OneSpan Inc.
For the period ended Dec 31, 2025. Filed Feb 26, 2026.
View on SEC.govAbout this filing
A company's yearly report to the SEC, with audited financial statements. It is the fullest account a company gives of its business, its finances and the risks it sees.
FY2025 · Filed Feb 26, 2026
OSPN$21.59-1.4%Stored close · as of Nov 6, 2026
What changed in Risk Factors?
Read the current filingPrevious report: 10-K
Period ended 2024-12-31; filed 2025-02-27.
0001628280-25-008750
Item 1A. Risk FactorsCurrent report: 10-K
Period ended 2025-12-31; filed 2026-02-26.
0001044777-26-000008
Item 1A. Risk FactorsThe baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.
Compared 242 previous paragraphs and 268 current paragraphs.
182 unchanged; 48 reworded; 36 added; 12 removed; 0 previous and 2 current paragraphs rearranged.
Tables are not compared: 0 previous and 0 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.
A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.
Added paragraphs (36)
Current report
•We may encounter challenges in achieving our revenue growth objectives.
Current report
•We may be unable to maintain or increase our level of profitability.
Current report
•The credit agreement for our revolving credit facility contains financial covenants and various other restrictions and requirements that could limit our operational flexibility and adversely affect our financial condition and results of operations if we are unable to comply with them.
Current report
•U.S. trade policy or foreign policy developments could have a material adverse impact on our business.
Current report
We may encounter challenges in achieving our revenue growth objectives.
Current report
•Delays in completing acquisitions, or failure to complete planned acquisitions, due to longer than anticipated regulatory clearance processes or other unexpected challenges;
Current report
Artificial intelligence technologies introduce evolving industry‑wide risks, including model manipulation, data poisoning, deceptive AI‑generated content, and rapidly expanding regulatory requirements. For OneSpan, the use of AI within security operations and product‑related processes may create vulnerabilities if systems are improperly designed, supervised, or governed, potentially resulting in unauthorized access, incorrect automated actions, exposure of confidential information, or operational failures. Despite policies governing AI usage, lifecycle risk management, and oversight, failures in design, monitoring, or compliance—as well as errors or misuse of AI‑enabled capabilities—could impair our security posture, reduce threat‑detection effectiveness, harm customer trust, or expose OneSpan to legal, regulatory, and reputational consequences.
Current report
Additionally, we use third-party service providers for certain services involving data storage or transmission, such as SaaS, cloud computing, and internet infrastructure and bandwidth. These providers face various cybersecurity threats and may experience cybersecurity incidents or other security breaches. For example, the recent Salesloft, Inc. Drift data breach impacted hundreds of Salesforce.com customers worldwide. Although OneSpan was among the affected customers, the incident did not compromise our products and had minimal impact on our business, but it is possible that future third-party incidents may be more harmful to us.
Current report
Despite these measures, we may not be able to anticipate or prevent all attacks. In the event of an actual or perceived security breach, confidence in our security practices and products could be diminished, resulting in loss of customers and sales, impairment of our operations, significant liabilities, reputational harm, and a negative impact on our business and financial condition.
Current report
•geopolitical conflicts and related economic or political instability, including tensions or conflicts between the U.S. and other countries or regions, particularly China and the European Union, over territorial and sovereignty matters (including those related to Taiwan, Hong Kong, and Greenland), tariffs and trade, or U.S. foreign policy;
Current report
We may be unable to maintain or increase our level of profitability.
Current report
The credit agreement for our revolving credit facility contains financial covenants and various other restrictions and requirements that could limit our operational flexibility and adversely affect our financial condition and results of operations if we are unable to comply with them.
Current report
On June 23, 2025, we entered into the Credit Agreement with MUFG, as administrative agent, swingline lender and letter of credit issuer, and other lenders party thereto. The Credit Agreement provides for a $100.0 million revolving credit facility with a $10.0 million letter of credit sublimit and a $10.0 million swingline loan sublimit. It also provides that we may, with the agreement of the lenders and/or new lenders and subject to certain conditions and limitations, add one or more incremental revolving facilities to increase commitments under the credit facility in an aggregate amount not to exceed the greater of (x) $100.0 million and (y) 100% of Consolidated EBITDA (as defined in the Credit Agreement) for the four consecutive fiscal quarters most recently ended for which financial statements have been delivered pursuant to the terms of the Credit Agreement.
Current report
The proceeds of borrowings under the Credit Agreement may be used for general corporate purposes. We may borrow, repay and reborrow funds under the revolving credit facility until its maturity on June 23, 2030. As of December 31, 2025, we had outstanding letters of credit of $0.4 million and no borrowings outstanding under the Credit Agreement. Refer to Note 12, Debt in the Notes to Consolidated Financial Statements in Item 8 of Part II of this Annual Report on Form 10-K for further details on the Credit Agreement.
Current report
The Credit Agreement contains certain customary representations and warranties, affirmative and negative covenants, minimum net leverage and interest coverage ratios that we must maintain, and other requirements. Subject to limited exceptions, the Credit Agreement restricts our ability to, among other things:
Current report
•make prepayments or repurchases of subordinated debt;
Current report
•make certain amendments to subordinated debt agreements or our certificate of incorporation or bylaws;
Current report
•consolidate, merge, dissolve, or sell or otherwise dispose of all or substantially all of our assets;
Current report
•make certain investments or acquisitions or dispositions of assets;
Current report
•enter into certain sale and leaseback transactions;
Current report
•pay more than a specified amount of dividends on or make other distributions in respect of our capital stock or make other restricted payments; and
Current report
•enter into certain transactions with affiliates.
Current report
These negative covenants may prevent us from taking actions that we believe would be in the best interests of our business and may make it difficult for us to execute our business strategy successfully or effectively compete with companies that are not similarly restricted.
Current report
The Credit Agreement contains customary events of default relating to, among other things, payment defaults, breach of covenants, cross defaults to material indebtedness, bankruptcy-related defaults, judgment defaults, and the occurrence of certain change of control events. If an event of default occurs and is not cured or waived, the lenders under the Credit Agreement will be entitled to take various actions, including the termination of commitments and the acceleration of amounts due under the Credit Agreement in addition to charging default interest. If we are unable to repay our indebtedness, the lenders under our credit facility could proceed against the collateral securing the indebtedness, which would be likely to have a material adverse effect on our financial condition and results of operations. Additionally, any event of default may be a disclosable event and may be perceived negatively. Such perception could adversely affect the market price for our common stock and our ability to obtain financing in the future.
Current report
U.S. trade policy or foreign policy developments could have a material adverse impact on our business.
Current report
Our Digipass authentication devices are assembled by third-party manufacturers located in China and Romania, using components from suppliers in a wide range of geographic locations, including China. The U.S. presidential administration has imposed new or additional tariffs on foreign goods, including tariffs on certain Chinese imports. Although sales to U.S. customers account for a small portion of our Digipass sales, these tariffs could negatively impact our financial results. In some cases, we may not be able to pass the cost of the tariffs to our customers, which would negatively affect our profit margin. Even if we can pass on these costs, the tariffs and the economic uncertainty they cause may discourage customers from placing Digipass orders or lead them to decrease or delay such orders. Additional expansion of or increases to tariffs would exacerbate these impacts. Although we are planning measures to mitigate the potential impact of the China tariffs on our business, including moving more of our Digipass production to Romania or to other locations, these measures are unlikely to fully offset the impact, particularly since the U.S. has also imposed new tariffs on members of the European Union and other countries.
