OneSpan Inc. (OSPN)

Item 2 - Management’s Discussion and Analysis of Financial Condition and Results of Operations

Unless otherwise noted, references in this Quarterly Report on Form 10-Q to “OneSpan,” “Company,” “we,” “our,” and “us” refer to OneSpan Inc. and its subsidiaries.

This commentary should be read in conjunction with the condensed consolidated financial statements and related notes thereto of OneSpan for the three- and six-month periods ended June 30, 2026 and 2025 as well as our consolidated financial statements and related notes thereto and management’s discussion and analysis of financial condition and results of operations in our Annual Report on Form 10-K for the year ended December 31, 2025 (the “Form 10-K”).

Cautionary Note Regarding Forward-Looking Statements

This Quarterly Report on Form 10-Q contains forward-looking statements within the meaning of applicable U.S. securities laws, including statements regarding: our goal of driving profitable, efficient growth in both operating segments, with a particular emphasis on subscription revenue growth; expectations regarding the contributions of, and results from, our acquisitions of Build38 GmbH and Nok Nok Labs, Inc.; expectations about trends in our cost of goods sold, gross margin, and sales and marketing, research and development, and general and administrative expenses; the expected impact of foreign currency rate fluctuations; expectations regarding sources and uses of cash; and our general expectations regarding our operational or financial performance in the future. Forward-looking statements may be identified by words such as "seek", "believe", "plan", "estimate", "anticipate", “expect", "intend", "continue", "outlook", "may", "will", "should", "could", or "might", and other similar expressions. These forward-looking statements involve risks and uncertainties, as well as assumptions that, if they do not fully materialize or prove incorrect, could cause our results to differ materially from those expressed or implied by such forward-looking statements. Factors that could materially affect our business and financial results include, but are not limited to: difficulties increasing or maintaining our rate of revenue growth; our ability to attract new customers and retain and expand sales to existing customers; our ability to successfully develop and market new product offerings and product enhancements; changes in customer requirements; the potential effects of technological changes; the loss of one or more large customers; difficulties enhancing and maintaining our brand recognition; competition; lengthy sales cycles; challenges retaining key employees and successfully hiring and training qualified new employees; security breaches or cyber-attacks; real or perceived malfunctions or errors in our products; interruptions or delays in the performance of our products and solutions; reliance on third parties for certain products and data center services; our ability to effectively manage third party partnerships, acquisitions, divestitures, alliances, or joint ventures; economic recession, inflation, tariffs or trade disputes, and political instability; claims that we have infringed the intellectual property rights of others; changing laws, government regulations or policies; pressures on price levels; component shortages; delays and disruption in global transportation and supply chains; impairment of goodwill or amortizable intangible assets causing a significant charge to earnings; actions of activist stockholders; and exposure to increased economic and operational uncertainties from operating a global business, as well as other factors described in the “Risk Factors” section of our most recent Annual Report on Form 10-K (filed with the SEC on February 26, 2026). Our filings with the Securities and Exchange Commission and other important information can be found in the Investor Relations section of our website at investors.onespan.com. We do not have any intent, and disclaim any obligation, to update the forward-looking information to reflect events that occur, circumstances that exist or changes in our expectations after the date of this Form 10-Q, except as required by law.

Our website address is included in this Quarterly Report on Form 10-Q as an inactive textual reference only.

Overview

OneSpan helps organizations build secure, seamless, and trusted digital experiences through two solution portfolios: Cybersecurity and Digital Agreements. Our cybersecurity solutions protect identities, secure mobile apps, and safeguard access through advanced high-assurance authentication, threat intelligence, fraud prevention, and robust mobile app protection, defending users, devices, and applications against sophisticated attacks. Our digital agreement solutions streamline agreement workflows with secure e-signatures, identity verification, and smart digital forms, built to enable speed, compliance and exceptional customer experiences. Trusted by leading global enterprises, including more than 60% of the world’s 100 largest banks, OneSpan processes over 100 million digital agreements and billions of secure authentication transactions across more than 120 countries each year.

We offer our products primarily through a subscription licensing model and provide multiple deployment options, including cloud-based and on-premises solutions. Our solutions are sold worldwide through our direct sales force, as well as through distributors, resellers, systems integrators, and original equipment manufacturers.

26

Table of Contents

We report our financial results under the following two business units, which are our reportable operating segments: Cybersecurity and Digital Agreements.

