OneSpan Inc.

OneSpan claims the "identity gate before the regulated, high-value transaction" — strong customer authentication (SCA/PSD2 in Europe, FFIEC guidance in the US) plus cryptographic transaction signing and regulated e-signature. The historical moat was the certified Digipass hardware token; the strategic claim now is that DigipassONE (a unified authentication platform + verifiable-credentials/digital-wallet layer) re-bundles passkeys, FIDO2, hardware tokens, mobile-app shielding, and e-signature into one regulated-identity rail for financial institutions.

• Banking-grade transaction signing — cryptographic approval of specific transaction data (amount, payee), not mere login MFA. Deeper than passkeys/FIDO2 login; this is the residual durable core.
• FIPS 140-2/3 + Common Criteria (EAL) certification on Digipass hardware/software authenticators — a ~6–18 month re-certification cycle that creates regulatory switching friction for financial institutions.
• DigipassONE platform (launched ~late July 2026) — four components: Authenticate (passkeys, FIDO2 security keys, hardware/mobile/software tokens), Verify (verifiable credentials / digital wallets — early-access Q2 2026), Protect (mobile app shielding), Insights (telemetry/analytics).
• OneSpan Sign — risk-adaptive e-signature aligned to EU eIDAS guidance (signature type matched to risk/use case), plus "Smart Forms" to cut abandonment.

bypass 2 / concentration 1 / hyperscaler 2 = 5 → WEAK PROXY (consistent with published Identity/SSO 4–5 range). Rationale: transaction-signing + regulated e-signature retain partial bypass friction (2), but OneSpan is not a value-chain chokepoint (1 — no >10% customer, one of many vendors) and hyperscalers/competitors (Microsoft/Google/Apple passkeys, Okta/Entrust/Thales, DocuSign/Adobe) provide partial substitutes (2).

FIPS 140-2/3 + Common Criteria certification (~6–18 mo re-cert cycle) + banking-grade transaction signing — real but shrinking; passkeys/FIDO2 commoditize the login layer.

The binding constraint is whether Digital Agreements + acquired software can outgrow hardware-authentication volume decline on a cash base that just funded two bolt-ons. Build38 does not create a new scarce chokepoint: management said the deal would not materially affect FY2026 guidance, and the 10-Q says post-close operating results "are not material."

From 10-Q Note 6 (period ended 2026-06-30, filed 2026-08-04):

Derived:

• Goodwill / purchase price = $25.962M / $37.874M = 68.5%. Most of the price is synergy/workforce, not a separable scarce asset.
• Customer-relationship life = 1 year — the acquired book is not modeled as a durable contracted base. That is a direct disconfirm of "acquired switching-cost."
• Cost of moat vs defended revenue: $37.9M ÷ FY26 revenue midpoint $250M = 0.152× annual revenue. Combined with Nok Nok Labs (closed 2025-06-04, $19.2M consideration, 10-Q Note 6) → $57.1M / $250M = 0.228× FY26 revenue for two authentication-adjacent tuck-ins.
• Company IR (2026-03-02 close PR): acquisition "not expected to materially affect OneSpan's full-year 2026 guidance." 10-Q: "Build38 operating results since completion of the acquisition are not material."

A 0.15×-revenue bolt-on that is explicitly non-material cannot be the thing that repairs a −7% core segment.

10-Q MD&A (filed 2026-08-04):

• Q2 Cybersecurity −$3.3M / ~7% ($40.9M). FX +$0.5M on Q2 CS.
• H1 Cybersecurity −$2.5M / ~3%. FX +$3.1M on H1 CS.
• Decrease "primarily due to lower hardware revenue, partially offset by an increase in software revenue" (acquisitions + expansions, offset by lower multi-year term licenses and perpetual-maintenance transitions).

Derived FX-neutral:

• H1 CS declined $2.5M despite a $3.1M FX tailwind → FX-neutral H1 CS decline ≈ $5.6M.
• Q2 CS FX-neutral ≈ $40.9M − $0.5M = $40.4M vs implied prior-year $44.2M → ≈ −8.6% vs −7% reported.

The software/acquisition attach is not filling the hardware-volume hole on a constant-currency basis. Digital Agreements +$3.9M Q2 / +$5.7M H1 is real, but it is the e-signature follower book, not the authentication toll.

H1 cash-flow statement (10-Q):

Derived:

• Capital returned H1 (dividends + buybacks) = $18.131M = 65% of H1 OCF.
• M&A cash $34.554M exceeds H1 OCF $28.069M — the revolver draw of $5.0M is the plug.
• Cash $70.499M (12/31/25) → $43.337M (6/30/26). Remaining repurchase authorization $47.1M (10-Q) is larger than cash on hand.

