The types of software development that counts as research and development is incredibly narrow given the fact software development contains the word development. Section 174 of the Code, but more importantly, the regs associated with that section are very particular about what is and is not deductible.

For example, developing windows 11 might count as R&D up until it ships. Spending a decade supporting it, doing bug fixes, and patching security holes in the already-shipped product would not count as research or development.

This “the research is done when the product shipped” might work for tangible objects but it does not seem coherent given the way the software lifecycle works.

It might be wise to revisit this; giving companies a tax break when they do security upgrades after release might be a good way to incentivize more secure software.