•Cybersecurity. Cybersecurity, formerly Security Solutions, consists of our broad portfolio of software products, software development kits ("SDKs") and Digipass authenticator devices that are used to build applications designed to defend against attacks on digital transactions across online environments, devices, and applications. The software products and SDKs included in the Cybersecurity segment are delivered through on-premises and cloud-based deployment models and include standards-based authentication technologies such as Fast Identity Online ("FIDO") authentication and passkeys, multi-factor authentication, transaction signing solutions and mobile application security.

•Digital Agreements. Digital Agreements consists of solutions that enable our clients to secure and automate business processes associated with their digital agreement and customer transaction lifecycles that require consent, non-repudiation and compliance. These solutions, which are cloud-based, include OneSpan Sign e-signature, OneSpan Notary, and Identity Verification.

We seek to drive profitable, efficient growth in both operating segments, with a particular emphasis on subscription revenue growth. Both operating segments were profitable for the three and six months ended June 30, 2026, and Cybersecurity and Digital Agreements subscription revenue grew 2% and 25%, respectively, as compared to the three months ended June 30, 2025, respectively, and 5% and 18% as compared to the six months ended June 30, 2025, respectively.

Overview of Key Factors Impacting our Results of Operations

As discussed in greater detail below in "Results of Operations", the following factors had a significant impact on our financial results for the three and six months ended June 30, 2026 as compared to the three and six months ended June 30, 2025.

Foreign exchange rate impact for the six months ended June 30, 2026. Changes in foreign exchange rates, in particular the weakening of the U.S. Dollar relative to the Euro, favorably impacted both total revenue and Cybersecurity revenue by approximately $3.3 million and $3.0 million, respectively, for the six months ended June 30, 2026 as compared to the same period in 2025. The impact of changes in foreign exchange rates on the Digital Agreements segment for this period was approximately $0.3 million as compared to the same period in 2025.

Recent acquisitions. In June 2025, we acquired Nok Nok Labs, Inc. ("Nok Nok Labs"), a leading provider of passwordless software authentication solutions, and in February 2026, we acquired Build38 GmbH ("Build38"), a leader in next-generation mobile application protection solutions. See Note 6, Business Acquisitions, for additional information about these two transactions.

Components of Operating Results

Revenue

We generate revenue from the sale of our subscriptions, perpetual maintenance and services, and Digipass hardware products. We believe comparison of revenues between periods is heavily influenced by the timing of orders and shipments, reflecting the transactional nature of significant parts of our business.

•Product and license revenue. Product and license revenue includes Digipass hardware products and software licenses, which are provided on a perpetual or term basis subscription model.

•Service and other revenue. Service and other revenue includes solutions that are provided on a cloud-based subscription model, term and perpetual maintenance and support, and services.

Cost of Goods Sold

Our total cost of goods sold consists of cost of product and license revenue and cost of service and other revenue. We expect our cost of goods sold to increase in absolute dollars as our business grows, although it may fluctuate as a percentage of total revenue from period to period.

27

Table of Contents

•Cost of product and license revenue. Cost of product and license revenue primarily consists of direct product and license costs, including personnel costs, production costs, freight, and inventory write-off adjustments for discontinued products and services.

•Cost of service and other revenue. Cost of service and other revenue primarily consists of costs related to cloud subscription solutions, including personnel and equipment costs, depreciation, amortization, and personnel costs of employees providing professional services and maintenance and support.

Gross Profit

Gross profit is revenue net of the cost of goods sold. Gross profit as a percentage of total revenue, or gross margin, has been and will continue to be affected by a variety of factors, including our average selling price, manufacturing costs, the mix of products sold, and the mix of revenue among products, subscriptions and services. We expect our gross margins to fluctuate over time depending on these factors.

Operating Expenses

Our operating expenses are generally based on anticipated revenue levels and fixed over short periods of time. As a result, small variations in revenue may cause significant variations in the period-to-period comparisons of operating income or operating income as a percentage of revenue.

Generally, the most significant factor driving our operating expenses is headcount. Direct compensation and benefit plan expenses generally represent between 50% and 60% of our operating expenses. In addition, a number of other expense categories are directly related to headcount. We attempt to manage our headcount within the context of the economic environments in which we operate and the investments we believe we need to make for our infrastructure to support future growth and for our products to remain competitive.

Historically, operating expenses have been impacted by changes in foreign exchange rates. We estimate the change in currency rates during the three months ended June 30, 2026 compared to the comparable prior year period resulted in an increase in operating expenses of $1.2 million.

The comparison of operating expenses can also be impacted significantly by costs related to our stock-based and long-term incentive plans. Long-term incentive plan compensation expense includes both stock-based incentives and an immaterial amount of cash-based incentives. During the three months ended June 30, 2026 and 2025, operating expen

[Excerpt truncated for page length; source filing is linked above.]

