Italy's Iperammortamento 2026-2028 Puts Cyber Purchases Inside the Tax Code

Introduction

A tax rule is not usually where cybersecurity headlines begin. But Legge 199/2025 makes security procurement part of a fiscal conversation, and that matters because budget design often decides which controls get refreshed, delayed, or left untouched.

The measure covers the 2026-2028 period and applies to digital and cybersecurity technologies produced in Europe. That is a narrow legal trigger, but it is still a notable one: public policy is now helping define which security investments are easier to justify on a balance sheet.

Fast Facts

• Legge 199/2025 creates an iperammortamento window for 2026-2028.
• Qualifying investments can receive incentive treatment up to 180%.
• The measure covers digital and cybersecurity technologies produced in Europe.
• The eligible amount is capped at 2.5 million euro.
• The case is about investment policy, not a breach, theft, or incident.

Conclusion

The lesson for readers is simple. Cybersecurity is not governed only by alerts, audits, and controls. It is also influenced by the tax rules that decide what gets bought and when. In this case, the important question is not whether the law creates a threat, but whether it gives defenders a faster path to modernize before weaknesses become expensive.

TECHCROOK

hardware security key: A small physical authenticator used for stronger login protection on email, cloud accounts, and admin portals. It is a common, ordinary security purchase that fits the article’s procurement theme, especially when teams are reviewing which cyber controls to upgrade or standardize.

Scheda Techcrook: hardware security key

WIKICROOK

• Iperammortamento: a tax mechanism that can increase the deductible value of qualifying investments.
• Capital expenditure: money spent on long-term assets such as hardware, software, or security platforms.
• Cybersecurity procurement: the process of selecting and buying security tools and services.
• Legacy systems: older technologies that remain in use and can be harder to maintain securely.
• Attack surface: the collection of points where a system or organization can be exposed to risk.