This is a balance-sheet constraint on the pivot, not a fortress: the company is paying a dividend and buying back stock while funding a non-material bolt-on out of a shrinking cash pile.

Platform switching-cost model (FI authentication rail):

• Recertification of FIPS 140 / Common Criteria authenticators: 6–18 months (assumed industry cycle; not a OneSpan-disclosed figure).
• Parallel-run of hardware tokens + new vendor: 1 year of incumbent spend (inferred).
• Implied payback at a 20% fee cut on a mid-size FI book would still be multi-year if NRR showed pricing power.

Observed capture (measured, 8-K EX-99.1 / 10-Q):

• NRR 103% — 3 points of net expansion. A real identity toll-road (OKTA/JKHY class) prints 110–125% NRR. 103% is the empirical falsification of pricing-power lock-in.
• Contract liability (deferred revenue) $63.290M at 6/30/26 vs Q2 revenue $60.466M = 1.05× quarterly revenue (derived). Contrast: a sticky SaaS/security base often sits at 2–3×. OneSpan's prepaid lock-in is ~one quarter of revenue.
• Disclosed remaining performance obligations $100.043M (10-Q; excludes ≤1-year and as-invoiced practical expedients) vs ARR $189.7M = 0.53× ARR. Even the visible contracted tail is not a multi-year fortress.
• 60% of the world's 100 largest banks is an installed-base logo claim (10-Q business description), not revenue concentration — and no >10% customer is disclosed in this 10-Q.

Conclusion: recertification friction exists, but buyers are not paying up and not expanding. Switching cost without economic capture is a WEAK PROXY, not a DIRECT BOTTLENECK.

• product_service: Authentication, anti-fraud, identity verification, and e-signature/digital agreement security. [same 10-K, Business]
• technical function: MFA, transaction signing, risk analytics, identity proofing, e-signature workflows, and hardware OTP tokens. [same 10-K, Business]
• why it is hard: Bank-grade security certifications, deep financial-institution integrations, cryptography/patents, compliance, and switching costs. [same 10-K, Business/Risk Factors]
• substitutes: Okta, Ping, RSA, Entrust, Thales, DocuSign, Adobe, Microsoft Entra, in-house builds. [same 10-K, Competition]
• pricing power: MED — certified MFA/e-signature in regulated FIs, but hardware and e-signature face strong substitutes. [same 10-K, Competition/Risk Factors]

OneSpan sells hardware and software products that together provide identity security, transaction security, and digital agreements. The main product families are:

• OneSpan Sign — electronic signature and digital agreement automation.
• OneSpan Cloud Authentication — cloud-based multi-factor authentication and transaction signing.
• DIGIPASS authenticators — hardware and software one-time-password generators.
• Mobile Security Suite — mobile app security, app shielding, and mobile token functionality.
• Identity Verification — document verification and identity proofing.
• Risk Analytics — fraud and risk scoring for financial transactions.

Pricing power is asymmetric across the product portfolio.

• Stronger pricing power: high-assurance authentication and transaction signing for regulated banks, where switching vendors is expensive and risky.
• Weaker pricing power: basic e-signature, where DocuSign and Adobe have scale, brand, and enterprise integration advantages.

OneSpan cannot safely raise e-signature prices without losing share; it can likely sustain or raise prices in bank transaction-signing deployments because alternatives are costly to qualify and deploy.

• Exact target/purpose of the H1 2026 tuck-in (goodwill +$24M) — needs the named 8-K.
• Whether DigipassONE Verify (verifiable credentials) wins any named FI pilot in 2026 (primary source needed).
• Cash-flow statement detail for the $27.2M H1 cash decline (buyback vs dividend vs working capital split).

WEAKENED (on the authentication toll-road thesis). The original moat — certified hardware-token strong authentication — is eroding (−7% Cybersecurity, NRR 103%, passkey commoditization). The Digital Agreements (+25%) and DigipassONE digital-wallet pivot is the only growth vector, but it is a DocuSign-follower in e-signature and unproven in verifiable credentials — not a bottleneck. Profitable, cheap (2.25× EV/revenue), paying a dividend and buying back stock, so not INVALIDATED; but the "durable toll-road" premise does not hold.

WEAKENED.

WEAKENED (authentication-toll-road thesis). Naming Build38 closes the 08-29 open question and does not reverse the verdict: the acquired RASP module is a cheap, non-material adjacency (0.15× revenue, 68.5% goodwill, 1-year CR life) sitting on top of an FX-neutral core decline and 103% NRR. Digital Agreements +25% is the only growth engine and is a DocuSign-follower e-signature book, not an identity bottleneck. Profitable, guiding up, paying a dividend — not INVALIDATED — but the "durable identity toll-road" premise still fails the capture test.