Item 7 - Management’s Discussion and Analysis of Financial Condition and Results of Operations (in thousands, except head count, ratios, time periods and percentages)

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our financial statements and related notes appearing elsewhere in this Annual Report on Form 10-K. In addition to historical financial information, the following discussion may contain predictions, estimates and other forward-looking statements that involve a number of risks and uncertainties, including those discussed under Item 1A, Risk Factors and elsewhere in this Form 10-K. These risks could cause our actual results to differ materially from any future performance suggested below. Please see “Cautionary Note Regarding Forward Looking Statements” at the beginning of this Form 10-K.

For a comparison of our results of operations for the fiscal years ended December 31, 2024 and 2023, see “Part II, Item 7, Management’s Discussion and Analysis of Financial Condition and Results of Operations” of our Annual Report on Form 10-K for the year ended December 31, 2023, filed on March 6, 2024.

37

Overview

OneSpan helps organizations build secure, seamless, and trusted digital experiences through two solution portfolios: Cybersecurity and Digital Agreements. Our cybersecurity solutions protect identities, secure mobile apps, and safeguard access through advanced high-assurance authentication, threat intelligence, fraud prevention, and mobile app protection, defending users, devices, and applications against sophisticated attacks. Our digital agreement solutions streamline agreement workflows with secure e-signatures, identity verification, and smart digital forms, built to enable speed, compliance and exceptional customer experiences. Trusted by leading global enterprises, including more than 60% of the world’s 100 largest banks, OneSpan processes over a hundred million digital agreements and billions of secure authentication transactions across more than 120 countries each year.

We offer our products primarily through a subscription licensing model and provide multiple deployment options, including cloud-based and on-premises solutions. Our solutions are sold worldwide through our direct sales force, as well as through distributors, resellers, systems integrators, and original equipment manufacturers.

We report our financial results under the following two business divisions, which are our reportable operating segments: Cybersecurity and Digital Agreements.

•Cybersecurity. Cybersecurity, formerly Security Solutions, consists of our broad portfolio of software products, software development kits ("SDKs") and Digipass authenticator devices that are used to build applications designed to defend against attacks on digital transactions across online environments, devices, and applications. The software products and SDKs included in the Cybersecurity segment are delivered through on-premises and cloud-based deployment models and include standards-based authentication technologies such as Fast Identity Online ("FIDO") authentication and passkeys, multi-factor authentication, transaction signing solutions and mobile application security.

•Digital Agreements. Digital Agreements consists of solutions that enable our clients to secure and automate business processes associated with their digital agreement and customer transaction lifecycles that require consent, non-repudiation and compliance. These solutions, which are cloud-based, include OneSpan Sign e-signature, OneSpan Notary, and OneSpan Identity Verification.

Beginning in mid-2023 and through the third quarter of 2024, our focus was on adjusting our cost structure to enable both business divisions to operate profitably. These cost optimization efforts were a major factor in the overall business returning to operating profitability in the fourth quarter of 2023. The subsequent increase in profitability, combined with high levels of cash generation, enabled us to return approximately $31.6 million to shareholders in 2025 in the form of quarterly dividends and share repurchases. Beginning in the fourth quarter of 2024 and continuing through 2025, we continued to operate profitably while taking a number of important steps to generate future revenue growth:

•In December 2024, we hired a new Chief Technology Officer, Ashish Jain, to lead our research and development efforts.

•In June 2025, we acquired Nok Nok Labs, a provider of passwordless software authentication solutions, which brought S3, a leading FIDO software product, to our product portfolio. This acquisition provides OneSpan's customers with a wider range of flexible, adaptable authentication options. See Note 6, Business Acquisitions, for additional information.

•In June 2025, we entered into the Credit Agreement with MUFG and other lenders party thereto. The Credit Agreement provides for a $100.0 million revolving credit facility with a $10.0 million letter of credit sublimit and a $10.0 million swingline loan sublimit. The proceeds of borrowings under the Credit Agreement may be used for general corporate purposes. We may borrow, repay and reborrow funds under the revolving credit facility until its maturity on June 23, 2030. See Note 12, Debt, for additional information.

•In October 2025, we announced a strategic investment in, and partnership with, ThreatFabric Holding B.V., a Dutch company that provides mobile threat intelligence, malware risk detection, and behavioral analytics, to further enhance the value we offer by providing fraud detection solutions to our customers. See Note 2, Summary of Significant Accounting Policies, for additional information.

•In December 2025, we hired a new Chief Revenue Officer, Shaun Bierweiler, to lead our go-to-market efforts, and to drive growth and customer success.

