Running a business as an IT professional: what I've run into since 2023

Nov 05, 2026 · Samantha Kloos-Kilkens

I founded Argus IT at the end of 2023. I knew what the work would be: security and identity, the same field as before, just without the layers of management. What I knew far less about was everything that comes with it once you don't just hire yourself out, but take on colleagues who go to work at clients.

In this blog I go through what I've run into over the past few years: first how the company took shape, then what changes when you take people on, and finally the market, from assignments, client contracts and cash flow to pressure on rates and protecting our name. The rules that come with having staff work at clients, such as the Wtta, pensions and the g-rekening, are in a separate blog. This is the Dutch situation, it isn't a manual, and I'm not a lawyer or a tax adviser. It's what I learned along the way.

A standing desk with two laptops and a monitor by a sunny window in the Argus IT office

How the company took shape

When I started, what I mainly knew was what the company should deliver: clients who are more than happy when we work for them, and colleagues who are paid according to the impact they have at those clients. Underneath that are two principles I don't negotiate on: quality and transparency. I also had an idea of what the company would look like, and I've had to adjust that idea a few times.

In the beginning I focused on projects for direct clients, as a business services provider, and I put a lot of effort into trainings. Those trainings turned out not to be economically viable. Preparation takes a lot of time, the margin is limited, a cancellation costs you revenue straight away, it scales badly and you constantly need new clients. I had put a lot of time and effort into it and still stopped. Kill your darlings: if something doesn't work, you stop and put your time into something else or something new, even if you've already invested a lot in it.

Switching and adapting quickly is part of running your own company, and the hard part is not losing your core along the way. For me the aim and those two principles have stayed the same, the form has changed. Argus IT is now a detachering company (we employ specialists who work on assignment at clients), and I'm a hundred percent behind the company as it stands now. Our specialists add something at a client, now and in the years ahead.

With that choice, Argus IT also became something different in the eyes of the law. As soon as you employ people who work at a client under that client's direction and supervision, Dutch law treats you as an uitlener, a company that hires out staff, even when the work is specialised security work. That comes with a whole list of obligations: your registration with the KVK (the Dutch Chamber of Commerce), the Wtta with a licence and a deposit, the SFU (the staffing industry fund), a mandatory pension fund, the g-rekening and the sector classification for employee insurance. There's enough to say about that for a blog of its own, so I put it in a separate one: From IT company to staffing provider.

Finding colleagues

With detachering as the business model, everything depends on the people. Finding good security and IAM specialists without a recruitment department is harder than I expected. What I mostly do is the direct approach on LinkedIn: actually searching myself for people with the profile we need and sending them a personal message.

I've also tried LinkedIn Recruiter, but I haven't got the hang of it yet. You can post vacancies for free or paid, and either way, whatever you set, you get a lot of responses from people who don't live or work in the Netherlands. You have to go through all of them before you get to the useful ones.

The best people are often not the ones you come across most easily. There are a lot of good IT people hidden away at an employer where they've been doing good work for years, without putting themselves forward much. You won't find them with a vacancy, you have to go and look for them.

What I'm thinking about now is advertising where the people I'm looking for actually are, such as Reddit and similar communities. I think I'm more likely to find them there than on a job site.

Becoming an employer

Once you've found someone, you become an employer, and that starts with the employment contract. You don't write one in five minutes. We started with contracts in days, four or five days a week. Less focus on hours and more on impact: I still like that idea, but because of the legislation and in practice it turned out to be impractical. We now offer contracts of 32, 36 and 40 hours. That number of hours is the colleague's own intention, and we look for an assignment to match. If you have a 32-hour contract but choose a 36-hour assignment anyway, we pay out the extra hours. That does have a legal side. Under article 7:610b of the Dutch Civil Code there's a legal presumption: if someone structurally works more hours than the contract says for three months, those hours are presumed to be the real working hours. In detachering, where a client sometimes simply expects 40 hours a week, that's something to keep an eye on.

Then you need to sort out what happens when things go wrong. As an employer in the Netherlands you continue to pay wages for two years when someone is ill, at least 70 percent. In a small company, one colleague who's off sick for a long time means you keep paying a salary with no revenue against it, plus the cost of getting them back to work. In that situation, sickness absence insurance is no luxury. We chose to pay 100 percent in the first year of illness, and set up the insurance to match.

