Yes — for a business, security awareness training is tax deductible in Australia. A company, trust or partnership that pays for staff security training claims the full cost as a deductible operating expense in the year it is paid, quoted GST-exclusive. For sole traders and employees paying out of their own pocket, the training is deductible under the ATO's self-education and work-related training rules — but only when it connects to their current work activities, and training the employer reimburses is never personally claimable. This is general guidance, not tax advice: confirm the treatment with your accountant before lodging.
TL;DR
- Businesses can claim staff security awareness training as an ordinary operating expense in the year it is paid, GST excluded.
- The former 20% small business skills and training boost ended on 30 June 2024 — the underlying training cost remains deductible as normal.
- Sole traders and employees claiming out-of-pocket costs fall under the ATO's self-education rules, and the first $250 of certain self-education expenses is not deductible.
- Reimbursed training is never deductible in the individual's return — the business claims it instead.
- Records decide the claim: keep the invoice, and keep training completion records that show the business connection.
Is security awareness training tax deductible for a business?
Yes. The ATO's guidance on deductions for other operating expenses (last updated 1 October 2026) states that operating expenses for the everyday running of a business are generally deductible in the same income year you incur them. Staff security awareness training sits squarely in that bucket: it is a recurring software-and-services cost incurred in carrying on the business, directly related to protecting the data and systems the business earns its income with.
In practice that means:
- The subscription is an operating expense. Per-seat training platforms bill like any other software subscription — per user, per month or per year — and the full GST-exclusive amount is claimable in the year it is paid.
- GST comes off first. If your business is registered for GST, claim the GST-exclusive portion; the GST is claimed separately via your BAS.
- Records back the claim. Invoices in the business name, plus a note of what the spend was for, are what an accountant or a review wants to see.
The same logic covers related spend: phishing simulation campaigns, gap assessments and compliance reporting under the same platform all count as operating expenses of the business, for the same reason.
What about the small business skills and training boost?
From 2022 to 2024, eligible small businesses could claim an additional 20% bonus deduction on external training costs under the ATO's small business skills and training boost — for example, $700 on top of a $3,500 external training bill. That boost ended on 30 June 2024.
What did not end is the underlying deduction: the training cost itself is still deductible as an ordinary operating expense, exactly as it always was. The boost was a bonus on top, not the basis of the claim. If a website is still advertising a 20% training deduction for 2026, that is the expired boost — check the dates before relying on it.
Is it deductible for a sole trader or employee paying themselves?
Different rules apply, and they are stricter. The ATO's self-education guidance (D4 work-related self-education expenses and the self-education expenses page) allows a deduction only where the cost was incurred to maintain or increase the knowledge, skills or capabilities needed to earn income in your current employment activities.
That covers a genuine security training need: a bookkeeper paying for invoice-fraud awareness, an MSP owner training to deliver security services, an office manager who handles payroll. It does not cover training aimed at qualifying for a new career, or study with only a personal-interest connection.
The rules that bite:
- Reimbursed training is out. If your employer pays the fees or reimburses you, you cannot claim a deduction — the business claims it instead.
- A $250 reduction applies to certain expenses. For some self-education claims the ATO reduces the deductible amount by the first $250; the ATO's self-education expenses calculator works out how the reduction applies to your mix of expenses.
- Records scale with the claim. A total work-related claim of $300 or less needs records showing how you calculated it; above $300, written evidence such as receipts or invoices is required for every expense.
- Eligible formats are broad. Courses at educational institutions, courses by professional or industry organisations, work-related conferences and seminars, and self-paced learning all qualify when the work connection exists.
Why deductibility varies
- Who pays. The business claims what it pays; the individual claims only what they pay themselves and were not reimbursed for.
- Purpose. Training that maintains or improves skills for current work is deductible; training aimed at a new career is not.
- Entity type. Companies and trusts claim operating expenses; sole traders and employees claim under the self-education rules with their tighter tests.
- GST registration. GST-registered businesses claim the GST-exclusive amount and recover the GST separately.
- Records. No invoice, no claim — and above $300, written evidence for every expense.
What a year of training costs against what it offsets
Context matters when the question is whether the deduction is worth taking. Human-layer training commonly runs a few dollars per user per month — compare security awareness platforms on automation and reporting rather than on headline price. Against that, ASD received more than 84,700 cybercrime reports in FY2024-25 — one every six minutes — with a self-reported average cost of $56,600 for small businesses (ASD Annual Cyber Threat Report 2024-25). A deductible subscription priced to protect against a $56,600 event is an easy case to make to a board, an insurer or a partner.
If you are not sure whether the human layer or the technical layer deserves the spend first, a security gap assessment tells you which control the next dollar should buy — and that assessment is itself a deductible operating expense.
How to keep the records that prove the claim
The deduction is only as good as the paperwork behind it:
- Invoice trail. Every platform invoice, GST-exclusive, in the business name, filed against the year it was paid.
- Completion records. An exportable training log showing who completed what and when — the record that also answers an auditor, an insurer or an enterprise customer. On a security awareness training programme these completion exports come out of the reporting suite; ongoing human risk evidence lives in human risk reporting.
- Business connection. A one-line note of why the spend exists — protecting client and business data — keeps the operating-expense character of the claim obvious if it is ever questioned.
For a sole trader claiming under the self-education rules, keep the same documents plus the calculation of any $250 reduction the ATO applies.
FAQ
Is security awareness training tax deductible in Australia? Yes — for a business it is deductible as an ordinary operating expense in the year it is paid, GST excluded. Sole traders and employees claim under the self-education rules when the training connects to their current work.
Can I claim the 20% skills and training boost in 2026? No — the small business skills and training boost ended on 30 June 2024. The training cost itself remains deductible as a normal operating expense.
Is the GST claimable too? GST-registered businesses claim the GST separately on their BAS and deduct the GST-exclusive amount; the GST-exclusive figure is the deductible portion.
My employer paid for the course — can I claim it? No. Training the employer pays for or reimburses is not claimable by the individual; the employer claims it as a business expense.
What is the $250 reduction on self-education expenses? For certain self-education claims the ATO reduces the deductible amount by the first $250 — the ATO's self-education expenses calculator applies the reduction to your specific expenses.
Are phishing simulations and gap assessments deductible as well? Yes — as operating expenses of the business, on the same basis as the training subscription, when they are incurred in carrying on the business.
One last thing
The deduction is the smaller prize. The larger one is that a training line item with completion records attached is also the evidence an insurer, an auditor and an enterprise customer keep asking for — one spend, two jobs.