OneSpan Undergoing Changes, May Become Interesting In Future

OneSpan (NASDAQ:OSPN) is a cybersecurity provider specialized in authentication, validation and agreement. The company has global operations and diversified revenues. It also enjoys a very clean balance sheet.

However, OSPN has been disappointing investors in terms of profits and share price. That disappointment, along with some questionable practices by the prior management, triggered activist investors to demand changes.

Consequently, last year, the company replaced most of the board and C level positions, including the CEO. This year the new management announced its strategic plan.

Although I do not consider the plan as tremendously innovative or promising, OSPN could improve at the operational level. Also, the company is currently selling relatively cheap compared to its 12 year average R&D generation capacity. It is not clear whether it can return to that average, and with so many bargains in today’s markets, OSPN is not a buy. But it is definitely worth following.

OSPN’s Business, Market And Last Decade

OSPN is a cybersecurity provider specialized in authentication, validation and agreement. The company has been operating since the 1990s under the name VASCO, acquiring some other companies in the process. For most of the last decade, OSPN main revenue generators have been licensed software and Digipass, a hardware password generator. However, in the last few years it has been moving to a recurring revenue model based on SaaS and cloud.

From Porter’s framework perspective, OSPN is not in a great market.

First, the market is fiercely competitive with many companies participating. Some of OSPN’s competitors are very similar, like Transmit Security, others are more niche, like Trusona, while others are segments of bigger companies, like DocuSign and Adobe.

From customers’ perspective, OSPN serves mostly to institutions, with a significant percentage of revenue (undisclosed specifically as of the latest 10-K) coming from banking and finance. Other customer industries are healthcare and the government. These are strong, knowledgeable customers that can compare alternatives in a rational, procedural way.

On the positive side, OSPN has a globally diversified customer base, with approximately 50%, 40% and 20% of revenue coming from EMEA, Americas and APAC regions respectively. 90% of revenue and 70% of expenses are generated outside the US.

Fortunately, OSPN’s international structure did not represent higher tax rates, which is common in internationally distributed companies. This is because OSPN made good management of its sales offices, registering them as service providers, with most variable earnings moving to either the US or Switzerland. The chart below shows the relation between pre-tax income to income taxes. An average ratio of 3 represents an average tax rate of 33%. This is higher than the regular US company, but it is not that high compared to other globally diversified companies.

Finally, from a resources perspective, the company has high quality human capital at the base. Its employees are divided 40, 40, 20 between development, sales and administrative. Almost 900 people in total. Developers and salespeople require competitive payment and are not easy to replace.

OSPN is also diversified in terms of its human resources, with its main R&D center in Montreal, and additional centers across Europe. The company has sales offices in the US, Europe, Dubai and Japan. Also a network of non-exclusive distributors, that may be considered a resource or a customer, again with significant bargaining power given that OSPN is just another competitor in the market.

So for the four aspects considered, competitors, customers, resources and distributors, OSPN is not in the best bargaining position with any of them.

OSPN’s industry is definitely growing, particularly pushed in the financial sector by the move towards mobile applications. This movement requires significant investment in authentication and security. The company also got a temporary boost during the pandemic from work from home security requirements.

Maybe because of a growing industry, OSPN has been able to grow revenues and gross profits at a decent level. The process seems to have reached a limit somewhere between 2015 and 2017, with difficulties growing since.

Management was able to grow gross profits anyway, as the chart above shows. Unfortunately, the same is not true for SG&A expenses, which grew faster than gross profits for the past decade. Added to fast growing R&D expenses, particularly after 2018, it resulted in OSPN running into negative earnings territory.

In my opinion, net earnings should not be the only profitability gauge for a technological company. The reason is that net earnings penalize investments in non physical assets, like R&D expenses. Those investments should translate to increased profitability in the future. Of course, one has to also consider how productive those investments are, and if they generate new markets or are only a defense mechanism against losing existing markets.

Therefore another important profitability gauge is how much money can the company spend in R&D. This can be calculated as gross profit minus SG&A minus depreciation and amortization not included in CoGS minus interest expenses.

In the case of OSPN, the company has not had any debt in the past year, and has very little physical assets, therefore the calculation below is useful as a proxy for R&D capacity (I don’t know if there is a technical name for that).