Current report
In addition, in response to tariffs or geopolitical actions by the U.S., other countries have implemented, or may implement in the future, retaliatory tariffs, other protective measures, or sanctions impacting U.S. companies and goods. Political tensions as a result of trade and foreign policies could reduce trade volume, investment, technological exchange, and other economic activities between major international economies, resulting in a material adverse effect on global economic conditions and the stability of global financial markets, which could in turn have a material adverse impact on our business and financial condition.
Current report
In addition, as we increasingly use of generative AI coding tools to assist in software development, these tools may introduce similar or heightened risks. For example, AI-generated snippets of code could inadvertently include open-source components subject to restrictive licenses or that infringe third-party intellectual property rights. If such risks materialize, we could face legal claims, be required to modify or replace portions of our code, or incur additional compliance costs.
Current report
International and domestic laws and regulations relating to data privacy, protection, access, sharing, portability and use could have a material adverse impact on our results of operations.
Current report
Our business is subject to a rapidly expanding and increasingly complex set of international, federal, state, and local laws and regulations governing the collection, use, access, sharing, transfer, portability, interoperability, and other processing and use of data worldwide. Globally, virtually every jurisdiction in which we operate has established its own data security, privacy, and broader data governance frameworks with which we must comply, including regimes that regulate data access and sharing rights, data portability and interoperability, restrictions on use and commercialization, and obligations imposed on cloud and other data processing services. We collect, transmit, store, and otherwise process (on our systems and on our third-party partners’ systems) our customers’, their end users, and our employees’ data that includes personal data subject to these international and domestic privacy, data protection, and data governance laws and regulations. Failure to comply, or a perceived failure to comply, with these requirements could subject us to enhanced regulatory and customer monitoring, audits, and related expenses, restrict our ability to deliver or enhance our services, limit our ability to use data, expose us to regulatory enforcement actions, litigation and fines, and harm our reputation and customer relationships.
Current report
For example, in the European Economic Area (“EEA”), we are subject to Regulation (EU) 2016/679 (the General Data Protection Regulation or “GDPR”) and related national implementing laws. The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to lawful basis for processing, transparency, data subject rights, security safeguards, breach notification, accountability, and the oversight of third-party processors. Certain categories of data, including biometric and other sensitive data are subject to heightened requirements. In addition, the GDPR permits data protection authorities to impose corrective measures and/or administrative fines of up to the greater of 20 million Euros or four percent of global annual revenues, and allows data subjects to seek judicial remedies and compensation. Moreover, the EU Data Act (Regulation (EU) 2023/2854) establishes new rules governing access to, sharing of, and switching of data generated by connected products and related services, including mandatory data access rights for users and restrictions on contractual and technical barriers to data portability. The Data Act may require us to modify product design, data architectures, commercial terms, and cloud or data processing arrangements, and could limit our ability to monetize or control certain data assets. Although we have implemented policies, technical measures, and contractual safeguards designed to support compliance, the interpretation and enforcement of GDPR and the EU Data Act obligations continue to evolve and may differ across EEA member states. As a result, there can be no assurance that our compliance measures will not be challenged by regulators, courts, or other parties, which could result in investigations, fines, restrictions on processing or data sharing activities, or civil claims.
Current report
In the United States, we are subject to a fragmented and expanding regulatory landscape at both the federal and state levels. Federal data privacy and security enforcement continues to evolve, and although the current federal regulatory environment is expected to shift toward more traditional and narrower enforcement priorities, our company remains exposed to potential actions by federal agencies such as the FTC under existing privacy laws, especially in the area of processing biometrics and other sensitive data. At the state level, comprehensive privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act of 2020, and other similar statutes adopted by more than a dozen other states, impose varying obligations and grant enhanced enforcement powers, and in some cases, private rights of action. In addition, certain state laws regulate specific categories of information, such as biometric or health-related information. This patchwork of requirements increases compliance costs, audit and reporting obligations, litigation, fine and penalty exposure, and the risk that we may be subject to inconsistent or conflicting legal standards.
Current report
Several jurisdictions impose particularly stringent requirements on the processing of biometric data. Laws such as the Illinois Biometric Information Privacy Act, Québec's Act respecting the protection of personal data in the private sector, and other similar laws regulate the collection, use, safeguarding, storage, governance, transparency and disclosure of biometric identifiers and information. Many of these laws also require informed consent, and provide for statutory damages and private rights of action. Because some of our SaaS solutions support identity verification, authentication, fraud prevention, and similar use cases that may involve biometric identifiers processed on behalf of customers, we may face heightened regulatory scrutiny and litigation risk.
Current report
Additionally, our products may increasingly incorporate advanced analytics, automation, and AI-enabled features. The regulatory landscape governing the use of automated decision-making, AI systems, and data-driven technologies is evolving rapidly, with increasing convergence between privacy, data protection, consumer protection, and AI-specific regulatory regimes. New or emerging requirements may restrict how we design, deploy, or market certain features, require additional transparency or governance measures, or increase the risk of regulatory enforcement and legal claims related to data use, transparency and accountability.
Removed paragraphs (12)
Previous report
•We may experience difficulties increasing or maintaining our rate of revenue growth.
Previous report
•We have operated at a loss for two of the past three years, and we may not be profitable in the future.
Previous report
We may experience difficulties increasing or maintaining our rate of revenue growth.
Previous report
In addition, while we believe the significant workforce reductions we completed in the past three years were necessary in order to position the company for profitable growth, it is possible that we could experience various negative effects from these reductions, including slower customer service response times and reduced ability to complete or undertake new product development projects and other business, product, technical, compliance or risk mitigation initiatives.
Previous report
We have operated at a loss for two of the past three fiscal years, and we may not be profitable in the future.
Previous report
•economic or political instability in foreign markets, including instability related to the impact of geopolitical tensions between China and the U.S. over Taiwan, Hong Kong, and tariffs and trade, particularly if the current U.S. presidential administration continues or expands tariffs on Chinese or other imports into the U.S.
Previous report
International and domestic privacy and data protection laws and regulations could have a material adverse impact on our results of operations.
Previous report
The regulatory framework for the collection, use, access, sharing, transfer and other processing of information worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. Globally, virtually every jurisdiction in which we operate has established its own data security and privacy frameworks with which we must comply. We collect, transmit, store, and otherwise process (on our systems and on our third-party partners’ systems) our customers’ and our employees’ data that includes personal data subject to these international and domestic privacy and data protection laws and regulations. For example, in the European Union, we are required to comply with the General Data Protection Regulation, (EU) 2016/679 as well as supplementary laws implemented by EU member states of the European Economic Area (“EEA”) (collectively, “GDPR”). The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to processing biometric and other sensitive data, obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches, and taking certain measures when engaging third-party processors. The GDPR also imposes strict rules on the transfer of personal data from the EEA to other countries that are not viewed as providing an adequate level of data protection. In addition, the GDPR permits data protection authorities to require destruction of improperly gathered or used personal information and/or impose substantial fines for violations of the GDPR, which can be up to four percent of global revenues or 20 million Euros, whichever is greater, and it also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. We continue to adapt our compliance with GDPR using standard contractual clauses and other methods; however, it is difficult to be certain that compliance has been achieved. We have expended significant resources to comply, but those methods may be subject to scrutiny by data protection authorities in EEA member states.
