OneSpan (OSPN) Q1 2026: Subscription Revenue Hits 80% of Mix as Hardware Slips to 16%
OneSpan’s Q1 saw subscription revenue reach 80% of total sales, signaling a decisive pivot from legacy hardware to recurring software and services. The company’s acquisitions and internal R&D are broadening its authentication and mobile security portfolio, but near-term ARR faces a modest headwind from two non-renewing contracts. Management reiterated full-year profitability guidance and raised ARR expectations, highlighting ongoing business model transformation and prudent capital allocation.
Summary
- Recurring Revenue Model Accelerates: Subscription now dominates, with hardware shrinking further in relevance.
- Acquisitions Expand Product Breadth: Recent M&A enhances mobile security and passwordless authentication offerings.
- Profitability Focus Maintained: Company remains committed to cash generation and capital returns despite sector volatility.
Performance Analysis
OneSpan’s Q1 2026 results reflect a business in the midst of a structural shift from hardware-centric sales to a recurring, software-driven model. Total revenue grew modestly, with digital agreements up double digits and cybersecurity showing steady, if slower, growth. The company’s annual recurring revenue (ARR) rose 14% year-over-year, aided by the acquisitions of Knock Knock Labs and Build38, which together contributed roughly $11 million in ARR, but organic ARR growth was closer to 7-8%.
Subscription revenue, now at 80% of total sales, is the primary engine of growth, while hardware revenue continued its secular decline, dropping to just 16% of mix. Gross margins held steady near 74%, and both divisions—cybersecurity and digital agreements—delivered positive operating income. Cash flow from operations was robust, enabling continued buybacks and a raised quarterly dividend, yet operating income and adjusted EBITDA margins compressed year-over-year due to acquisition-related expenses and ongoing investment in R&D and go-to-market initiatives.
- Mix Shift to Recurring Revenue: Subscription and SaaS now comprise the vast majority of revenue, with hardware in long-term decline.
- Margin Stability Amid Investment: Gross margins held firm despite acquisition costs, reflecting operational discipline.
- Capital Allocation Balance: Share repurchases, dividends, and M&A all featured, signaling confidence in cash generation.
The company’s focus on ARR and recurring revenue is yielding improved retention and higher-quality earnings, but the near-term outlook is tempered by customer transitions and hardware headwinds.
Executive Commentary
"Subscription revenue grew 8% year over year, and our adjusted EBITDA margin was 32%. I'm also happy to report that notwithstanding the doom and gloom you might hear about software, our gross revenue retention increased again in Q1, reaching 90% for the company as a whole and 94% for our digital agreements business."
Victor Lomonduli, Chief Executive Officer
"Annual recurrent revenue, or ARR, increased 14.1% year-over-year to $192.1 million, inclusive of the two acquisitions. Our net retention rate was 105%, benefiting from customer expansion contracts. ARR also benefited from new customer additions and M&A."
Jorge Martel, Chief Financial Officer
Strategic Positioning
1. Recurring Revenue Model Gains Critical Mass
Subscription revenue now accounts for 80% of total sales, a result of deliberate migration away from hardware and perpetual licenses. This shift is central to OneSpan’s business model, which prices cybersecurity solutions by end-user volume and digital agreements by transaction count, not seat-based licensing. This model aligns revenue growth with customer adoption and usage, creating more stability and scalability.
2. Portfolio Expansion via Targeted M&A
Acquisitions of Build38 and Knock Knock Labs have materially expanded the product suite. Build38, mobile application security, brings telemetry and SDK-based app protection, addressing critical mobile banking threats. Knock Knock Labs, passwordless authentication, has grown ARR by 20% since acquisition and positions OneSpan as a leader in FIDO-based authentication. These deals not only add ARR but also enhance cross-sell and upsell opportunities within the installed base.
3. Hardware Decline and Strategic Offsetting
Legacy hardware revenue is in secular decline, now just 16% of mix, as banks and financial institutions shift toward mobile and software-based authentication. While some hardware demand will persist for niche use cases, management is clear that future growth will be driven by software and services. Cross-selling FIDO2 hardware with Knock Knock software is an emerging, but not yet material, opportunity.