In this spectrum, the company did not perform very great either, particularly after 2015. Consider the graph above, showing a significant increase in R&D expenses after 2018. Those expenses translated into higher R&D capacity for some time, but then that new capacity was lost. The increased R&D expenses did not translate into higher capacity, meaning that somewhere the company was not allocating expenses efficiently.

Of course, R&D capacity is only valid as long as it is sustainable. OSPN has not used debt or equity issuance as financing mechanisms, therefore whatever R&D expenditure the company generated was sustainable as long as it was cash flow sustainable. The chart below shows CFO before changes in working capital. CFO before WC shows how much cash the company had after spending on R&D. If R&D expenditure is unsustainable, this should show a consistent negative figure.

Changes In Strategy

Based on stagnant earnings, falling profits and an underperforming stock, OSPN started receiving the recommendations of activist investors from Legion Partners holding about 8% of the company’s stock. The activists’ main questioning was that the company was too slow in moving towards a recurring revenue model based on SaaS and cloud.

After two years of contesting, Legion was able to generate changes in most management and board positions, including a new CEO and President. When announcing its new CEO, OSPN announced a new strategic plan that was explained in May during the company’s investors day.

The strategy will divide the company in two segments. Security solutions will concentrate most of the current products, including Digipass. It currently generates 80% of revenue and the strategy will use it as a cash cow, with low growth. The cash generated by security solutions will be used to grow digital agreements, currently generating 20% of revenue, specializing in the complete process of high value authentication and agreement.

The company will concentrate on high value transactions, meaning highly regulated industries with valuable, sensitive contacts with their customers. These industries are mainly banks, financial services, insurance, government and healthcare.

The new strategy also includes reducing personnel expenses, with the headcount falling on 1Q22. Out of $2.7 million in severance payments in 1Q22, $1.6 million come from R&D, and the remaining from sales and administration. According to OSPN, this should drive costs down $12 million this year. The company also announced in the plan presented in May that it will continue reductions in personnel until 2025, expecting between $10 and $17 million in severance expenses that should drive costs down between $20 and $25 million yearly.

Going Forward

I am not particularly excited about the new strategy. It is difficult to recognize how it is different from the previous strategy, which was already moving towards SaaS and cloud. The strategy will also concentrate on the financial, healthcare and government industries, but that was already the company’s previous targetting as well.

Probably the changes have most to do with operations, efficiency and micro capital allocation. That is, not strategy but implementation and focus. This is difficult to gauge for the SEC filing reader like me, not being close to the company or being an expert on the industry. Hopefully, the company should show improvements in some of the performance metrics commented above.

Unfortunately, the change in segments will make comparability with previous periods harder, at least at the revenue and gross profit section. Maybe the company will also separate the operating expenses into segments, something the previous management did not. In that case, future comparability will be much better.

Regarding improvements, I would like to see R&D capacity grow, even if the company does not return to accounting-wise profitability. As long as CFO minus WC is positive, therefore R&D expenditure is sustainable, more R&D capacity is a better gauge of value generation for a technology company than accounting net earnings are, IMHO at least.

I would not be impressed by a sudden return to earnings profitability by curtailing R&D expenses. That can be done, at the expense of future profitability, and only to push stock prices higher for some time. In an ideal world, other expenses should go down, like SG&A, particularly the G&A part. Also the same expenses should prove more fruitful, increasing efficient use of resources.

Valuation

OSPN is not a quality company. From Porter’s framework perspective it operates in a competitive industry at almost every level. This, probably coupled with not the best management, showed up in every profitability measure we consider, particularly after 2015.

Now the company is trading at a market cap of about $500 million, compared to $43 million historical yearly average of R&D capacity and $24 million historic yearly average of CFO minus WC. I consider these two measures a good gauge of profitability.

In my opinion the multiples proposed are not good yet, for two reasons. First, in the current market context there are companies providing 10% dividend yields, so why should one invest in something that only promises less than 10% R&D yield if things go well. Second, OSPN’s industry is competitive, and therefore a return to the historical average is not guaranteed.

For those reasons, I rate OSPN as neutral. However, I will continue following it in future quarters to see how the new management does.