Yubico
Yubico makes YubiKey hardware security keys for phishing-resistant login.
On the record
Checkpoint: FIPS 140-3 federal compliance deadline and first post-mandate bookings report
The call
Yubico's certified hardware still locks in government and high-security buyers, but free platform passkeys are eating the broader market faster than new mandates are refilling it.
Yubico sells physical security devices that prove who you are when logging into sensitive accounts. Banks, governments, and large companies use them because they meet strict safety rules and are hard to hack. The company is not going away, but it faces two problems: its sales growth has flattened in the last year, and Apple, Google, and Microsoft are giving away similar technology built into phones and computers for free. The real question is whether big companies will stick with Yubico's paid hardware when free alternatives exist, or whether new government rules and AI companies adopting security keys will push enough fresh business their way to restart growth.
Why
01
AI pressure: OpenAI Advanced Account Security mandate. iCloud Keychain, Android/Chrome passkeys and Windows Hello give away free passwordless login, squeezing consumer and mid-market bookings. Could AI do the core job? Unlikely.
02
Bigger players: Apple, Google, Microsoft free OS-native passkeys. iCloud Keychain, Android/Chrome passkeys and Windows Hello give away free passwordless login, squeezing consumer and mid-market bookings. Could a giant copy it? Probably.
03
What protects it. Government certifications like FIPS 140-3 and Common Criteria that software passkeys cannot legally satisfy for regulated buyers.
What would change this call
Yubico reports Q2 2026 bookings growth YoY (expected around Aug 2026). Would show FIPS 140-3 and OpenAI mandates are converting to new demand, reversing platform-passkey erosion.
Scale of enforcement under OpenAI's Advanced Account Security hardware-key mandate (began June 1, 2026). Would show whether high-profile partner mandates translate into material new-seat volume.
Federal agency compliance activity ahead of the Sept 21, 2026 FIPS 140-3 cutover deadline. Would show whether the regulatory catalyst produces a bookings spike or gets absorbed without much new revenue.
Scale of enforcement under OpenAI's Advanced Account Security hardware-key mandate (began June 1, 2026). Would show whether high-profile partner mandates translate into material new-seat volume.
Federal agency compliance activity ahead of the Sept 21, 2026 FIPS 140-3 cutover deadline. Would show whether the regulatory catalyst produces a bookings spike or gets absorbed without much new revenue.
Key numbers
- Q3 2025 bookings fell 17% YoY
- ARR grew 32% YoY in Q3 2025
- Over 40 million YubiKeys sold cumulatively
Named risks
- New bookings down 7.6% then 17% YoY across two straight quarters signaling structural passkey erosion.
- CEO transition (Dec 2025) coincides with critical FIPS 140-3 and OpenAI catalyst window through 2026.
- Unpatchable EUCLEAK side-channel flaw affects pre-5.7 firmware YubiKeys with no formal replacement program.
- Revenue concentration in regulated government/enterprise segment while consumer/mid-market softens.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Apple, Google, Microsoft (OS-native passkeys) | gaining on | Bookings fell 7.6% YoY Q2 2025, then 17% YoY Q3 2025 as free passkeys spread |
| Google Titan Security Key | contesting | Direct hardware key rival named among top alternatives, 2026-04-11 listing |
| Feitian Technologies | contesting | Cited as a leading hardware-key alternative to YubiKey in 2026 comparisons |
| OpenAI (Advanced Account Security) | gaining on | Partnered rather than competed, mandate takes effect 2026-06-01, boosting Yubico volume |
Questions people ask
- Is Yubico profitable in 2025?
- Yubico does not disclose net profit publicly in the material reviewed, but FY2025 net sales were SEK 2.2bn (as of 2025-12-31) and ARR grew 32% YoY in Q3 2025, even as new bookings fell 17% YoY that same quarter, per company investor materials.
- Could AI replace Yubico's YubiKey hardware?
- No. Yubico's YubiKey is a physical hardware root of trust that AI/software cannot replicate; the company itself frames AI-driven phishing as a demand driver, and OpenAI mandated hardware keys for high-risk ChatGPT/Codex users starting June 1, 2026.
- Who is Yubico's biggest competitor?
- Apple, Google, and Microsoft pose the biggest structural threat by shipping free OS-native passkeys (iCloud Keychain, Android/Chrome passkeys, Windows Hello) that erode consumer/mid-market demand; Yubico's bookings fell 17% YoY in Q3 2025 amid this pressure.
- Who owns Yubico?
- Yubico is publicly traded on Nasdaq Stockholm (ticker YUBICO, OTC ADR YUBCF), having gone public via reverse merger on September 20, 2023 and uplisted to the Main Market on December 5, 2024. Co-founder Stina Ehrensvard remains on the board; no single controlling parent.
- Did Yubico have layoffs recently?
- No layoffs are documented in the reviewed material; instead Yubico saw a leadership change when longtime CEO Mattias Danielsson stepped down on December 17, 2025 after 16 years, with COO Jerrod Chong appointed acting CEO.
- Is Yubico losing market share to free passkeys?
- Signs point to erosion at the consumer/mid-market edge: Yubico's new bookings fell 7.6% YoY in Q2 2025 and 17% YoY in Q3 2025, even as enterprise ARR held up with 32% YoY growth, per company Q3 2025 investor presentation dated 2025-11-12.
Timeline
- 2026-06-17YubiKey 5 FIPS Series and YubiHSM 2 FIPS upgraded to FIPS 140-3 validation (Certificate #5291)
- 2026-05-04Q1 2026 interim report refers to Jerrod Chong as CEO, no longer 'acting'
- 2026-04-30Yubico announces OpenAI partnership bundling YubiKeys with Advanced Account Security
- 2026-02-10YubiKey 5 CCN Series certified for Spain's CCN/CPSTIC catalog with ENS Alta rating
- 2025-12-17CEO Mattias Danielsson steps down after 16 years; COO Jerrod Chong named acting CEO
- 2025-11-12Q3 2025 results show bookings down 17% YoY while ARR grew 32% YoY
- 2025-08-14Q2 2025 results show bookings down about 7.6% YoY
- 2024-12-05Yubico uplists to Nasdaq Stockholm Main Market
- 2023-09-20Yubico begins trading on Nasdaq First North via reverse merger with ACQ Bure
Head to head
Revision history
21 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- About Yubico, Yubico
- Q3 25 Yubico presentation (2025-11-12)
- Interim Report Q1 2025 (2025-05-13)
- Q2 25 Yubico presentation (2025-08-14)
- Presentations Interim Report Q1 2025 (2025-05-13)
- Introducing Advanced Account Security for ChatGPT and Codex (2026-04-30)
- YubiKey 5 FIPS Series and YubiHSM 2 FIPS are now FIPS 140-3 validated (2026-06-17)
- Jerrod Chong, Yubico's Chief Operating Officer, appointed as acting CEO (2025-12-16)
- Interim report January, March 2026, Yubico (2026-05-04)
- Public Comps and Valuation Multiples (2026-07-14)
- YUBICO Number of Employees (2025-12-30)
- Yubico Announces Availability of the YubiKey 5 CCN Series (2026-02-10)