OneSpan (OSPN) Risk Analysis

Technological changes occur rapidly in our industry and development of new products and features is critical to maintain and grow our revenue. Our ability to attract and retain customers will depend in part upon our ability to enhance our current products and develop innovative new solutions to distinguish us from the competition and to meet customers' changing needs. For instance, we believe that our bank and financial institution customers, who account for a majority of our revenue, may increasingly move away from multi-factor authentication methods and toward passkeys that use the FIDO2 passwordless authentication standard. If we are unable to provide our customers with high quality and innovative passkey solutions, or if we otherwise do not anticipate or adapt to changing technology, industry standards or customer requirements on a timely basis, our competitive position and financial results will be negatively impacted. Product developments and technology innovations by others may adversely affect our competitive position. The introduction by our competitors of products embodying new technologies or the emergence of new industry standards could render our existing products obsolete and unmarketable. For example, if our competitors are able to more quickly and effectively integrate technologies such as generative artificial intelligence into their products, our competitive position may suffer. In addition, AI may reduce barriers to entry in our markets by allowing new entrants to rapidly and cost-effectively create competitive and potentially disruptive software solutions. We spend substantial amounts of time and money to research and develop new offerings and enhanced versions of our existing offerings in order to meet our customers' rapidly evolving needs. When we develop a new offering or an enhanced version of an existing offering, we typically incur expenses and expend resources upfront to market, promote and sell the new offering. Therefore, when we develop or acquire new or enhanced offerings, their introduction must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing them to market. In the past, we have determined that certain product initiatives we initially believed were promising did not warrant further investment, and incurred non-cash impairment charges as a result. If future new product initiatives do not garner widespread customer adoption and implementation, we may incur future non-cash charges and our business may be adversely affected.

Our corporate infrastructure stores and processes our sensitive, proprietary and other confidential information (including information related to finance, technology, employees, marketing, sales, etc.) which is used daily in our operations. In addition, our solutions involve the transmission and processing of our customers' confidential, proprietary, personal and sensitive information. We have legal and contractual obligations to protect the confidentiality and appropriate use of customer data. Because we are a digital agreements and cybersecurity company, and because the majority of our customers are banks and other financial institutions, which are frequent targets of cyberattacks, we may be an attractive target for cyber attackers or other data thieves. High-profile cyberattacks and security breaches have increased in recent years, with the potential for such acts heightened because of the widespread adoption of remote working and the increase in sophisticated cyberattack methods, including the use of artificial intelligence to launch automated, accelerated and enhanced cyberattacks. Because techniques used to obtain unauthorized access or to sabotage systems are constantly evolving, change frequently and often are not recognized until launched against a specific target, we may be unable to anticipate these techniques or to implement adequate preventative measures. As we seek to increase our client base and expand awareness of our brand, we may become a greater target for third parties seeking to compromise our security systems and we anticipate that hacking attempts and cyberattacks will increase in the future. Artificial intelligence technologies introduce evolving industry-wide risks, including model manipulation, data poisoning, deceptive AI-generated content, and rapidly expanding regulatory requirements. For OneSpan, the use of AI within security operations and product-related processes may create vulnerabilities if systems are improperly designed, supervised, or governed, potentially resulting in unauthorized access, incorrect automated actions, exposure of confidential information, or operational failures. Despite policies governing AI usage, lifecycle risk management, and oversight, failures in design, monitoring, or compliance-as well as errors or misuse of AI-enabled capabilities-could impair our security posture, reduce threat-detection effectiveness, harm customer trust, or expose OneSpan to legal, regulatory, and reputational consequences. We have experienced several security incidents in the past, none of which have been material to date. However, it is possible that we may experience a material event in the future. While we have established teams, processes and strategies to protect our assets, we may not always succeed in preventing or repelling unauthorized access to our systems. We also may face delays in detecting or otherwise responding to cybersecurity incidents or other breaches. Additionally, we use third-party service providers for certain services involving data storage or transmission, such as SaaS, cloud computing, and internet infrastructure and bandwidth. These providers face various cybersecurity threats and may experience cybersecurity incidents or other security breaches. For example, the recent Salesloft, Inc. Drift data breach impacted hundreds of Salesforce.com customers worldwide. Although OneSpan was among the affected customers, the incident did not compromise our products and had minimal impact on our business, but it is possible that future third-party incidents may be more harmful to us. Despite our security measures, our IT systems and infrastructure may be vulnerable to attacks. Threats to IT security can take a variety of forms. Individuals and groups of malicious actors and sophisticated organizations, including state-sponsored organizations or nation-states, continuously attempt to compromise systems using tactics, techniques, and procedures such as phishing attacks, malicious software, exploiting hardware or software vulnerabilities, social engineering, and coordinated attacks like distributed denial of service or other coordinated attacks. If account security controls are not effectively implemented or maintained, unauthorized access to confidential or sensitive information could occur. Security incidents may have a number of negative consequences to us, including the following: requiring us to expend significant capital and other resources to alleviate the incidents and to improve our security technologies; impairing our ability to provide services to our customers and protect the privacy of their data delaying product development efforts; compromising confidential or technical business information or personal data; harming our reputation or competitive position; resulting in theft or misuse of our intellectual property or other assets; and exposing us to substantial litigation expenses and damages, indemnity and other contractual obligations, government fines and penalties, mitigation expenses, costs for remediation and incentives offered to affected parties, including customers, other business partners and employees, in an effort to maintain business relationships after an incident. We continually invest in strengthening our information technology systems and implementing robust security measures to protect critical and sensitive assets. Our cybersecurity program includes regular security awareness training for employees and key contractors, emphasizing best practices and emerging threats. These efforts are designed to reduce the likelihood of an attack and ensure preparedness to respond effectively to any security breach. Despite these measures, we may not be able to anticipate or prevent all attacks. In the event of an actual or perceived security breach, confidence in our security practices and products could be diminished, resulting in loss of customers and sales, impairment of our operations, significant liabilities, reputational harm, and a negative impact on our business and financial condition.

