OneSpan: Strong Digital Agreements Can't Mask Stalling Organic Expansion

What happened

OneSpan's Q1 2026 results highlight a tale of two businesses: Digital Agreements delivered 10%+ revenue growth and 9pp margin expansion, but Cybersecurity organic ARR is stalling as net revenue retention (NRR) declined to 105% from 107% due to lower expansion contracts. The company's low valuation (6.1x P/E) reflects ongoing hardware headwinds and an organic growth engine that is weakening, with Cybersecurity margins deteriorating by 8pp. Reported ARR growth of 14% includes ~$1.3M FX benefit and acquisitions, masking the underlying slowdown. While management touts the subscription transition, the key health metric (NRR) signals diminishing expansion power, and the 90-day ARR renewal cushion delays churn visibility. The market's optimistic narrative of durable mid-teens ARR is not yet supported by organic fundamentals, warranting a cautious stance.

Implication

Over the next 6–12 months, OneSpan's valuation floor is supported by its strong balance sheet and capital returns, but upside is capped unless NRR stabilizes or re-accelerates above 105% and organic ARR growth becomes self-sustaining. Investors should monitor Cybersecurity organic expansion and gross margin trends; further deterioration could push the stock toward the $8 bear case. Digital Agreements remains a bright spot, but it alone cannot offset the broader growth deceleration. The Build38 acquisition has yet to contribute materially, and integration costs are pressuring opex. Buyers should wait for Q2–Q3 KPIs to confirm organic health before committing.

Thesis delta

No major shift: the DeepValue report already flagged NRR decline and weak organic expansion, and the Seeking Alpha article confirms those concerns. The thesis remains 'WAIT' with the same triggers: NRR needs to stabilize above 105% and hardware must stay within $43M–$45M. The news reinforces the risk that organic ARR growth is increasingly acquisition-dependent, lowering the quality of earnings.