4. R&D and AI-Driven Product Roadmap
Ongoing investment in R&D is focused on embedding AI and workflow automation into digital agreements, aiming to enhance security, compliance, and customer integration. This is expected to drive differentiation and higher retention, especially in regulated industries like financial services.
5. Balanced Capital Allocation and Shareholder Returns
Management continues to prioritize a balanced approach, deploying capital across acquisitions, internal investment, buybacks, and dividends. The board remains open to further repurchases, underscoring confidence in cash flow durability.
Key Considerations
OneSpan’s Q1 demonstrates measurable progress in business model transformation, but also surfaces key execution and market considerations for investors:
Key Considerations:
- Subscription Penetration: The business is now predominantly recurring, but further mix improvement depends on digital agreements and cybersecurity SaaS outpacing hardware erosion.
- Acquisition Integration: Recent deals are contributing to ARR and product breadth, yet integration costs and realization of full cross-sell potential remain in early innings.
- Geographic Mix Shift: Americas are gaining share as EMEA moderates; management sees under-penetration in North America as an ongoing growth lever.
- Customer Retention and Upsell: Gross revenue retention is improving, particularly in digital agreements, but cybersecurity retention, while higher, still trails, highlighting upsell and competitive risk.
- Hardware Stabilization: While hardware is not expected to go to zero, any stabilization depends on success in FIDO2 hardware and cross-sell with software, which is not yet proven at scale.
Risks
Key risks remain around the pace of organic ARR growth, with Q2 facing a $3 million ARR headwind from two non-renewing cybersecurity contracts—one driven by a customer’s move to passwordless before OneSpan acquired Knock Knock. Hardware revenue is in irreversible decline, and while management expects some baseline demand to persist, the risk is that hardware shrinks faster than recurring revenue grows. Geopolitical volatility in EMEA and the Middle East, while not currently material, could impact pipeline and deal timing. Integration of acquisitions and realization of anticipated synergies also bear execution risk.
Forward Outlook
For Q2 2026, OneSpan guided to:
- Continued software and services revenue growth, led by digital agreements and moderate cybersecurity expansion.
- An estimated $3 million ARR headwind from two non-renewing contracts in cybersecurity.
For full-year 2026, management affirmed and raised guidance:
- Total revenue: $244 to $249 million
- ARR: $194 to $198 million (up from $192 to $196 million prior)
- Adjusted EBITDA: $64 to $68 million
Management expects ARR growth to accelerate in the second half as seasonality and pipeline conversion favor Q4, and highlighted the strategic importance of the Knock Knock acquisition in winning future passwordless business.
- Most ARR growth expected in Q4 due to seasonality
- Hardware revenue to remain in secular decline, but not go to zero
Takeaways
OneSpan’s Q1 confirms the business is shifting decisively to a recurring revenue model, with subscription and ARR now defining its growth trajectory. Acquisitions are adding product breadth and ARR, but organic growth and hardware erosion remain the key watchpoints for long-term value creation.
- Subscription Model Now Dominant: The company is no longer dependent on hardware, with 80% of revenue recurring and digital agreements leading growth.
- Acquisition Synergies Still Developing: Knock Knock and Build38 enhance the offering, but full cross-sell and upsell impact will take time to materialize.
- Investors Should Monitor ARR Growth and Hardware Baseline: The pace of organic ARR acceleration and signs of hardware stabilization or further decline will be critical in assessing OneSpan’s path to the Rule of 40 and sustainable value creation.
Conclusion
OneSpan’s Q1 2026 results reinforce its evolution into a software-first, recurring revenue business, underpinned by strategic acquisitions and disciplined capital allocation. Execution on organic ARR growth and hardware transition will determine whether the company delivers on its long-term targets and navigates the remaining headwinds.
Industry Read-Through
OneSpan’s pronounced shift from hardware to recurring software revenue is emblematic of broader security and digital workflow trends. The continued decline of hardware tokens in favor of cloud-based authentication and e-signature solutions reflects how financial services and regulated industries are modernizing identity and transaction security. Vendors lacking a robust recurring revenue mix or modern authentication stack face margin and retention risk, while those investing in AI-driven workflow automation and passwordless protocols are better positioned for durable growth. M&A remains a key lever for portfolio expansion in the security sector, but successful integration and cross-sell execution are critical for realizing value.