Corporate Tax for Cybersecurity Firms in the UAE

Cybersecurity firms blend recurring monitoring revenue with project-based testing and consulting. Taxable income aggregates all three at the standard bands, with the timing following delivery: retainers rateably, tests on completion, consulting on milestones.

The cost base is specialist-heavy: analysts, testers and consultants with expensive certifications, plus threat-intelligence feeds, tooling licences and lab environments. Certification costs that maintain the team's ability to deliver are deductible staff development.

Annual SOC contracts paid upfront are spread over twelve months. A penetration test delivered across the year-end is recognised when the report is delivered, with costs accrued to match. Incident-response work is recognised as performed, which can bunch revenue unpredictably.

Technology companies compute taxable income from accounting profit adjusted under Article 20 of Federal Decree-Law No. 47 of 2022, like everyone else, but their economics create distinctive questions. Subscription revenue is spread over the subscription term, project revenue follows delivery milestones, and development spending may be capitalised as an intangible asset or expensed, each with a different tax timing outcome.

People costs dominate: developers, product and support salaries, visas and equity incentives. Infrastructure costs, cloud hosting, licences and data charges, are deductible as incurred. Where a UAE company pays a foreign related party for IP, platform access or development services, Article 34 requires arm's length pricing, and the UAE currently applies a 0% domestic withholding tax rate on the outbound payment.

Deductions that matter most for cybersecurity firms:

• Analyst and tester salaries, visas and certification costs are deductible.
• Threat-intelligence feeds, tooling and lab environment costs are deductible.
• Specialist subcontractor invoices for work performed are deductible.

Security work often needs cleared or certified specialists the firm does not employ, engaged per engagement. Their invoices are deductible where they evidence real work, with engagement letters and deliverables behind them. 'Consultancy fees' paid monthly to an individual who works full-time hours for the firm looks like disguised employment and should be structured honestly.

Certification and clearance costs sit on the boundary between staff development and personal benefit. Certifications the business requires for its contracts are deductible; qualifications the individual keeps for life with no business link are weaker. Put the business requirement in writing before paying.

Tech companies repeatedly stumble on the same points: recognising annual subscriptions upfront instead of over the term; expensing development costs that the accounts capitalise, or vice versa; paying foreign related parties for IP without transfer-pricing support; and assuming a free zone tech licence means 0% on everything, when consumer and mainland revenue is taxed at 9%. Pre-revenue startups also forget that losses must be tracked properly to be carried forward under Article 37.

Technology sits in the most nuanced free zone position of any sector. A Qualifying Free Zone Person can earn 0% on qualifying income, which for tech includes transactions with other free zone persons, qualifying intellectual property income under the nexus approach, and certain headquarter or treasury services (Ministerial Decision No. 229 of 2025). But software sold to mainland customers, SaaS subscriptions from UAE consumers, and services to natural persons are taxed at 9%.

The practical discipline is revenue segmentation: tag every invoice by customer location and type, because the 0% and 9% computations run on different slices. IP income needs the nexus paperwork showing qualifying R&D expenditure; without it, the 0% claim on IP income fails. Many tech firms find the mainland 9% simpler than maintaining the segmentation, which is a legitimate commercial choice.

Cybersecurity services to other free zone persons can be qualifying income at 0% for a Qualifying Free Zone Person; services to mainland clients and government entities are taxed at 9%.

A firm recognises AED 3.4 million: retainers AED 2 million, tests AED 900,000 and consulting AED 500,000. Payroll is AED 1.7 million, subcontractors AED 500,000, tooling AED 200,000 and other costs AED 350,000:

Revenue exceeds AED 3 million so Small Business Relief is unavailable. The retainer spreading is what keeps the AED 3.4 million honest; upfront recognition would have pulled next year's retainer income into this period.

For help applying these rules to your own business, including registration, computations and filing, contact us for a quote.