From time to time, we are involved as a party or an indemnitor in disputes or regulatory inquiries. These may include alleged claims, lawsuits and proceedings regarding intellectual property disputes, labor and employment issues, commercial disagreements, securities law violations and other matters. In particular, companies in the software industry are often required to defend against litigation or claims based on allegations of infringement or other violations of intellectual property rights. In certain instances, we have received claims that we have infringed the intellectual property rights of others, including claims regarding patents, copyrights, and trademarks. Because of constant technological change in the markets in which we compete, the extensive patent coverage of existing technologies, and the rapid rate of issuance of new patents, it is possible that the number of these claims may grow. Such claims sometimes involve patent holding companies or other adverse patent owners that have no relevant product revenue and against which our own patents may therefore provide little or no deterrence. In addition, former employers of our former, current, or future employees may assert claims that such employees have improperly disclosed to us the confidential or proprietary information of these former employers. If we are not successful in defending such claims, we could be required to stop selling our products, delay shipments, redesign our products, pay monetary amounts as damages, enter into royalty or licensing arrangements (which may not be available to us on commercially reasonable terms), or satisfy indemnification obligations to our customers, any of which could have a material adverse effect on our business. Regardless of the merits or ultimate outcome of any claims that have been or may be brought against us or that we may bring against others, lawsuits are time-consuming and expensive to resolve, divert management's time and attention, and could harm our reputation. Although we carry general liability and other forms of insurance, our insurance may not cover potential claims that arise or may not be adequate to indemnify us for all liability that may be imposed. We may also determine that the most cost-effective way to resolve a dispute is to enter into a settlement agreement. Litigation is inherently unpredictable and we cannot predict the timing, nature, controversy or outcome of lawsuits, and it is possible that litigation could have an adverse effect on our business, operating results or financial condition.

