Cybersecurity companies — firms that develop security products, tools, or services — may perform activities that warrant analysis under the federal R&D tax credit. This page explains what development work may be relevant. It is educational and is not individualized advice. For the foundational framework, see our page on qualified research.
What R&D May Look Like in Cybersecurity
Cybersecurity development may involve threat detection, analysis, response systems, cryptographic methods, and security architecture. Work directed at resolving genuine technical uncertainty in these areas may warrant review. Routine security operations, monitoring, and configuration do not, by themselves, constitute qualified research.
Industry-Specific Examples of Technical Development
- Developing threat detection or analysis algorithms to achieve a specified accuracy or performance target where the appropriate approach is uncertain.
- Developing response or mitigation systems to achieve a specified performance or capability target where the appropriate design is uncertain.
- Developing or evaluating cryptographic methods to meet a specified security or performance target where the appropriate approach is uncertain.
- Developing security architectures to achieve a specified protection target where the appropriate design is uncertain.
- Developing approaches for new or evolving threats where the appropriate method is uncertain.
- Developing analysis or processing approaches to handle scale or complexity where the appropriate approach is uncertain.
Technical Uncertainty Examples
- Whether an alternative detection algorithm can achieve a specified accuracy target at scale.
- Whether a new response system can achieve a specified performance target.
- Whether an alternative cryptographic approach can meet a specified security and performance target.
Process-of-Experimentation Examples
A process of experimentation may involve testing alternative detection algorithms and measuring accuracy and performance, testing alternative response approaches and evaluating results, or benchmarking alternative cryptographic methods and measuring performance.
Potential Business Components
Potential business components may include a new or improved security product, a new or improved detection or analysis algorithm, a new or improved response system, a new or improved cryptographic method, or a new or improved security architecture.
Employee and Contractor Work
Employees whose work may warrant analysis include security engineers, software developers, data scientists, and researchers. Contractor work may include outside developers or researchers performing development work on behalf of the company.
Activities That Generally Require Caution or May Not Qualify
- Routine security monitoring and operations.
- Configuration of off-the-shelf security tools.
- Routine incident response and remediation.
- Ordinary troubleshooting or debugging.
- Simple integration of existing security products.
- Market research without a technical development question.
Documentation That May Help
Records that may help include algorithm development records, detection-accuracy test results, performance benchmarking data, and records connecting personnel to specific development projects.
Example Hypothetical Project
The following is a hypothetical example for illustration only.
A cybersecurity company is developing a threat detection algorithm intended to achieve a specified accuracy target at a higher scale than existing approaches. The technical uncertainty is whether an alternative combination of algorithm, data-processing approach, and architecture can achieve the specified accuracy and performance target. The team tests alternative algorithms, measures accuracy and performance, and evaluates the results. Professional review is still needed.
Questions to Ask Internally
- What specific product, algorithm, or architecture was being developed or improved?
- What technical uncertainty existed at the outset?
- How does this differ from routine security operations?
Relationship to the Four-Part Test
The four-part test applies the same way as in any industry. The work must satisfy all four elements: permitted purpose, technological in nature, elimination of uncertainty, and process of experimentation. For more on software activities generally, see our page on software development and the R&D tax credit.
Key Takeaway
Cybersecurity companies may perform activities that warrant analysis under IRC §41 — particularly work involving threat detection, analysis, response systems, cryptographic methods, and security architecture. Routine security operations do not automatically qualify. Because these determinations are fact-specific, professional review is appropriate. For related industries, see software development and the R&D tax credit and SaaS companies.