Previous report
There are ongoing concerns about the ability of companies to transfer personal data from the EEA to other countries. In October 2022, President Biden signed an executive order to implement the EU-U.S. Data Privacy Framework (“DPF”). The European Commission adopted an adequacy decision to permit data transfers from the EEA to the United States going forward. This development permits data transfers at this point under this framework and more broadly has made international data transfers more straightforward, but these provisions are being challenged in court. The new U.S. presidential administration may also impact whether the DPF remains an adequate data transfer framework. The continuing uncertainty around this issue may further impact our business operations in the EEA.
Previous report
In the United States, the federal and state governments have also enacted privacy and data protection laws and regulations that impact us, our customers, and partners. At the federal level, we could potentially be subject to privacy enforcement from the Federal Trade Commission (the “FTC”), which has been particularly focused on the processing of biometric and other sensitive data through its recent enforcement actions. The FTC’s enforcement priorities (as well as those of other federal regulators) may be impacted by the change in administration and new leadership. These shifts in enforcement priorities may also impact our business. At the state level, the California Consumer Privacy Act (“CCPA”)—which went into effect on January 1, 2020—is creating similar risks and obligations as those created by GDPR. The CCPA also has been amended through a recent referendum in California that creates additional obligations beginning in 2023.
Previous report
The California Privacy Rights Act of 2020 (“CPRA”) also created a new enforcement agency – the California Privacy Protection Agency – whose sole responsibility is to enforce the CPRA, which will further increase compliance risks. In addition, more than 18 other states already have passed comprehensive privacy laws. States are also passing laws regulating specific categories of information that may impact our business. For example, the State of Washington passed the My Health My Data Act in 2023, which specifically regulates health information, including biometric data, that is not otherwise regulated by the HIPAA rules and includes a private right action. A broad range of legislative measures also have been introduced at the federal level. Accordingly, failure to comply with federal and state laws (both those currently in effect and future legislation) regarding privacy and security of personal information could expose us to fines and penalties under such laws. There also is the threat of consumer class actions related to these laws and the overall protection of personal data. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our reputation and our business.
Previous report
In addition, several jurisdictions have imposed legal and compliance requirements on biometric data that are more stringent than requirements on other classifications of personal data. For example, in the U.S., the Illinois Biometric Information Privacy Act (“BIPA”) regulates the collection, use, safeguarding, and storage of biometric identifiers and information, requires informed consent before collection, imposes fines for non-compliance, and grants residents a private right of action over improper collection and mishandling of biometric data. The U.S. state comprehensive privacy laws generally treat biometric data as sensitive personal data, subject to heightened requirements around its processing. Similarly, Québec's Act respecting the protection of personal data in the private sector (“Law 25”, formerly known as “Bill 64”) introduces substantial changes to the privacy landscape in Quebec, enhancing protection for personal data and introducing new obligations for transparency and accountability in data processing activities, including those involving biometric data.
Reworded paragraphs (48)
Previous wording
•Acquisitions or other strategic transactions may not achieve the intended benefits or may disrupt our current plans and operations.
Current wording
•Acquisitions or other strategic transactions, such as our planned acquisition of Build38, may not achieve the intended benefits and could disrupt our operations.
Previous wording
•If we are unable to retain key employees and successfully hire and train qualified new employees, we may be unable to achieve our business objectives. In addition, we may experience negative effects from the significant workforce reductions we have completed over the past several years.
Current wording
•If we are unable to retain key employees and successfully hire and train qualified new employees, we may be unable to achieve our business objectives.
Previous wording
During 2024, we made significant strides in improving profitability across our business, including achieving profitability in our Digital Agreements segment for the first time. Our revenue also grew modestly during 2024, and we are aiming to continue to grow our revenue in both Security Solutions and Digital Agreements going forward; however, this may be challenging. We expect revenue from our Digipass authenticator tokens to decrease modestly on a year-over-year basis in 2025, consistent with trends over the past decade as our banking customers have generally moved toward “mobile-first” authentication (authentication solutions delivered through a software application on a mobile device), especially for consumer banking. We will therefore need to grow our revenue relatively more in the software component of our Security Solutions segment and in the Digital Agreements segment to compensate for the anticipated decline in hardware as well as, to a lesser extent, the impact of the sunsetting of certain of our products in 2022, 2023 and 2024 and the decrease in maintenance and support revenue as we continue to transition legacy perpetual maintenance contracts to term licenses. Although we are making additional investments in software product development and in channel partnerships to enhance our software solutions, these efforts may not yield the additional revenue we seek for various reasons, such as competition, delays and challenges in developing products that meet our customers’ needs, long sales cycles, lack of brand awareness, general economic conditions, and other risks described in these Risk Factors. If we are unable to grow our revenue as planned, we may also be unable to continue to gradually increase our profitability, since we have already implemented significant restructuring activities over the past several years.
Current wording
Our total revenue for 2025 was approximately the same as our total revenue for 2024. We are aiming to grow our revenue in both Cybersecurity and Digital Agreements going forward; however, this may be challenging. We expect revenue from our Digipass authenticator tokens to decrease modestly on a year-over-year basis in 2026, consistent with trends over the past decade as our banking customers have generally moved toward “mobile-first” authentication (authentication solutions delivered through a software application on a mobile device), especially for consumer banking. We will therefore need to grow our revenue relatively more in the software component of our Cybersecurity division and in our Digital Agreements division to compensate for the anticipated decline in hardware. We are enhancing our software solutions through strategic acquisitions, including our acquisition of Nok Nok Labs in June 2025 and our entry into a definitive agreement to acquire Build38 in December 2025, and targeted additional investments in software product development; however, these efforts may not yield the additional software revenue we seek for various reasons, such as competition, delays and challenges in integrating acquisitions or developing products that meet our customers’ needs, long sales cycles, lack of brand awareness, general economic conditions, and other risks described in these Risk Factors. If we are unable to grow our revenue as planned, we may also be unable to maintain or increase our profitability.
Previous wording
Acquisitions or other strategic transactions may not achieve the intended benefits or may disrupt our current plans and operations.
Current wording
Acquisitions or other strategic transactions, such as our planned acquisition of Build38, may not achieve the intended benefits and could disrupt our operations.