After those two years the WGA comes into play if someone stays partially unable to work. As an employer you choose whether to leave that risk in the public scheme at the UWV, the Dutch benefits agency, or carry it yourself as an eigenrisicodrager, and then you're tied to it for up to ten years. For the employee there's the WGA gap: when the benefit moves to the lower follow-up benefit after a while, income can drop considerably. WGA gap insurance covers that and is something you can offer as an employer. We've taken it out for our colleagues.

On top of that you need professional and general liability insurance, and clients and brokers often ask for it in their contracts.

Our sickness absence insurance includes the occupational health service (arbodienst): you report someone sick in the insurer's portal and it goes straight to the arbodienst. Apart from insurance, as an employer you're also required to have an RI&E, a risk inventory and evaluation with an action plan. For a company where most of the work happens behind a screen that's manageable, but it does have to be in place.

The company car

Many IT people expect a company car, so as an employer you'll deal with that too. Before a lease company will work with you, you go through a financial assessment. What happens next differs per company. Ours approved us on that basis and gave us a budget: the amount of lease obligations they think we can carry. Within that budget we can lease cars new or second-hand, as many as we like, as long as the total stays below it.

Then comes the tax side. For an electric car first registered in 2026, the bijtelling (the taxable benefit for private use of a company car) is 18 percent of the first 30,000 euro of the list price and 22 percent of the rest. In 2027 that becomes 20 percent up to 30,000 euro, and from 2028 it's 22 percent without a cap, the same as for a petrol or diesel car. The percentage is fixed for 60 months from the first registration. If you temporarily drive another car, for example a replacement car while your own lease car is at the garage, the bijtelling of that car applies for that period, pro rata. You only avoid paying bijtelling twice if you actually hand in your regular car, keys and papers included, and record that in writing in the payroll administration.

For every car that's also used privately, commuting included, you correct the VAT you deducted on the car in the last VAT return of the year. Usually that's done with a fixed percentage of the list price including VAT and bpm (the Dutch car registration tax): 2.7 percent for a lease car or a car on which you deducted VAT at purchase, even when the employee pays a personal contribution, and 1.5 percent for a car bought without VAT deduction. With a complete trip log you may also use the actual private kilometres. From 1 January 2027, cars with emissions get an additional pseudo final levy of 12 percent of the list price, paid by the employer, also when a BV gives its director-major shareholder a car. Cars that were already provided before 2027 are exempt until 17 September 2030. On Prinsjesdag 2026 (the presentation of the Dutch budget) it was proposed to extend that to 1 January 2031, but that hasn't been adopted yet.

I drive a 2007 Volvo V50 myself, a youngtimer. The reason is simple: it always works. Once it didn't, when the radio died and a parasitic drain kept emptying the battery, and that was fixed by disconnecting the battery and reconnecting it. For a youngtimer the bijtelling is 35 percent of the current value instead of the list price. In 2026 the car has to be at least 16 years old for that. The Belastingplan 2027 (the 2027 tax plan) says that limit goes to 17 years in 2027 and to 20 years from 2028, with a temporary gap for cars from roughly 2008 to 2010, which are 17 in 2027 but not yet 20 in 2028. That proposal still has to pass both chambers of parliament, but a car from 2007 qualifies under every variant. Because my car was already provided before 2027, it falls under the transitional rules for the pseudo final levy.

Finding the right assignment

Then the other side: finding work for those colleagues. A good assignment has to meet more requirements than you'd think. The rate has to be right, the location has to be doable and the work environment has to be enjoyable and interesting, because you spend a fair number of hours a week there. And for enthusiastic IT people, the content of the assignment is often what matters most.

The hardest part is the balance between what you can already do and where you want to go. You get an assignment because you're good at something, that's what a client looks at. But if you only take assignments you're already good at, you stand still. My colleagues and I want to grow, so I look for assignments that fit what we can do and that also leave room to develop.

And sometimes there's no assignment for a while. That's the biggest risk of detachering with people on permanent contracts: the salary keeps running, even when there's no revenue against it. By now we've learned a lot about how to put forward a good offer and how this world works, and finding a new assignment then gets top priority. But that doesn't take eight or nine hours a day. The rest of the time we pick up projects, study for new certifications, write blogs for our website and build things for internal use.

Once the assignment is agreed, the contracts with the client come in. Many assignments go through a broker. That comes with a contract of its own and often a self-billing arrangement, where the broker issues the invoice on your behalf. Your bookkeeping has to be set up for that.

