding under the revolving credit facility. Those figures describe June 30, not cash available on August 4 or an amount allocated to either portfolio. [P1, Ex. 99.1, lines 145–198]
During the first half of 2026, operating cash flow was $28.069 million. Investing activities used $40.974 million, including $34.554 million of cash paid for acquisitions net of cash acquired and $6.420 million of property and intangible additions. Financing activities used $14.375 million: $9.834 million of dividends and $8.297 million of repurchases were partly offset by $5 million of revolver borrowings, among other items. Foreign-exchange effects added $0.118 million. The resulting $27.162 million cash decrease reconciles beginning cash of $70.499 million to $43.337 million at June 30. Acquisition cash paid is not attributed wholly to Build38 in the release. [P1, Ex. 99.1, lines 203–257]
The company reported approximately 230,000 shares repurchased for $2.9 million during Q2 and declared a $0.13-per-share dividend payable September 4 to shareholders of record August 14. The release does not provide an additional repurchase authorization balance or a post-quarter cash figure. H1 cash-flow repurchases of $8.297 million and the Q2 narrative amount are reported on different lines; the release does not reconcile them. [P1, lines 33–35, 47, 203–257]
Exhibit 4. Management's full-year 2026 outlook
| Measure | Updated range | Previous range |
|---|---|---|
| Total revenue | $248–252m | $244–249m |
| Software and services revenue | $202–204m | $201–204m |
| Hardware revenue | $46–48m | $43–45m |
| ARR | $194–198m | — |
| Adjusted EBITDA | $67–71m | $64–68m |
These are management forecasts, not realized results or product-specific targets. The Q2 release provides no prior-range comparator for ARR; the dash does not imply a new Q2 update. The company did not reconcile Adjusted EBITDA guidance to GAAP net income because certain items could not be predicted without unreasonable effort. [P1, Ex. 99.1, lines 49–68]
The assignment
Recommend how OneSpan should pace incremental product and go-to-market resources across the two portfolios. Consider three policy designs:
- Prioritize DigipassONE/Cybersecurity commercialization. Focus product completion, customer migration and targeted selling on the newly announced authentication platform while maintaining Digital Agreements operations.
- Favor Digital Agreements expansion. Direct more incremental commercial effort toward the segment with faster reported Q2 growth while sustaining Cybersecurity support.
- Stage a portfolio plan. Choose an initial balance between the two efforts and set evidence-based gates for releasing later resources. Staging is a pacing rule, not a separate investment use.
The alternatives are constructed for the exercise. No dollar budget, actual product allocation, adoption target, or board decision is disclosed in the sources. If your recommendation uses a hypothetical budget or numerical hurdle, label it as your assumption and explain what company-specific data would be needed to calibrate it.
Address the following in your memo:
- Which policy do you recommend, and what is the strongest evidence for it?
- What is the best argument against your choice? What result would make you change course?
- Which measures should determine whether the next tranche continues or stops? Distinguish product adoption, customer economics, segment operating results and cash use.
- What customer, competitor, product, implementation and financial data are missing before a full-scale commitment?
Sources and information boundary
- P1: OneSpan Inc., Form 8-K, accession 0001044777-26-000038, accepted August 4, 2026 at 4:04:47 p.m. ET; Exhibit 99.1, Q2 2026 results release.
- P2: OneSpan, “OneSpan Introduces DigipassONE, Bringing a Unified Platform Approach to Authentication Modernization,” July 22, 2026.
- P3: OneSpan, “OneSpan Reports First Quarter 2026 Financial Results,” April 30, 2026.
- P4: OneSpan, “OneSpan Completes Acquisition of Build38,” March 2, 2026.
- P5: OneSpan Inc., 2025 Form 10-K, filed February 26, 2026, Item 1, “Competition” (SEC HTML lines 282–290; competition description, company-identified peers and factors).
The Q2 results call was scheduled for 4:30 p.m. ET, after this case's cutoff. The Q2 Form 10-Q, accession 0001044777-26-000040, was accepted at 5:23:30 p.m. ET. Both the call and the 10-Q, along with any later transcript or subsequent event, are outside the information set for this case.