We are subject to U.S. federal, state, local and sales taxes in the United States and foreign income taxes, withholding taxes and transaction taxes in numerous foreign jurisdictions. Significant judgment is required in evaluating our tax positions and our worldwide provision for taxes. During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination is uncertain and the relevant taxing authorities may disagree with our determinations as to the income and expenses attributable to specific jurisdictions. In addition, our tax obligations and effective tax rates could be adversely affected by changes in the relevant tax, accounting and other laws, regulations, principles and interpretations by recognizing tax losses or lower than anticipated earnings in jurisdictions where we have lower statutory rates and higher than anticipated earnings in jurisdictions where we have higher statutory rates, by changes to our operating structure (including a currently in-process revenue of our intellectual property structure), by changes in foreign currency exchange rates, or by changes in the valuation of our deferred tax assets and liabilities. We may be audited in various jurisdictions, and such jurisdictions may assess additional taxes, sales taxes and value-added taxes against us. Although we believe our tax estimates are reasonable, the final determination of any tax audits or litigation could be materially different from our historical tax provisions and accruals, which could have a material adverse effect on our operating results or cash flows in the period for which a determination is made. At December 31, 2025 we had U.S. federal, U.S. state, foreign, and Canadian provincial net operating losses ("NOLs") of $6.6 million, $52.3 million, $32.6 million, and $23.2 million, respectively, available to offset future taxable income, some of which begin to expire in 2032. A lack of future taxable income would adversely affect our ability to utilize these NOLs before they expire. Also, certain NOLs have limitations on the amount that can be utilized each year. In addition, under the provisions of the Internal Revenue Code of 1986, as amended (the "Internal Revenue Code"), substantial changes in our ownership may limit the amount of pre-change NOLs and other tax attributes that can be utilized annually in the future to offset taxable income. Section 382 of the Internal Revenue Code imposes limitations on a company's ability to use its NOLs if one or more stockholders or groups of stockholders that own at least 5% of the company's stock increase their ownership by more than 50 percentage points over their lowest ownership percentage within a rolling three-year period. Similar rules may apply under state tax laws. Based upon an analysis as of December 31, 2024, we determined that we do not expect these limitations to materially impair our ability to use our NOLs prior to expiration. However, if changes in our ownership occurred after such date, or occur in the future, our ability to use our NOLs may be further limited. Subsequent statutory or regulatory changes in respect of the utilization of NOLs for federal or state purposes, such as suspensions on the use of NOLs or limitations on the deductibility of NOLs carried forward, or other unforeseen reasons, may result in our existing NOLs expiring or otherwise being unavailable to offset future income tax liabilities. For these reasons, we may not be able to utilize a material portion of the NOLs, even if we achieve profitability.

