Cybersecurity – Are there any tax breaks for my business?

Cybersecurity is now at the front of mind for many businesses, given the recent cyber-attacks at Optus, Medibank and Woolworths with potentially sensitive data stolen from millions of Australians. A challenge for many small to medium-sized enterprises (SMEs) is applying the resources required to protect their businesses and their customers from cyber-attacks.

This article highlights two proposed tax concessions that are now being actioned by the current Government. The tax concessions are targeted at SMEs with aggregated turnover of less than $50 million that undertake expenditure relating to technology and skills training.

In particular, the following measures are being introduced:

  • Technology Investment Boost
  • Skills and Training Boost

While these measures are not targeted solely at cybersecurity expenditure, the concessions can potentially be applied to provide a tax break for SMEs when they undertake certain expenditure relating to cybersecurity protection and associated external training.

As noted above, one of the main requirements is that the SME’s aggregated turnover is under $50m. Further details are explained below.


Technology Investment Boost

Under the Technology Investment Boost, a 20% bonus tax deduction is available for eligible expenditure of up to $100,000 – incurred on expenses, or on the acquisition of depreciating assets for the purposes of your digital operations or digitising your operations.

Examples of qualifying expenditure can include expenditure on:

  • Cyber Security – cyber security systems, backup management and monitoring services
  • Digitising Operations – computer and telecommunications hardware, software, internet costs, systems and services that form and facilitate the use of computer networks
  • E-Commerce – e-commerce services and equipment such as subscription to cloud based services, advice on establishing e-commerce platforms, digital inventory management and portable payment devices
  • Social Media – digital media and marketing, including expenditure on web page design services

Where an SME can show it has incurred qualifying expenditure, the following points should be noted:

  1. As mentioned above there is a maximum $100,000 cap in qualifying expenditure for each eligible period.
  2. For most SMEs there will be two eligible periods with the first period being part of the Financial Year (FY) 2022 income year from 29 March 2022 to 30 June 2022, and the second eligible period being from 1 July 2022 to 30 June 2023 for the FY23 income year. This means SMEs with 30 June year ends will be eligible for a maximum bonus deduction of up to $20,000 for each eligible period. The eligible period may vary for SMEs with substituted accounting periods.
  3. The 20% bonus deduction covering each eligible period will in most cases be claimed in the SME’s FY23 tax return unless the SME is an early balancer – in which case any bonus deduction is claimed in the FY24 return.
  4. If the expenditure is on a depreciating asset, the asset must be installed or ready for use before 1 July 2023. If the asset is in-house software allocated to a software development pool, such assets do not qualify.
  5. Certain kinds of expenditure – such as salary and wage costs, financing costs, capital works, and training and education costs – do not qualify. That said, training and education costs may otherwise qualify for the Skills and Training Boost – see below.

Skills and Training Boost

Like the Technology and Investment Boost, the Skills and Training Boost also provides a 20% bonus tax deduction for certain expenditure. In particular, the 20% bonus tax deduction under the Skills and Training Boost is available where eligible expenditure is on external training for an SME’s employees.

The key criteria that must be met for expenditure to qualify for the Skills and Training Boost are as follows:

  1. The expenditure must be for training employees. This means that training expenditure for non-employee business owners such as sole traders, independent contractors or partners in a partnership does not qualify.
  2. The training must be provided by a registered training provider within the scope of the provider’s registration. On-the-job training costs do not qualify.
  3. The expenditure must be incurred between 29 March 2022 and 30 June 2024.
  4. The arrangement or enrolment of the relevant training is entered into after 29 March 2022.


Training expenditure can also include costs incidental to training provided it is charged by the registered training provider. This could include, for example, the cost of books or equipment required for the training and charged to the SME by the registered training provider.

In addition, provided the training is within the scope of the registered training provider’s registration, there is no requirement for employees to obtain a formal qualification.

Unlike the Technology and Investment Boost, there is no spending cap for eligible expenditure under the Skills and Training Boost.

There will be similar timing rules to claim the bonus deduction under the Skills and Training Boost as described for the Technology and Investment Boost.

Take aways

It is noted that the window to claim the Technology Investment Boost is small. There is just under seven (7) months remaining for businesses to take advantage of the bonus deduction. SMEs should therefore start planning early for their cybersecurity and other technology and investment expenditure in order to meet the 30 June 2023 deadline.

In respect of the Skills and Training Boost, it will be important for SMEs to ensure training providers are registered and the training is provided within the scope of their registration. Businesses can check whether training is within the scope of a registered provider’s training at

SMEs may also wish to consider prepayment strategies to ensure planned expenditure that qualifies for either the Technology Investment Boost or Skills and Training Boost meets the relevant timing deadlines.

It should also be noted where an SME undertakes research and development (R&D) expenditure, the bonus deductions claimed under either the Technology and Investment Boost or the Skills and Training Boost will not affect the amount of the R&D tax offset.

Cyber attacks are a real and present danger.

There have been many recent examples where businesses and their customers have been crippled and held to ransom by cyber criminals. Cyber Insurance is vital in today’s environment. The complexity of policies means that expert knowledge and advice should be sought to help you choose the most suitable Cyber Insurance for your business.

To discuss Cyber Insurance for your business – make a time for a chat with a Bentleys business advisor. You can also click here to find out more about Bentleys Insurance Services.

Disclaimer: This information is general in nature and should not be relied on as advice. It does not take into account the objectives, financial situation or needs of any particular person. You need to consider your financial situation and needs and seek professional advice before making any decisions based on this information.