Start for free
Language: EN

Accounting and invoicing for cybersecurity consultants

Penetration tests, security audits, training and incident response: cybersecurity consultants sell projects with a clear scope and standby contracts for emergencies. Saldiqo issues stage invoices, bills day rates and creates standby flat fees on schedule.

Updated:

What comes up for cybersecurity consultants

Projects with a clear scope

A pentest has target systems, period and report. That belongs in quote and invoice.

Standby for emergencies

Incident response contracts cost a monthly flat fee and day rates when used.

Travel and equipment

On-site jobs bring travel costs and equipment costs.

How Saldiqo helps

  • Stage invoices for projectsQuote, deposit at start, final invoice with the report.
  • Standby as a recurring invoiceMonthly flat fee on schedule.
  • Day ratesTime tracking and invoice from days.
  • Record travel costsReceipts by phone photo.

Typical invoice lines

Examples that often appear on invoices in this industry. You set the prices yourself.

  • Penetration test web application, 5 person days
  • Report and recommendations
  • Incident response standby, November
  • Emergency call-out, day rate
  • Awareness training, half a day
  • Travel costs as per receipt

Tax and invoicing in Ireland

What applies to invoices in Ireland, in short. As of October 2026.

VAT
Standard rate 23 %, reduced rates 13.5 % and 9 %, 4.8 % for livestock, and 0 %. Since 1 July 2026 a 9 % rate applies to restaurants, catering, hot takeaway food and hairdressing, excluding alcohol and soft drinks.
VAT registration
Registration is required above €42,500 a year for services and above €85,000 for goods, if at least 90 % of turnover comes from goods. Saldiqo leaves VAT off your invoices while you are below the threshold and shows how much room is left.
What goes on an invoice
Registered businesses show their VAT number. Sole traders and partnerships providing services show their tax reference number, or their full name and address, on invoices and receipts of €7 or more (section 885 TCA). Companies show their name, CRO number and registered office, and directors’ details on letters, order forms and the website.
Invoice timing
Issue a VAT invoice within 15 days after the end of the month in which the supply took place.
E-invoicing
From 1 November 2028 every business must be able to receive e-invoices. Issuing is phased in: first for suppliers to large corporates, from November 2029 for businesses trading B2B within the EU, and from 1 July 2030 under the EU VAT in the Digital Age rules. A PDF does not count as an e-invoice, and the technical specifications are not yet published.
VAT returns
VAT3 returns are filed every two months through ROS, by the 19th of the following month, or the 23rd when you file online through ROS. Saldiqo does not file returns, your accountant or ROS does.
Record keeping
Keep records for 6 years, longer while a review is open.
Late payment
Interest on late business payments is the ECB main refinancing rate (2.40 % in the second half of 2026) plus 8 points, so 10.40 %, plus fixed compensation of €40, €70 or €100 depending on the amount owed.
Getting paid
IBAN and BIC are on every invoice, plus a SEPA QR code (EPC) for banking apps that can read it.

Frequently asked questions

How do I bill a pentest?

With a quote, a deposit at start and a final invoice with the report.

Can I bill standby contracts automatically?

Yes. A recurring invoice creates the monthly flat fee on schedule.

Do cybersecurity consultants in Ireland have to charge VAT?

Once they are registered, yes. Registration is required from the sale that takes turnover over €42,500 a year for services or €85,000 for goods, where at least 90 % of turnover comes from goods. Below those limits Saldiqo leaves VAT off your invoices.

Do cybersecurity consultants in Ireland need e-invoicing?

Not yet. From 1 November 2028 every business must be able to receive e-invoices. The duty to issue them phases in from the same date for suppliers to large corporates and later for more businesses. PDF invoices do not count as e-invoices.

How long should cybersecurity consultants keep invoices?

Keep records for 6 years, longer while a review is open. You can store receipts digitally in Saldiqo. The legal duty to keep records stays with you.

Try Saldiqo for free

Write invoices, match payments, collect receipts and send reminders: free and without a trial period.

Start for free

This page for other countries

Related niches

More industries

All industries

As of October 2026. General information, not legal or tax advice, without guarantee. For your case ask your tax adviser.