Our business is subject to a rapidly expanding and increasingly complex set of international, federal, state, and local laws and regulations governing the collection, use, access, sharing, transfer, portability, interoperability, and other processing and use of data worldwide. Globally, virtually every jurisdiction in which we operate has established its own data security, privacy, and broader data governance frameworks with which we must comply, including regimes that regulate data access and sharing rights, data portability and interoperability, restrictions on use and commercialization, and obligations imposed on cloud and other data processing services. We collect, transmit, store, and otherwise process (on our systems and on our third-party partners' systems) our customers', their end users, and our employees' data that includes personal data subject to these international and domestic privacy, data protection, and data governance laws and regulations. Failure to comply, or a perceived failure to comply, with these requirements could subject us to enhanced regulatory and customer monitoring, audits, and related expenses, restrict our ability to deliver or enhance our services, limit our ability to use data, expose us to regulatory enforcement actions, litigation and fines, and harm our reputation and customer relationships. For example, in the European Economic Area ("EEA"), we are subject to Regulation (EU) 2016/679 (the General Data Protection Regulation or "GDPR") and related national implementing laws. The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to lawful basis for processing, transparency, data subject rights, security safeguards, breach notification, accountability, and the oversight of third-party processors. Certain categories of data, including biometric and other sensitive data are subject to heightened requirements. In addition, the GDPR permits data protection authorities to impose corrective measures and/or administrative fines of up to the greater of 20 million Euros or four percent of global annual revenues, and allows data subjects to seek judicial remedies and compensation. Moreover, the EU Data Act (Regulation (EU) 2023/2854) establishes new rules governing access to, sharing of, and switching of data generated by connected products and related services, including mandatory data access rights for users and restrictions on contractual and technical barriers to data portability. The Data Act may require us to modify product design, data architectures, commercial terms, and cloud or data processing arrangements, and could limit our ability to monetize or control certain data assets. Although we have implemented policies, technical measures, and contractual safeguards designed to support compliance, the interpretation and enforcement of GDPR and the EU Data Act obligations continue to evolve and may differ across EEA member states. As a result, there can be no assurance that our compliance measures will not be challenged by regulators, courts, or other parties, which could result in investigations, fines, restrictions on processing or data sharing activities, or civil claims. Our operations also depend on the ability of companies to transfer personal data across borders, including from the EEA to the United States and other jurisdictions. While the European Commission has adopted an adequacy decision for the EU-U.S. Data Privacy Framework, the long-term availability and scope of this and other transfer mechanisms remain subject to legal, regulatory, and political uncertainty. We rely on multiple transfer tools, including standard contractual clauses and supplementary measures, to support international data flows. If existing transfer mechanisms are invalidated, restricted, or require additional safeguards, we may be required to restructure data flows, localize certain processing activities, or implement new technical and contractual controls. These changes could increase operational complexity and costs, delay service delivery, limit product functionality, and expose us to regulatory scrutiny during transition periods. Beyond the GDPR, there are privacy, data security, and data governance laws in a growing number of countries around the world. For example, other jurisdictions such as Brazil, Canada, and the United Kingdom have enacted privacy and data protection laws and regulations that impose similar restrictions and obligations on products and services we sell and that otherwise may impact our ability to conduct our business activities. In the United States, we are subject to a fragmented and expanding regulatory landscape at both the federal and state levels. Federal data privacy and security enforcement continues to evolve, and although the current federal regulatory environment is expected to shift toward more traditional and narrower enforcement priorities, our company remains exposed to potential actions by federal agencies such as the FTC under existing privacy laws, especially in the area of processing biometrics and other sensitive data. At the state level, comprehensive privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act of 2020, and other similar statutes adopted by more than a dozen other states, impose varying obligations and grant enhanced enforcement powers, and in some cases, private rights of action. In addition, certain state laws regulate specific categories of information, such as biometric or health-related information. This patchwork of requirements increases compliance costs, audit and reporting obligations, litigation, fine and penalty exposure, and the risk that we may be subject to inconsistent or conflicting legal standards. Several jurisdictions impose particularly stringent requirements on the processing of biometric data. Laws such as the Illinois Biometric Information Privacy Act, Québec's Act respecting the protection of personal data in the private sector, and other similar laws regulate the collection, use, safeguarding, storage, governance, transparency and disclosure of biometric identifiers and information. Many of these laws also require informed consent, and provide for statutory damages and private rights of action. Because some of our SaaS solutions support identity verification, authentication, fraud prevention, and similar use cases that may involve biometric identifiers processed on behalf of customers, we may face heightened regulatory scrutiny and litigation risk. A substantial portion of our activities as a SaaS solution provider involves processing personal data on behalf of our customers in our capacity as a data processor. As a data processor acting on behalf of our customers, we collect, transmit, store, and process a wide range of data, including personal data and biometric information from individuals worldwide. This data is handled both on our systems and those of our third-party partners, increasing the complexity of compliance and the potential impact of any failure or perceived failure by us or our third-party partners to meet applicable legal, contractual, or security standards. Adapting to these requirements may entail significant operational changes, including revising data processing and storage practices, enhancing data security measures, implementing data access and sharing controls, enabling data portability and interoperability features, ensuring transparent communication with data subjects about their rights and our data handling practices, and it may impact our business activities, including our relationships with business partners and the marketing and distribution of our products. Additionally, our products may increasingly incorporate advanced analytics, automation, and AI-enabled features. The regulatory landscape governing the use of automated decision-making, AI systems, and data-driven technologies is evolving rapidly, with increasing convergence between privacy, data protection, consumer protection, and AI-specific regulatory regimes. New or emerging requirements may restrict how we design, deploy, or market certain features, require additional transparency or governance measures, or increase the risk of regulatory enforcement and legal claims related to data use, transparency and accountability. We work to comply with all applicable international and domestic privacy, data protection, and data governance laws and regulations; however, these laws and regulations vary greatly from jurisdiction to jurisdiction, change rapidly, and are subject to interpretation, all of which leads to uncertainty in their applicability. Compliance may increase costs and require that we modify existing products, delay or limit the rollout of new features, increase investment in technical and organizational safeguards, renegotiate contractual arrangements with customers or partners, and dedicate significant legal, compliance, and engineering resources. Any actual, alleged or perceived failure to comply with applicable data-related laws and regulations, our processes and policies, contractual provisions, or an actual or suspected data privacy or information security incident could result in serious consequences for us. These consequences may include enforcement actions, audits, investigations, prosecutions, fines, penalties, debarment, litigation, contractual liability, loss of customer trust, reputational harm, and overall material adverse effects on our business, results of operations, and financial condition.