And then the data processing agreements. Clients send their standard version along and you don't sign that blindly. I came across one with unlimited liability for the processor. That's a risk a small company can't carry and can't insure either, so that's something to discuss before you sign.

Cash flow

You pay salaries on a fixed date every month, but the money for the hours only comes in weeks later: first you invoice, then the client's or broker's payment term runs, and part of it goes to the g-rekening, where it's blocked. That simply has to be in your planning. You need to understand exactly how the money flows and stay on top of it, because it goes wrong over the smallest things.

One example: a payment took two months to arrive because the client had transferred the wrong amount to the broker. As a result it didn't match the invoice, and the broker didn't communicate about it proactively. Our emails and calls were ignored. The difference was less than 100 euro, and the broker held on to our money for all those months.

The market in 2026

It's not an easy time to be doing this. According to the Talent Monitor by HeadFirst and Intelligence Group, the number of registered assignments in the second quarter of 2026 was about 42 percent lower than four years earlier, and each assignment gets more offers. The average realised hourly rate did still rise over that period, but with that much competition per assignment, I notice in conversations that rates are under pressure.

On top of that, the government is a big hirer of IT people, and budgets there are under pressure. The central government spent just over 3.2 billion euro on external hiring in 2025, a large share of it on IT. That was the first decline in years, of about 11 percent. According to the 2025 budget, the core ministries want to roughly halve their spending on external hiring between 2024 and 2027, from 607 to 268 million euro.

Since 1 January 2025 the Dutch tax authority has been enforcing the Wet DBA again (the rules on false self-employment), and you notice it. Clients have become more careful with external hiring. In a survey by Vereniging ZZP Nederland from early 2025, 59 percent of self-employed ICT professionals said they experienced negative effects of the Wet DBA, against 42 percent on average. That applies to me too. When I work at a client myself as DGA (director and majority shareholder), the Wet DBA assesses whether there's a relationship of authority in the same way as for a freelancer. That Argus IT is a BV with employees doesn't change that.

And then there's the Wtta, which affects the detachering side instead, and young companies in particular: anyone who hires out staff and hasn't been registered as an uitlener for four years by the end of 2026 has to pay a deposit of 100,000 euro when applying for the licence in 2027. How that works exactly is in the blog about hiring out staff.

Protecting our name

In a market with this many providers, you also want your name to be really yours. This autumn we came across a company in IT with a name that was very similar to ours. We had a lawyer send a formal demand letter, and so far it's gone very well: the other party responded quickly and constructively and is choosing a new name. What I took away from it is mostly about what you can do beforehand.

In the Netherlands your trade name is protected by the Handelsnaamwet (the Trade Name Act). You get that protection by using the name, not by registering it with the KVK. A younger name that's the same as yours or only differs slightly isn't allowed if it can cause confusion. So who was first counts, and you need to be able to show it. Keep your first invoices, registrations and other proof of use from day one. If you want more certainty, also register your name as a trademark with BOIP, the Benelux Office for Intellectual Property. That registration covers the whole Benelux for ten years, and after that you can renew it. Before you choose a name, search the KVK trade register and the BOIP trademark register, including names that look similar. And if you later come across someone who's too close to your name, don't wait, and bring in a lawyer who knows this field.

What I'd pass on to someone starting out

Decide early what your core is, and be prepared to change the form around it when something doesn't work. Arrange sickness absence and liability insurance before the first colleague starts, read contracts and data processing agreements yourself and be critical before you sign, build your cash flow into your planning, and look up your name in the KVK trade register and the BOIP trademark register before it goes on your website. If your colleagues are going to work at clients, read the blog about hiring out staff first, because that's where most of the obligations with a deadline are.

Written by an Argus IT expert

Want an expert like this in your team, or work like this yourself in security, IAM or cloud?

Samantha Kloos-Kilkens

Samantha Kloos-Kilkens

Samantha Kloos-Kilkens has worked in security and identity for more than ten years, eight of them at Microsoft in the Identity and Network Access product group. She founded Argus IT in 2023 and has a soft spot for the hidden gems in Entra ID. CISSP, CCSP, CISM, CCSK and Microsoft Certified Trainer.

Stay in the Loop

Subscribe to our newsletter for a friendly nudge whenever we publish a new article or have news to share.