Previous wording
To remain competitive, we have in the past and may in the future seek to acquire additional businesses, products or technologies or to make investments in, or enter into joint ventures or similar transactions with, third parties. These transactions involve numerous risks, including the following:
Current wording
To remain competitive, we have in the past and may in the future acquire additional businesses, products or technologies or make investments in, or enter into joint ventures or similar transactions with, third parties. In 2025, we acquired Nok Nok Labs, a provider of FIDO passwordless software authentication solutions, and made a strategic investment in ThreatFabric Holding B.V., a provider of fraud detection, mobile threat intelligence, and malware defense solutions. In December 2025, we signed a definitive agreement to acquire Build38, a provider of mobile application protection software. The proposed Build38 acquisition is subject to customary closing conditions and is currently expected to close in March 2026. Acquisitions and other strategic transactions such as these involve numerous risks, including the following:
Previous wording
•Delays or reductions in customer purchases for both us and the company we acquired due to customer uncertainty about continuity and effectiveness of service from either company;
Current wording
•Delays or reductions in customer purchases for OneSpan and/or the company we acquired due to customer uncertainty about continuity and effectiveness of service from either company;
Previous wording
•Difficulties in supporting and migrating acquired customers, if any, to our platforms, which could cause customer churn, unanticipated costs, and damage to our reputation;
Current wording
•Difficulties in supporting and, where applicable, migrating acquired customers to our platforms, which could cause customer churn, unanticipated costs, and damage to our reputation;
Previous wording
•Constraints on our liquidity in the event that we use cash or incur debt to fund an acquisition, or dilution to existing stockholders in the event we issue equity securities as part of the consideration for the acquisition;
Current wording
•Constraints on our liquidity in the event that we use cash or incur debt to fund a significant acquisition, or dilution to existing stockholders in the event we issue equity securities as part of the consideration for such an acquisition;
Previous wording
•Potential loss of the customers or partners of an acquired business due to the actual or perceived impact of the acquisition;
Current wording
•Potential loss of partners of OneSpan or an acquired business due to the actual or perceived impact of the acquisition;
Previous wording
Any of these risks could result in acquisitions or other strategic transactions disrupting our business and/or failing to achieve their intended objectives.
Current wording
Any of these risks could result in acquisitions or other strategic transactions failing to achieve their intended objectives and/or disrupting our business.
Previous wording
Technological changes occur rapidly in our industry and development of new products and features is critical to maintain and grow our revenue. Our ability to attract and retain customers will depend in part upon our ability to enhance our current products and develop innovative new solutions to distinguish us from the competition and to meet customers’ changing needs. For instance, we believe that our bank and financial institution customers, who account for a majority of our revenue, may increasingly move away from multi-factor authentication methods and toward passkeys that use the FIDO2 passwordless authentication standard. If we are unable to provide our customers with high quality and innovative passkey solutions, or if we otherwise do not anticipate or adapt to changing technology, industry standards or customer requirements on a timely basis, competitive position and financial results will be negatively impacted.
Current wording
Technological changes occur rapidly in our industry and development of new products and features is critical to maintain and grow our revenue. Our ability to attract and retain customers will depend in part upon our ability to enhance our current products and develop innovative new solutions to distinguish us from the competition and to meet customers’ changing needs. For instance, we believe that our bank and financial institution customers, who account for a majority of our revenue, may increasingly move away from multi-factor authentication methods and toward passkeys that use the FIDO2 passwordless authentication standard. If we are unable to provide our customers with high quality and innovative passkey solutions, or if we otherwise do not anticipate or adapt to changing technology, industry standards or customer requirements on a timely basis, our competitive position and financial results will be negatively impacted.
Previous wording
Product developments and technology innovations by others may adversely affect our competitive position. The introduction by our competitors of products embodying new technologies or the emergence of new industry standards could render our existing products obsolete and unmarketable. For example, if our competitors are able to more quickly and effectively integrate new technologies such as generative artificial intelligence into their products, our competitive position may suffer.
Current wording
Product developments and technology innovations by others may adversely affect our competitive position. The introduction by our competitors of products embodying new technologies or the emergence of new industry standards could render our existing products obsolete and unmarketable. For example, if our competitors are able to more quickly and effectively integrate technologies such as generative artificial intelligence into their products, our competitive position may suffer. In addition, AI may reduce barriers to entry in our markets by allowing new entrants to rapidly and cost-effectively create competitive and potentially disruptive software solutions.
Previous wording
We spend substantial amounts of time and money to research and develop new offerings and enhanced versions of our existing offerings in order to meet our customers’ rapidly evolving needs. When we develop a new offering or an enhanced version of an existing offering, we typically incur expenses and expend resources upfront to market, promote and sell the new offering. Therefore, when we develop or acquire new or enhanced offerings, their introduction must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing them to market. In some cases, we determine that product initiatives we initially believed were promising do not warrant further investment. For example, in 2023, we decided to discontinue investments in our Digipass CX product in order to rationalize and focus our product portfolio, and incurred non-cash charges as a result. If other recent or future new product offerings do not garner widespread customer adoption and implementation, we may incur future non-cash charges and our business may be adversely affected.
Current wording
We spend substantial amounts of time and money to research and develop new offerings and enhanced versions of our existing offerings in order to meet our customers’ rapidly evolving needs. When we develop a new offering or an enhanced version of an existing offering, we typically incur expenses and expend resources upfront to market, promote and sell the new offering. Therefore, when we develop or acquire new or enhanced offerings, their introduction must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing them to market. In the past, we have determined that certain product initiatives we initially believed were promising did not warrant further investment, and incurred non-cash impairment charges as a result. If future new product initiatives do not garner widespread customer adoption and implementation, we may incur future non-cash charges and our business may be adversely affected.
Previous wording
We derive a substantial portion of our revenue from a limited number of customers. The loss of substantial sales to any one of them could adversely affect our operations and results. In 2024, 2023, and 2022, our top 10 largest customers contributed 20%, 22%, and 23%, respectively, of our total worldwide revenue.
Current wording
We derive a substantial portion of our revenue from a limited number of customers. The loss of substantial sales to any one of them could adversely affect our operations and results. In 2025, 2024, and 2023, our top 10 largest customers contributed 18%, 20%, and 22%, respectively, of our total worldwide revenue.
Previous wording
The market for digital solutions for security, authentication, identity, electronic signature, and digital workflow solutions is very competitive and, like most technology-driven markets, is subject to rapid change and constantly evolving solutions and services.
Current wording
The markets for cybersecurity and digital agreements solutions are very competitive and, like most technology-driven markets, are subject to rapid change and constantly evolving solutions and services. Competition in these markets may intensify further as advances in AI enable rapid, low-cost development of software applications.
Previous wording
Our identity verification and authentication products are designed to allow authorized users access to digital business processes and properties, in some cases using patented technology, as a replacement for or supplement to a static password. Our main competitors in our identity verification and authentication markets are Gemalto, a subsidiary of Thales Group, Yubico and RSA Security. There are also many other companies in adjacent areas, such as mobile device management ("MDM"), threat protection, and identity and access management ("IAM"), that offer competing services In addition to these companies, we face competition from many small authentication solution providers, many of whom offer new technologies and niche solutions such as biometric or risk and behavioral analysis. We believe that competition in this market is likely to intensify as a result of increasing demand for security products.
Current wording
The authentication products in our Cybersecurity division are designed to allow authorized users access to digital business processes, in some cases using patented technology. Our main competitors in our authentication market are Gemalto, a subsidiary of Thales Group, Yubico and RSA Security. There are also many other companies in adjacent areas, such as MDM, threat protection, and IAM, that offer competing services. In addition to these companies, we face competition from many small authentication solution providers, many of whom offer new technologies and niche solutions such as biometric or risk and behavioral analysis. We believe that competition in this market may to intensify as a result of increasing demand for security products.
Previous wording
Our primary competitors for electronic signature solutions are DocuSign and Adobe Systems. Both companies are significantly larger than us. In addition to these companies, there are numerous smaller and regional or niche providers of electronic signing solutions.
