Managed Security Costs, Price Drivers and 2026 Rules
GST, TDS and dollar pricing on cybersecurity services: 18% GST, reverse charge, OIDAR and section 393
How 18% GST, reverse charge on imported services, OIDAR, TDS under section 393 of the Income-tax Act 2025 and exchange rates change the real cost of managed security in India.
Managed security, VAPT and vCISO services bought from an Indian provider carry 18% GST on the invoice, which a registered business normally claims back as input tax credit. Platforms billed from abroad, such as some EDR, SIEM or email security subscriptions, usually arrive without Indian GST: a registered buyer then pays 18% IGST under reverse charge and claims credit, while an unregistered buyer is dealing with an OIDAR supplier that should charge GST itself. From 1 April 2026, TDS on payments to residents and non-residents sits in section 393 of the Income-tax Act, 2025. And a dollar price brings exchange-rate and card markup costs. This guide explains each layer with illustrative sums. It is part of the managed security pricing overview and is general information, not tax advice.
GST on security services
| Who bills you | GST position (general) | Input tax credit |
|---|---|---|
| Indian provider, same state | 9% CGST + 9% SGST on the invoice | Usually available to a registered business using it for taxable business |
| Indian provider, other state | 18% IGST on the invoice | Usually available |
| Supplier outside India, you are GST-registered | Import of services: you pay 18% IGST under reverse charge in GSTR-3B | Usually available, after paying the tax in cash |
| Supplier outside India, you are not registered | OIDAR supply to a non-taxable online recipient; the foreign supplier should charge GST | Not applicable |
Hardware such as firewall appliances is a supply of goods; check its rate and whether it is bought or rented in the service. Confirm rates on the CBIC GST site.
Worked example: reverse charge (illustrative)
A registered company buys a SIEM subscription billed from abroad at $6,000 a year. At an illustrative ₹88 per dollar, the value is ₹5,28,000. IGST under reverse charge = ₹5,28,000 × 18% = ₹95,040, paid in cash in GSTR-3B. If eligible, the same ₹95,040 is claimed as input tax credit, so the net GST cost is nil, but the cash is out until the credit is used. A business with exempt supplies may have to reverse part of the credit, which then becomes a real cost.
Exchange rate and card charges
- Rate used: banks and cards apply their own rate, usually with a forex markup.
- Renewal risk: a three-year plan is exposed to three years of rupee movement.
- Buffer: add 3–5% to dollar quotes when budgeting.
Illustrative example. $6,000 at ₹88 = ₹5,28,000. A 3% card markup adds ₹15,840. If the rupee is ₹92 at renewal, the same plan costs ₹5,52,000 before markup, ₹24,000 more. Use the renewal uplift calculator with the percentage set to your buffer, or the GST and FX price calculator with the markup in the charges field.
Ask whether the platform is available through an Indian entity or reseller billing in rupees. That removes FX risk and moves GST onto a normal tax invoice.
TDS on security service payments
From 1 April 2026, TDS on payments other than salary is consolidated in section 393 of the Income-tax Act, 2025, which replaced sections such as 194J and 195 of the 1961 Act. Sub-section (1) covers payments to residents; sub-section (2) covers non-residents.
For residents, the table in section 393(1), as published by the Income Tax Department, provides 10% on fees for professional services and royalty (other than film royalty) and 2% on fees for technical services, with a threshold of ₹50,000 a year per category. A higher rate applies where the payee has no valid PAN.
| Payment | Possible characterisation | Comment |
|---|---|---|
| Managed SOC or MDR from an Indian provider | Fees for technical services, or a contract for work | Depends on the contract; take advice once and document it |
| VAPT or vCISO by an Indian firm | Fees for technical or professional services | Commonly within section 393(1) above the threshold |
| Software subscription from an Indian reseller | Purchase of software or service, or royalty | Facts matter |
| Subscription paid to a non-resident | Section 393(2), subject to the tax treaty and facts | Take advice before paying |
Worked example: TDS on a VAPT (illustrative)
A firm pays ₹2,00,000 + ₹36,000 GST for a VAPT. If treated as fees for technical services at 2%, TDS is generally worked out on the amount excluding GST when GST is shown separately: ₹2,00,000 × 2% = ₹4,000. The firm pays ₹2,32,000 to the auditor and deposits ₹4,000. If treated as professional fees at 10%, TDS would be ₹20,000. Settle the treatment with your CA before paying.
Equalisation levy
The 2% equalisation levy on e-commerce supplies was withdrawn from 1 August 2024, and the 6% levy on online advertising from 1 April 2025. Confirm with your CA if you are reconciling older periods.
Checklist before paying a security invoice
- Is GST charged correctly (CGST + SGST or IGST), with your GSTIN on the invoice?
- For a foreign supplier, is reverse charge recorded in GSTR-3B?
- Is the TDS position documented?
- Is the rupee value recorded at the rate your bank used?
- Are hardware and services shown separately where the rates or treatment differ?
FAQ
Can an MSME claim GST credit on cybersecurity services?
Generally yes, if registered and the service is used for taxable business supplies, subject to the conditions and restrictions in the CGST Act.
Is a security subscription bought by card exempt from TDS?
No. The payment route does not decide TDS. Ask your CA once and apply the answer consistently.
Should we prefer rupee billing?
It removes exchange-rate risk and simplifies GST. It is one factor among scope and service quality, not a reason on its own to pick a provider.
Sources
- CBIC GST — GST rates, reverse charge and OIDAR
- GST Council — rate decisions and meeting recommendations
- Income Tax Department — Income-tax Act, 2025 and TDS under section 393