The markets for cybersecurity and digital agreements solutions are very competitive and, like most technology-driven markets, are subject to rapid change and constantly evolving solutions and services. Competition in these markets may intensify further as advances in AI enable rapid, low-cost development of software applications. The authentication products in our Cybersecurity division are designed to allow authorized users access to digital business processes, in some cases using patented technology. Our main competitors in our authentication market are Gemalto, a subsidiary of Thales Group, Yubico and RSA Security. There are also many other companies in adjacent areas, such as MDM, threat protection, and IAM, that offer competing services. In addition to these companies, we face competition from many small authentication solution providers, many of whom offer new technologies and niche solutions such as biometric or risk and behavioral analysis. We believe that competition in this market may to intensify as a result of increasing demand for security products. Our primary competitors for electronic signature solutions in our Digital Agreements division are DocuSign and Adobe Systems. Both companies are significantly larger than us. In addition to these companies, there are numerous smaller and regional or niche providers of electronic signing solutions. Some of our present and potential competitors have significantly greater brand awareness and financial, technical, marketing, purchasing, and other resources than we do. As a result, they may be able to respond more quickly to new or emerging technologies and changes in customer requirements, devote greater resources to the development, promotion and sale of products, or deliver competitive products at a lower end-user price than we do. These factors have made it more difficult for us to compete successfully and may continue to do so, which could negatively affect our business.

We derive a substantial portion of our revenue from a limited number of customers. The loss of substantial sales to any one of them could adversely affect our operations and results. In 2025, 2024, and 2023, our top 10 largest customers contributed 18%, 20%, and 22%, respectively, of our total worldwide revenue.

We believe that enhancing our brand recognition is important to our efforts to attract new customers and channel partners, and that our relative lack of brand awareness has made it more challenging to acquire new customers. Our brand recognition and reputation are dependent upon numerous factors, including: - our marketing efforts;- our ability to continue to offer high quality, innovative and reliable products;- our ability to maintain customer satisfaction with our products;- our ability to be responsive to customer concerns and provide high quality customer support, training and professional services;- any misuse or perceived misuse of our products;- positive or negative publicity, including through reviews by industry analysts;- our ability to prevent or quickly react to any cyberattack on our information technology systems or security breach of or related to our software; and - litigation or regulatory-related developments. Improving our brand recognition is likely to require significant additional expenditures and may not be successful or yield increased revenues. If we do not successfully enhance our brand and maintain our reputation, we may continue to have difficulties attracting new customers, including due to reduced pricing power relative to competitors with stronger brands, and we could lose customers or renewals, which would adversely affect our business.