Current wording
Our primary competitors for electronic signature solutions in our Digital Agreements division are DocuSign and Adobe Systems. Both companies are significantly larger than us. In addition to these companies, there are numerous smaller and regional or niche providers of electronic signing solutions.
Previous wording
Some of our present and potential competitors have significantly greater brand awareness and financial, technical, marketing, purchasing, and other resources than we do. As a result, they may be able to respond more quickly to new or emerging technologies and changes in customer requirements, devote greater resources to the development, promotion and sale of products, or deliver competitive products at a lower end-user price than we do. These factors have made it more difficult for us to compete successfully and may continue to do so, which would negatively affect our business.
Current wording
Some of our present and potential competitors have significantly greater brand awareness and financial, technical, marketing, purchasing, and other resources than we do. As a result, they may be able to respond more quickly to new or emerging technologies and changes in customer requirements, devote greater resources to the development, promotion and sale of products, or deliver competitive products at a lower end-user price than we do. These factors have made it more difficult for us to compete successfully and may continue to do so, which could negatively affect our business.
Previous wording
Our corporate infrastructure stores and processes our sensitive, proprietary and other confidential information (including information related to finance, technology, employees, marketing, sales, etc.) which is used daily in our operations. In addition, our solutions involve transmission and processing of our customers' confidential, proprietary, personal and sensitive information. We have legal and contractual obligations to protect the confidentiality and appropriate use of customer data. Because we are a digital agreements and cybersecurity company, and because the majority of our customers are banks and other financial institutions, which are frequent targets of cyberattacks, we may be an attractive target for cyber attackers or other data thieves.
Current wording
Our corporate infrastructure stores and processes our sensitive, proprietary and other confidential information (including information related to finance, technology, employees, marketing, sales, etc.) which is used daily in our operations. In addition, our solutions involve the transmission and processing of our customers' confidential, proprietary, personal and sensitive information. We have legal and contractual obligations to protect the confidentiality and appropriate use of customer data. Because we are a digital agreements and cybersecurity company, and because the majority of our customers are banks and other financial institutions, which are frequent targets of cyberattacks, we may be an attractive target for cyber attackers or other data thieves.
Previous wording
High-profile cyberattacks and security breaches have increased in recent years, with the potential for such acts heightened because of the number of employees working remotely since the COVID-19 pandemic and the increase in sophisticated cyberattack methods, such as the use of artificial intelligence to launch automated, accelerated and enhanced cyberattacks. Because techniques used to obtain unauthorized access or to sabotage systems are constantly evolving, change frequently and often are not recognized until launched against a specific target, we may be unable to anticipate these techniques or to implement adequate preventative measures. As we seek to increase our client base and expand awareness of our brand, we may become a greater target for third parties seeking to compromise our security systems and we anticipate that hacking attempts and cyberattacks will increase in the future.
Current wording
High-profile cyberattacks and security breaches have increased in recent years, with the potential for such acts heightened because of the widespread adoption of remote working and the increase in sophisticated cyberattack methods, including the use of artificial intelligence to launch automated, accelerated and enhanced cyberattacks. Because techniques used to obtain unauthorized access or to sabotage systems are constantly evolving, change frequently and often are not recognized until launched against a specific target, we may be unable to anticipate these techniques or to implement adequate preventative measures. As we seek to increase our client base and expand awareness of our brand, we may become a greater target for third parties seeking to compromise our security systems and we anticipate that hacking attempts and cyberattacks will increase in the future.
Previous wording
We have experienced several security incidents in the past. None have been material to date, but it is possible that we will experience a material event in the future. Even though we have established teams, processes and strategies to protect our assets, we may not always be successful in preventing or repelling unauthorized access to our systems. We also may face delays in our ability to identify or otherwise respond to a cybersecurity incident or other breach. Additionally, we use third-party service providers to provide some services to us that involve the storage or transmission of data, such as SaaS, cloud computing, and internet infrastructure and bandwidth, and they face various cybersecurity threats and may suffer cybersecurity incidents or other security breaches. Despite our security measures, our IT and infrastructure may be vulnerable to attacks. Threats to IT security can take a variety of forms. Individuals and groups of hackers and sophisticated organizations, including state-sponsored organizations or nation-states, continuously undertake attacks that pose threats to our customers and our own IT. These actors may use a wide variety of methods, which may include utilizing our products to launch phishing attacks, developing and deploying malicious software or exploiting vulnerabilities in hardware, software, or other infrastructure in order to attack our products and services or gain access to our networks, using social engineering techniques to induce our employees, users, partners, or customers to disclose passwords or other sensitive information or take other actions to gain access to our data or our users’ or customers’ data, or acting in a coordinated manner to launch distributed denial of service or other coordinated attacks. Inadequate account security practices may also result in unauthorized access to confidential and/or sensitive data.
Current wording
We have experienced several security incidents in the past, none of which have been material to date. However, it is possible that we may experience a material event in the future. While we have established teams, processes and strategies to protect our assets, we may not always succeed in preventing or repelling unauthorized access to our systems. We also may face delays in detecting or otherwise responding to cybersecurity incidents or other breaches.
Previous wording
Security incidents may have a number of negative consequences to us, including the following: requiring us to expend significant capital and other resources to alleviate the incidents and to improve our security technologies; impairing our ability to provide services to our customers and protect the privacy of their data delaying product development efforts; compromising confidential or technical business information or personal data; harming our reputation or competitive position; resulting in theft or misuse of our intellectual property or other assets; and exposing us to substantial litigation expenses and damages, indemnity and other contractual obligations, government fines and penalties, mitigation expenses, costs for remediation and incentives offered to affected parties, including customers, other business partners and employees, in an effort to maintain business relationships after an incident. We are continuously working to improve our IT systems, together with creating security boundaries around our critical and sensitive assets. We provide security awareness training to our employees and our key contractors that focuses on various aspects of cybersecurity. All these steps are taken to mitigate the risk of attack and to ensure our readiness to responsibly manage a security violation or attack. However, we may nevertheless be unable to anticipate attacks or to implement adequate preventative measures. If an actual or perceived breach of our security occurs, the market perception of the effectiveness of our security measures and our products could be harmed, we could lose potential sales and existing customers, our ability to operate our business could be impaired, we may incur significant liabilities, we could suffer harm to our reputation and competitive position, and our business and financial condition could be negatively impacted.
Current wording
Security incidents may have a number of negative consequences to us, including the following: requiring us to expend significant capital and other resources to alleviate the incidents and to improve our security technologies; impairing our ability to provide services to our customers and protect the privacy of their data delaying product development efforts; compromising confidential or technical business information or personal data; harming our reputation or competitive position; resulting in theft or misuse of our intellectual property or other assets; and exposing us to substantial litigation expenses and damages, indemnity and other contractual obligations, government fines and penalties, mitigation expenses, costs for remediation and incentives offered to affected parties, including customers, other business partners and employees, in an effort to maintain business relationships after an incident. We continually invest in strengthening our information technology systems and implementing robust security measures to protect critical and sensitive assets. Our cybersecurity program includes regular security awareness training for employees and key contractors, emphasizing best practices and emerging threats. These efforts are designed to reduce the likelihood of an attack and ensure preparedness to respond effectively to any security breach.
