SR&ED in cybersecurity
Behavioural detection, applied cryptography, malware analysis, false-positive reduction: cybersecurity is one of the few fields where technological uncertainty is structural. SR&ED is built for exactly this kind of work.
- Detection, correlation and false-positive reduction
- Applied cryptography and protocols
- Malware analysis and reverse engineering
SR&ED applied to cybersecurity
SR&ED is Canada's federal R&D tax credit. A Canadian-controlled private corporation recovers up to 35 % of its qualifying expenditures as a refundable cash payment, on a base of up to $6M per year; in Québec, the CRIC adds 30 % on the first $1M. In cybersecurity the difficulty is not demonstrating uncertainty — it is everywhere — but documenting it without exposing sensitive information, and separating research from the operation of a monitoring service.
- 01
The false-positive rate is a research target
Driving a false-positive rate below a threshold that known approaches cannot reach, without degrading detection, is a measurable research problem. It is also one of the easiest files to defend, because it produces curves.
- 02
The security operations centre is not SR&ED
Monitoring, triaging and responding to incidents is a service. Designing the method that detects a class of attacks the market does not detect is experimental development. Both activities often share the same team, which makes the time split decisive.
- 03
Documenting without exposing
An SR&ED file is defended with measurements, hypotheses and test results — not with customer data or operational detail. The evidence is built on test sets and metrics, which resolves the confidentiality question by construction.
Examples of eligible projects
Work that commonly qualifies among our clients in this sector. This list illustrates; it does not enumerate. A project absent from it is not a project excluded.
Commonly qualifying in this domain
- Behavioural detection and anomaly models
- Reducing the false-positive rate at constant detection
- Automated malware analysis and deobfuscation
- Applied cryptography and post-quantum migration
- Container and software supply chain security
- High-throughput correlation over log streams
The sector trap: claiming compliance. Obtaining a certification, running an audit or applying a recognised framework is compliance work, not SR&ED. What qualifies is the mechanism you had to design because the existing controls did not hold the constraint.
Frequently asked questions
A penetration test delivered as a service, applying known techniques to a customer environment, is not SR&ED. Developing a method or a tool capable of discovering a class of vulnerabilities existing tools do not find is experimental development, and it is claimable — including when the research does not succeed.
By documenting the method rather than the incidents. An SR&ED file is built on the hypothesis tested, the test protocol, the test data sets and the measurements obtained — never on customer data or operational detail. In practice this confidentiality constraint produces a better file, because it forces you to write down what the CRA actually asks for.
Threat tracking and intelligence production are monitoring and service activities, generally excluded. What qualifies is the engineering that follows: designing a detection technique, a deobfuscation mechanism or a model that generalises beyond known samples.
Training a model with established methods on clean data is not, in itself, SR&ED. Eligibility appears when the problem resists: extreme class imbalance, adversarial drift, a latency or explainability constraint that no known approach satisfies. Those obstacles, and the trials run to overcome them, are what make up the file.
Hubvention is a Canadian firm specialised in public R&D funding. In cybersecurity our contribution is twofold: cleanly separating research from service delivery, and building evidence from measurements rather than from material you cannot disclose.