38

•Later in December 2025, we entered into a definitive agreement to acquire Build38, a leader in next-generation mobile application protection solutions, to extend our investment in advanced mobile security technologies. See Note 6, Business Acquisitions, for additional information.

Our efforts to broaden and strengthen our product offerings are driven in part by a secular shift away from physical authentication devices such as our Digipass tokens. Because consumers increasingly interact with their banks through their mobile devices rather than desktop computers, they are more likely to prefer authentication methods that enable secure, convenient access to mobile banking apps without the need for a physical device. In response to this trend, our bank and financial institution customers have increasingly adopted a “mobile first” approach to consumer authentication that prioritizes the mobile user experience over traditional desktop experiences. This approach has resulted in a reduction of Digipass hardware authenticator sales and an increase in sales of software authentication licenses delivered through software applications on mobile devices. Due largely to the mobile first trend, our revenue from Digipass devices declined from 78% of our revenue in 2015 to 20% of our revenue in 2025. Although we plan to continue to invest in our Digipass authenticators, including our newer FIDO2 Digipass devices, as an important component of our broad authentication solution portfolio, we are focused on driving revenue growth in higher–margin software solutions, both through further expansion of our Cybersecurity software solutions and through continued growth in our Digital Agreements division.

Restructuring Plan

In 2021 and 2022, our board of directors approved cost reduction actions designed to advance our operating model, streamline our business, improve efficiency, and enhance our capital resources.

In August 3, 2023, our board of directors approved further cost reduction actions (the "2023 Actions"). In connection with the 2023 Actions, we have incurred restructuring charges, most of which relate to employee transition and severance payments and employee benefits, with a significantly smaller amount of charges relating to vendor contract termination and rationalization actions. We terminated our restructuring plan as of December 31, 2025, as we substantially completed all of the workforce reductions and vendor contract termination and rationalization actions planned as part of the 2023 Actions from 2023 through 2025.

As part of the restructuring plan (including the 2023 Actions), we reduced headcount by eliminating approximately 345 positions. We incurred severance and related benefits costs, recorded in “Restructuring and other related charges” in the consolidated statements of operations for the years ended December 31, 2025, 2024 and 2023.

Recent Developments

On February 26, 2026, our board of directors declared a quarterly cash dividend as part of our recurring quarterly dividend program announced in December 2024. A cash dividend of $0.13 per share, which represents a year-over-year increase of 8.3%, will be paid on March 27, 2026 to shareholders of record as of the close of business on March 13, 2026. The declaration and payment of future dividends is subject to the sole discretion of the board.

Components of Operating Results

Revenue

We generate revenue from the sale of our subscriptions, maintenance and support, professional services, and Digipass hardware products. We believe comparison of revenues between periods is heavily influenced by the timing of orders and shipments reflecting the transactional nature of significant parts of our business.

•Product and license revenue. Product and license revenue includes Digipass hardware products and software licenses, which are provided on a perpetual or term basis subscription model.

•Service and other revenue. Service and other revenue includes solutions that are provided on a cloud-based subscription model, maintenance and support, and professional services.

Cost of Goods Sold

Our total cost of goods sold consists of cost of product and license revenue and cost of service and other revenue. We expect our cost of goods sold to increase in absolute dollars as our business grows, although it may fluctuate as a percentage of total revenue from period to period.

39

•Cost of product and license revenue. Cost of product and license revenue primarily consists of direct product and license costs, including personnel costs, production costs, freight, and inventory write-off adjustments for discontinued products and services.

•Cost of service and other revenue. Cost of service and other revenue primarily consists of costs related to cloud subscription solutions, including personnel and equipment costs, depreciation, amortization, and personnel costs of employees providing professional services and maintenance and support.

Gross Profit

Gross profit is revenue net of the cost of goods sold. Gross profit as a percentage of total revenue, or gross margin, has been and will continue to be affected by a variety of factors, including our average selling price, manufacturing costs, the mix of products sold, and the mix of revenue among products, subscriptions and services. We expect our gross margins to fluctuate over time depending on these factors.

Operating Expenses

Our operating expenses are generally based on anticipated revenue levels and fixed over short periods of time. As a result, small variations in revenue may cause significant variations in the period-to-period comparisons of operating income or operating income as a percentage of revenue.

Generally, the most significant factor driving our operating expenses is headcount. Direct compensation and benefit plan expenses generally represent between 50% and 60% of our operating expenses. In addition, a number of other expense categories are directly related to headcount. We attempt to manage our headcount within the context of the economic environments in which

[Excerpt truncated for page length; the complete text is on the linked full-MD&A page.]