Previous wording
In 2024, approximately 83% of our revenue and approximately 59% of our operating expenses were generated/incurred outside of the U.S. In 2023, approximately 83% of our revenue and approximately 58% of our operating expenses were generated/incurred outside of the U.S. In 2022, approximately 83% of our revenue and approximately 66% of our operating expenses were generated/incurred outside of the U.S. A severe economic decline in any of our major foreign markets could adversely affect our results of operations and financial condition.
Current wording
In 2025, 2024 and 2023, we generated approximately 79%, 83% and 83% of our revenue and incurred approximately 54%, 59% and 58% of our operating expenses outside of the U.S., respectively. A severe economic decline in any of our major foreign markets could adversely affect our results of operations and financial condition.
Previous wording
•increased exposure to climate change, natural disasters, armed conflict, terrorism, epidemics, or pandemics and other health crises; and
Current wording
•increased exposure to climate change, natural disasters, armed conflict, terrorism, epidemics, or pandemics and other health crises.
Previous wording
In the event that the supply of components or finished products for our Digipass authenticator business is interrupted or relations with any of our principal component vendors or contract manufacturers is terminated, there could be increased costs and considerable delay in finding suitable replacement sources for components or alternative manufacturers for our hardware products. Our Digipass authentication devices are currently assembled at several facilities located in mainland China and one facility in Romania. The importation of these products from China and Romania exposes us to the possibility of product supply disruption and increased costs in the event of changes in the policies of the Chinese, Romanian or EU governments, political unrest, natural disasters, extreme weather or unstable economic conditions in China, Romania or the EU, or developments in China, Romania, the U.S. or the EU that are adverse to trade, including enactment of tariffs or other protectionist legislation. We experienced supply chain disruption in 2022 as a result of China’s implementation and subsequent reversal of its “Zero COVID” policy and extreme heatwaves and drought affecting southern China, both of which affected our China-based contract manufacturers. We may experience similar disruptions again due to numerous factors, including tariffs and trade disputes, geopolitical tensions, armed conflict, impacts as a result of pandemics or other public health threats, and natural disasters and extreme weather, which may occur more frequently due to climate change. These factors have in the past, and may in the future, cause delays in our fulfillment of customer orders, which may in turn delay our recognition of revenue from such orders or cause customers not to place orders or to seek alternative suppliers.
Current wording
In the event that the supply of components or finished products for our Digipass authenticator business is interrupted or relations with any of our principal component vendors or contract manufacturers is terminated, there could be increased costs and considerable delay in finding suitable replacement sources for components or alternative manufacturers for our hardware products. Our Digipass authentication devices are currently assembled at several facilities located in mainland China and one facility in Romania. The importation of these products from China and Romania exposes us to the possibility of product supply disruption and increased costs in the event of changes in the policies of the Chinese, Romanian or EU governments, political unrest, natural disasters, extreme weather or unstable economic conditions in China, Romania or the EU, or developments in China, Romania, the U.S. or the EU that are adverse to trade, including threatened or actual military conflict or enactment of tariffs or other protectionist legislation. We have experienced supply chain disruption in the past as a result of China’s COVID-related policies and extreme heatwaves and drought affecting southern China, both of which affected our China-based contract manufacturers. We may experience similar disruptions again due to numerous factors, including tariffs and trade disputes, geopolitical tensions, armed conflict, pandemics or other public health threats, and natural disasters and extreme weather, which may occur more frequently due to climate change. These factors have in the past, and may in the future, cause delays in our fulfillment of customer orders, which may in turn delay our recognition of revenue from such orders or cause customers not to place orders or to seek alternative suppliers.
Previous wording
A typical sales cycle in the financial services market is often nine to 18 months long. We often need to spend significant time and resources to better educate and familiarize these potential customers with the value proposition of our products and solutions. Purchasing decisions for our products and services may be subject to delays due to a number of factors, many of which are outside of our control, such as:
Current wording
A typical sales cycle in the financial services market is often 9 to 18 months long. We often need to spend significant time and resources to better educate and familiarize these potential customers with the value proposition of our products and solutions. Purchasing decisions for our products and services may be subject to delays due to a number of factors, many of which are outside of our control, such as:
Previous wording
If we are unable to retain key employees and successfully hire and train qualified new employees, we may be unable to achieve our business objectives. In addition, we may experience negative effects from the significant workforce reductions we have completed over the past several years.
Current wording
If we are unable to retain key employees and successfully hire and train qualified new employees, we may be unable to achieve our business objectives.
Previous wording
Our ability to successfully attain our business objectives will depend significantly on our ability to retain and motivate key employees and attract qualified new hires. In 2022, 2023 and 2024, we terminated the employment of approximately 330 employees as part of our cost reduction and restructuring efforts. These reductions may make it more difficult, more time-consuming and more expensive for us to retain key employees and attract new hires, both because our reputation in the hiring market may have been negatively affected by the reductions and because the remaining employees have had to assume additional work. We face intense competition for these employees from numerous technology, software and other companies, many of whom have greater resources than we do, and our employees are generally employed on an at-will basis, which means that they could terminate their employment with us at any time. The temporary or permanent loss of the services of our CEO, other members of senior management or other key employees for any reason could significantly delay or prevent the achievement of our objectives and harm our business, financial condition and results of operations. Further, the loss of key employees, particularly those in senior management roles, could be negatively perceived in the capital markets, which could reduce the market value of our securities.
Current wording
Our ability to successfully attain our business objectives will depend significantly on our ability to retain and motivate key employees and attract qualified new hires. We face intense competition for these employees from numerous technology, software and other companies, many of whom have greater resources than we do, and our employees are generally employed on an at-will basis, which means that they could terminate their employment with us at any time. The temporary or permanent loss of the services of our CEO, other members of senior management or other key employees for any reason could significantly delay or prevent the achievement of our objectives and harm our business, financial condition and results of operations. Further, the loss of key employees, particularly those in senior management roles, could be negatively perceived in the capital markets, which could reduce the market value of our securities.
Previous wording
•Other events or factors, including those resulting from pandemics, war, natural disasters, incidents of terrorism or responses to these events.
Current wording
•Other events or factors, including those resulting from pandemics, war and other geopolitical conflicts, natural disasters, incidents of terrorism or responses to these events.
Previous wording
Over our approximately 30-year operating history, we have operated at a loss for many of those years, including for the years ended December 31, 2023 and 2022, for which we reported a net loss of $29.8 million and $14.4 million, respectively. Although we were profitable in 2024, we may not be able to maintain or increase our level of profitability. We intend to continue to incur significant expenses to maintain, develop and enhance our products and solutions, improve our infrastructure and technology, and grow our customer base. These efforts may be costlier than we expect, and we may not be able to increase our revenue enough to offset our increased operating expenses. We may incur significant losses in the future for a number of reasons, including the other risks described herein, and experience unforeseen expenses, difficulties, complications and delays and other unknown events. If we are unable to achieve and sustain profitability, the value of our business and common stock may significantly decrease.
Current wording
Over our approximately 30-year operating history, we have operated at a loss for many of those years, including for the year ended December 31, 2023, for which we reported a net loss of $29.8 million. Although we were profitable in 2024 and 2025, we may not be able to maintain or increase our level of profitability. We intend to continue to incur significant expenses to maintain, develop and enhance our products and solutions, improve our infrastructure and technology, and grow our customer base. These efforts may be costlier than we expect, and we may not be able to increase our revenue enough to offset our increased operating expenses. We may incur significant losses in the future for a number of reasons, including the other risks described herein, and experience unforeseen expenses, difficulties, complications and delays and other unknown events. If we are unable to achieve and sustain profitability, the value of our business and common stock may significantly decrease.
