The years following the COVID re-open has led to fewer IPOs and VC checks for American tech startups, even those that offer core benefits like cybersecurity. This anemic funding cycle coupled with tariff uncertainties has dampened business leaders' confidence in their forecasts. But help is coming in the form of financial lifelines from the One Big Beautiful Bill that businesses can tap for R&D and construction investments. 

✅  A gross receipt provision increases the threshold for manufacturers from $25 million to $80 million for 2025 and to $100 million in 2026, allowing more companies to use simpler accounting methods, benefits among which include deferring tax liability until the vendor receives payment. Qualified businesses also receive exemptions from certain inventory accounting and uniform capitalization (UNICAP) rules. A cybersecurity company that qualifies as a manufacturer, which hardware and sometimes software products could allow, can benefit.

✅  A provision depreciating qualified production property allows businesses to deduct 100% costs spent on "qualified production property" in the year it is placed into service. The definition covers nonresidential real estate in the U.S. (including U.S. territories) that is integral to production activity, which can include factories making routers and switches with security features, authentication tokens, intrusion detection systems, and trusted platform modules. Construction must begin after December 31, 2024 but before January 1, 2030 and the property must be in service before January 1, 2034.

Conversations with cybersecurity executives show optimism for the direction of these provisions and interest in the final form these provisions will take. The R&D deductions is the provision they expect to benefit the industry the most. All U.S. companies since 2022 have been forced to capitalize and amortize domestic R&D outlays over 5 years. The elimination of the multi-year deduction is a boon for cybersecurity vendors that typically invest 20-35% of revenue in R&D. The provision also incentivizes cybersecurity companies to keep R&D in America, which creates more tech jobs. 

"Restoring immediate R&D expensing could give cyber innovators the oxygen they need—cash today to fight tomorrow's cyber threats," said Bobby Wolfe, Co-Head of Cybersecurity Investment Banking, Houlihan Lokey. He sees the provision as well-timed for injecting liquidity into U.S. cybersecurity R&D as AI-driven threat actors are raising the innovation stakes. "Outcomes include accelerated product roadmaps, more cash-funded tuck-in acquisitions with the available cash, and margin tailwinds across the security software stack," he said. Sell-side models indicate that the deduction can increase FY25 free cash flow margins by 300-500 base points and cut GAAP effective tax rate by 2–3 points.

"The reconciliation package will be crucial to ensuring the U.S. remains a leader in global innovation and technology development. We urge lawmakers…to create a permanent extension for restoring research and development (R&D) expensing," said Jason Oxman, President and CEO of the Information Technology Industry Council (ITI), whose members include Cisco, Palo Alto Networks, and Zscaler. 

These reconciliation provisions give security companies financial lifelines to bring new cyber defenses to protect themselves and customers from cyber disruptions and theft. Defenders have the unenviable job of finding and securing every potential weakness. Their mission has evolved from keeping bad guys outside the castle walls to assume breach – including from malicious insiders – as the corporate network went hybrid and expanded exposure. While the AI boom is a force multiplier to detect and mitigate at scale, threat actors tap AI to scale malware coding and deep fakes. The attacks keep coming as bad actors seek better ways to infiltrate, disrupt, and steal from their targets. Funding security innovation is key to protecting our water, energy, financial, healthcare, technology, and other critical infrastructure systems.