Negative economic conditions, including conditions resulting from changes in foreign currency rates, changes in interest rates, gross domestic product growth, financial and credit market fluctuations, inflation, political turmoil, geopolitical tensions, tariffs, international trade disputes, natural catastrophes, regional and global conflicts, natural disasters, and terrorist attacks, could cause a decrease in business investments, including spending on information technology, and negatively affect the performance of our business. If global or regional economic and financial market conditions remain uncertain and/or weak for an extended period of time, any of the following factors, among others, could have a material adverse effect on our financial condition and results of operations: - slower consumer or business spending may result in reduced demand for our products and services, reduced orders from customers, order cancellations, lower revenues, increased inventories, and lower gross margins;- volatility in global markets, tariffs or international trade disputes, and fluctuations in exchange rates for foreign currencies could negatively impact our reported financial results and condition;- restructurings, reorganizations, consolidations and other corporate events could affect our customers' budgets and buying cycles, particularly in the banking and financial services industry, where we have particular exposure due to the majority of our customers being banks and financial institutions;- if our customers experience declining revenues, or experience difficulty obtaining financing in the capital and credit markets to purchase our products and services, this could result in reduced orders, longer sales cycles, order cancellations, inability of customers to timely meet their payment obligations to us, extended payment terms, higher accounts receivable, reduced cash flows, greater expense associated with collection efforts and increased bad debt expense;- severe financial difficulty experienced by our customers (such as the mid-market bank failures that occurred in 2023) may cause them to become insolvent or cease business operations, which could reduce sales, cash collections and revenue streams;- volatility in the prices for materials and components we use in our Digipass products could have a material adverse effect on our costs, gross margins, and profitability; and - any difficulty or inability on the part of manufacturers of our products or other participants in our supply chain in obtaining sufficient financing to purchase raw materials or to finance general working capital needs may result in delays or non-delivery of shipments of our products. Furthermore, in an adverse economic environment there is a risk that customers may delay their orders until the economic conditions improve. If a significant number of orders are delayed for an indefinite period of time, our revenue and cash receipts may not be sufficient to meet the operating needs of the business. If this is the case, we may need to significantly reduce our workforce, sell certain of our assets, enter into strategic relationships or business combinations, discontinue some or all of our operations, or take other similar restructuring actions. While we expect that these actions would result in a reduction of recurring costs, they also may result in a reduction of recurring revenue and cash receipts. It is also likely that we would incur substantial non-recurring costs to implement one or more of these restructuring actions.

Our business operations are subject to interruption by natural disasters, including extreme weather related to the effects of climate change, and other catastrophic events such as fire, floods, power loss, telecommunications failure, cyberattack, war or terrorist attack, or epidemic or pandemic. To the extent such events impact our facilities or off-premises or third-party infrastructure, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our software development, lengthy interruptions in our services, breaches of data security and loss of critical data, all of which could have an adverse effect on our future operating results.

Our ability to successfully attain our business objectives will depend significantly on our ability to retain and motivate key employees and attract qualified new hires. We face intense competition for these employees from numerous technology, software and other companies, many of whom have greater resources than we do, and our employees are generally employed on an at-will basis, which means that they could terminate their employment with us at any time. The temporary or permanent loss of the services of our CEO, other members of senior management or other key employees for any reason could significantly delay or prevent the achievement of our objectives and harm our business, financial condition and results of operations. Further, the loss of key employees, particularly those in senior management roles, could be negatively perceived in the capital markets, which could reduce the market value of our securities. Difficulties retaining, motivating and attracting qualified employees could have an adverse effect on our ability to achieve our business objectives and, as a result, our ability to compete could decrease and our financial results could be adversely affected. In addition, even if we are able to identify and recruit a sufficient number of new hires, these new hires will require significant training before they achieve full productivity, particularly in the case of sales employees.