Previous wording
We expect that our SaaS offerings will constitute an increasingly important part of our business. As a result, we will need to continue to evolve our processes to meet a number of regulatory, intellectual property, contractual, service, and security compliance challenges. These challenges include: compliance with licenses for open-source and third-party software embedded in our SaaS offerings; maintaining compliance with global export control, privacy, data security, and resiliency regulations (including the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the EU General Data Protection Regulation ("GDPR"), and the EU Digital Operational Resilience Act ("DORA")); supporting contractual requirements that our customers impose on us due to their own legal obligations, such as compliance with DORA; protecting our products from external threats; maintaining continuous service levels and data security practices expected by our customers; and preventing inappropriate use of our products. In addition to using our internal resources, we also utilize third-party resources to deliver SaaS offerings, such as third-party data hosting vendors. The failure of a third-party provider to prevent service disruptions, data losses or security breaches may require us to issue credits or refunds or to indemnify or otherwise be liable to customers or third parties for damages that may occur. Additionally, if these third-party providers fail to deliver on their obligations, our reputation could be damaged, and our customers could lose confidence in us and our ability to maintain and expand our SaaS offerings. Finally, our SaaS offerings must be designed to operate at significant transaction volumes. When combined with third-party software and hosting infrastructure, our SaaS offerings may not perform as designed, which could lead to service disruptions and associated damages.
Current wording
In addition to using our internal resources, we also utilize third-party resources to deliver SaaS offerings, such as third-party data hosting vendors. The failure of a third-party provider to prevent service disruptions, data losses or security breaches may require us to issue credits or refunds or to indemnify or otherwise be liable to customers or third parties for damages that may occur. Additionally, if these third-party providers fail to deliver on their obligations, our reputation could be damaged, and our customers could lose confidence in us and our ability to maintain and expand our SaaS offerings. Finally, our SaaS offerings must be designed to operate at significant transaction volumes. When combined with third-party software and hosting infrastructure, our SaaS offerings may not perform as designed, which could lead to service disruptions and associated damages.
Previous wording
Our business relies on our customers’ satisfaction with the technical and customer support and professional services we provide to support our products. If we fail to provide customer and technical support services that are high-quality, responsive, and able to promptly resolve issues that our customers encounter with our products and services, then they may elect not to purchase or renew subscription licenses or may otherwise reduce or discontinue their business relationship with us. Maintaining high-quality customer support can be costly, and it is possible that we will need to rely more heavily on online self-help tools or AI technology in order to meet our profitability objectives. These types of changes could result in difficulties maintaining the service levels our customers expect. This could result in loss of revenue and damage to our reputation, which could have an adverse effect on our business.
Current wording
Our business relies on our customers’ satisfaction with the technical and customer support and professional services we provide to support our products. If we fail to provide customer and technical support services that are high-quality, responsive, and able to promptly resolve issues that our customers encounter with our products and services, then they may elect not to purchase or renew subscription licenses or may otherwise reduce or discontinue their business relationship with us. Maintaining high-quality customer support can be costly, and therefore we have adopted, and expect to continue to adopt, online self-help tools and AI-enabled customer service technology. These types of tools may not always provide the service levels our customers expect, particularly when they are first adopted. This could result in loss of revenue and damage to our reputation, which could have an adverse effect on our business.
Previous wording
The exchange rate between the U.S. dollar and foreign currencies has fluctuated in recent years and may fluctuate substantially in the future. For example, the U.S. dollar’s strength against foreign currencies, particularly the Euro, during 2022 had a significant impact on our 2022 financial results. Although foreign exchange impact was not significant to our 2023 and 2024 results, it could adversely affect our results for 2025 and beyond. We do not currently use forward contracts or other hedging strategies such as options or foreign exchange swaps to mitigate our exposure to foreign currency fluctuations.
Current wording
The exchange rate between the U.S. dollar and foreign currencies has fluctuated in recent years and may fluctuate substantially in the future. Although foreign exchange impact was not significant to our 2023, 2024 or 2025 results, it could adversely affect our results for 2026 and beyond. We do not currently use forward contracts or other hedging strategies such as options or foreign exchange swaps to mitigate our exposure to foreign currency fluctuations.
Previous wording
We review our goodwill and intangible assets for impairment when events or changes in circumstances indicate the carrying value may not be recoverable. Goodwill is required to be tested for impairment at least annually. At December 31, 2024, we had goodwill and intangible assets with a net book value of $99.8 million primarily related to our acquisitions. An adverse change in market conditions, particularly if such change has the effect of changing one of our critical assumptions or estimates, could result in a change to the estimation of fair value that could result in an impairment charge to our goodwill or intangible assets.
Current wording
We review our goodwill and intangible assets for impairment when events or changes in circumstances indicate the carrying value may not be recoverable. Goodwill is required to be tested for impairment at least annually. At December 31, 2025, we had goodwill and intangible assets with a net book value of $113.6 million primarily related to our acquisitions. An adverse change in market conditions, particularly if such change has the effect of changing one of our critical assumptions or estimates, could result in a change to the estimation of fair value that could result in an impairment charge to our goodwill or intangible assets.
Previous wording
Approximately 57% of our total revenue for the year ended December 31, 2024 was attributable to our SaaS and on-premises term subscription contracts, and the revenue recognition treatment of both of these types of contracts under applicable accounting rules may make it more difficult for investors to accurately assess our operating results and the condition of our business.
Current wording
Approximately 64% of our total revenue for the year ended December 31, 2025 was attributable to our SaaS and on-premises term subscription contracts, and the revenue recognition treatment of both of these types of contracts under applicable accounting rules may make it more difficult for investors to accurately assess our operating results and the condition of our business.
Previous wording
We recognize SaaS subscription revenue ratably over the term of each of our contracts, which are typically one year in length but may be up to three years or longer. As a result, much of our SaaS revenue in a particular quarter is generated from the recognition of revenue from SaaS contracts we entered during previous periods, which can make it more challenging to assess the current state of our business. For instance, a shortfall in demand for our SaaS solutions or a decline in new or renewed SaaS contracts in any one quarter may not significantly reduce our revenue for that quarter (and may therefore not be apparent from our financial statements for that quarter), but could negatively affect our revenue in future quarters. In addition, the SaaS-based model of our Digital Agreements business unit makes it difficult for us to rapidly increase our Digital Agreements revenue through additional sales contracts in any period, since revenue from new customers is recognized over the applicable term of their contracts.
Current wording
We recognize SaaS subscription revenue ratably over the term of each of our contracts, which are typically one year in length but may be up to three years or longer. As a result, much of our SaaS revenue in a particular quarter is generated from the recognition of revenue from SaaS contracts we entered during previous periods, which can make it more challenging to assess the current state of our business. For instance, a shortfall in demand for our SaaS solutions or a decline in new or renewed SaaS contracts in any one quarter may not significantly reduce our revenue for that quarter (and may therefore not be apparent from our financial statements for that quarter), but could negatively affect our revenue in future quarters. In addition, the SaaS-based model of our Digital Agreements division makes it difficult for us to rapidly increase our Digital Agreements revenue through additional sales contracts in any period, since revenue from new customers is recognized over the applicable term of their contracts.
Previous wording
At December 31, 2024 we had U.S. federal, state, and foreign net operating losses ("NOLs"), of $22.7 million, $44.1 million, and $117.0 million, respectively, available to offset future taxable income, some of which begin to expire in 2025. Federal NOLs incurred in taxable years beginning after December 31, 2017 can be carried forward indefinitely, but the deductibility of federal NOLs in taxable years beginning after December 31, 2021 is subject to certain limitations. A lack of future taxable income would adversely affect our ability to utilize these NOLs before they expire.
Current wording
At December 31, 2025 we had U.S. federal, U.S. state, foreign, and Canadian provincial net operating losses ("NOLs") of $6.6 million, $52.3 million, $32.6 million, and $23.2 million, respectively, available to offset future taxable income, some of which begin to expire in 2032. A lack of future taxable income would adversely affect our ability to utilize these NOLs before they expire. Also, certain NOLs have limitations on the amount that can be utilized each year.
Previous wording
In addition, under the provisions of the Internal Revenue Code of 1986, as amended (the "Internal Revenue Code"), substantial changes in our ownership may limit the amount of pre-change NOLs that can be utilized annually in the future to offset taxable income. Section 382 of the Internal Revenue Code imposes limitations on a company’s ability to use its NOLs if one or more stockholders or groups of stockholders that own at least 5% of the company’s stock increase their ownership by more than 50 percentage points over their lowest ownership percentage within a rolling three-year period. Similar rules may apply under state tax laws. Based upon an analysis as of December 31, 2024, we determined that we do not expect these limitations to materially impair our ability to use our NOLs prior to expiration. However, if changes in our ownership occurred after such date, or occur in the future, our ability to use our NOLs may be further limited. Subsequent statutory or regulatory changes in respect of the utilization of NOLs for federal or state purposes, such as suspensions on the use of NOLs or limitations on the deductibility of NOLs carried forward, or other unforeseen reasons, may result in our existing NOLs expiring or otherwise being unavailable to offset future income tax liabilities. For these reasons, we may not be able to utilize a material portion of the NOLs, even if we achieve profitability.
Current wording
In addition, under the provisions of the Internal Revenue Code of 1986, as amended (the "Internal Revenue Code"), substantial changes in our ownership may limit the amount of pre-change NOLs and other tax attributes that can be utilized annually in the future to offset taxable income. Section 382 of the Internal Revenue Code imposes limitations on a company’s ability to use its NOLs if one or more stockholders or groups of stockholders that own at least 5% of the company’s stock increase their ownership by more than 50 percentage points over their lowest ownership percentage within a rolling three-year period. Similar rules may apply under state tax laws. Based upon an analysis as of December 31, 2024, we determined that we do not expect these limitations to materially impair our ability to use our NOLs prior to expiration. However, if changes in our ownership occurred after such date, or occur in the future, our ability to use our NOLs may be further limited. Subsequent statutory or regulatory changes in respect of the utilization of NOLs for federal or state purposes, such as suspensions on the use of NOLs or limitations on the deductibility of NOLs carried forward, or other unforeseen reasons, may result in our existing NOLs expiring or otherwise being unavailable to offset future income tax liabilities. For these reasons, we may not be able to utilize a material portion of the NOLs, even if we achieve profitability.
Previous wording
Our agreements with customers, solution partners and channel partners generally include provisions under which we agree to indemnify them for losses suffered or incurred as a result of claims of intellectual property infringement and, in some cases, for damages caused by us to property or persons or for other damages. In the past, we worked with a customer at our expense to resolve a claim brought against the customer related to our technology, and it is likely that we will need to indemnify our customers for similar claims in the future. The expense of defending these types of claims may adversely affect our financial results and may not be covered by any insurance policies we maintain. In addition, any such disputes and litigation could divert management attention and harm our reputation in the market.
Current wording
Our agreements with customers, solution partners and channel partners generally include provisions under which we agree to indemnify them for losses suffered or incurred as a result of claims of intellectual property infringement and, in some cases, for damages caused by us to property or persons or for other damages. These indemnification obligations may extend to claims arising from the use of third-party software, open-source components, or emerging novel legal theories, including those related to data usage or AI. In the past, we worked with a customer at our expense to resolve a claim brought against the customer related to our technology, and we may be required to indemnify customers for similar claims in the future. Defending such claims, regardless of their merit, could be costly and time-consuming, divert management attention and harm our reputation, and any resulting expense or liabilities may not be fully covered by insurance.
Previous wording
We also make certain representations and warranties and incur obligations under our contracts in the ordinary course of business, including for items related to data security and potential data privacy breaches. Although we normally contractually limit our liability with respect to such representations, warranties and other contractual obligations, we may still incur substantial liability related to them. Not all of our potential losses under our contracts are covered by insurance policies, which could increase the impact of any such loss should it occur. Large indemnity payments or damages resulting from our contractual obligations could harm our business, operating results and financial condition.
Current wording
We also make certain representations and warranties and incur obligations under our contracts in the ordinary course of business, including for items related to data security, data privacy, and regulatory compliance. Our customers increasingly seek heightened contractual protections including broader indemnification obligations or higher liability caps, particularly in the event of data security incidents, privacy breaches, or regulatory non-compliance. Although we normally contractually limit our liability with respect to such representations, warranties and other contractual obligations, we may still incur substantial liability related to them. Not all of our potential losses under our contracts are covered by insurance policies, and such coverage may be subject to coverage limits or exclusions, which could increase the impact of any such loss should it occur. Large indemnity payments or damages resulting from our contractual obligations could harm our business, operating results and financial condition.
Showing the first 40 of 48 pairs. Open the source sections for the rest.
Rearranged current paragraphs (2)
Current report — wording carried from elsewhere
Despite our security measures, our IT systems and infrastructure may be vulnerable to attacks. Threats to IT security can take a variety of forms. Individuals and groups of malicious actors and sophisticated organizations, including state-sponsored organizations or nation-states, continuously attempt to compromise systems using tactics, techniques, and procedures such as phishing attacks, malicious software, exploiting hardware or software vulnerabilities, social engineering, and coordinated attacks like distributed denial of service or other coordinated attacks. If account security controls are not effectively implemented or maintained, unauthorized access to confidential or sensitive information could occur.
Current report — wording carried from elsewhere
We expect that our SaaS offerings will constitute an increasingly important part of our business. As a result, we must continue to evolve our processes to meet a number of regulatory, intellectual property, contractual, service, and security compliance challenges. These challenges include: compliance with licenses for open-source and third-party software embedded in our SaaS offerings; maintaining compliance with global export control, privacy, data security, and resiliency regulations (including the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the EU General Data Protection Regulation ("GDPR"), the EU Digital Operational Resilience Act ("DORA"), and the Directive on Measures for a High Common Level of Cybersecurity Across the Union (EU) 2022/2555 (known as NIS2)); supporting contractual requirements that our customers impose on us due to their own legal obligations, such as compliance with DORA; protecting our products from external threats, including AI-driven attacks; maintaining continuous service levels and data security practices expected by our customers; and preventing inappropriate use of our products.