MSPs and IT service providers are a force multiplier for attackers: one compromise hits all clients simultaneously. NIS2 makes you directly liable.
of organisations simulate cyber incidents with ecosystem partners; the rest operate blind during a supply chain attack
Cybersecurity at ICT and managed service providers is about protecting both the provider's own environment and every client environment it can access. MSPs and IT service providers are a force multiplier for attackers: one compromise can hit all clients at once. B2B ICT service management is listed in NIS2 Annex I, implemented in the Netherlands through the Cyberbeveiligingswet (Cbw), which makes managed service providers directly responsible for their security. Clients in the financial sector also impose requirements stemming from DORA. The main threats are supply chain attacks via MSP access, software exploitation, credential compromise at managed clients and NIS2 liability as a service provider. ICT service providers therefore mainly hire SOC analysts and threat intelligence specialists, DevSecOps engineers for managed platforms, vulnerability management consultants and CISOs for growing IT service providers.
Supply chain attacks via MSP access
Software exploitation (58% risk increase)
Credential compromise at managed clients
NIS2 liability as service provider
SOC Analysts & Threat Intelligence specialists
DevSecOps engineers for managed platforms
Vulnerability Management consultants
CISOs for growing IT service providers
48u
Average time-to-shortlist
97%
Clients return
7.000+
Professionals in network
100%
Cybersecurity focus
Yes, B2B ICT service management, including managed service providers and managed security service providers, is listed in NIS2 Annex I. In the Netherlands this is implemented through the Cyberbeveiligingswet (Cbw), which has applied since 15 August 2026. An MSP therefore has its own duty of care and reporting obligation. Clients that fall under NIS2 or DORA themselves also increasingly ask for demonstrable security across the supply chain.
An MSP mainly needs SOC analysts and threat intelligence specialists to detect attacks on its own and managed environments quickly. DevSecOps engineers for managed platforms and vulnerability management consultants are also important, because software exploitation is a major risk. Growing providers need a CISO who owns policy, NIS2 compliance and accountability towards clients.
MVPeople Group responds to every request within 4 hours and, for interim assignments, often presents a first profile within 4 hours, with introduction CVs within 24 hours. Candidates come from a network of more than 7,000 pre-screened cybersecurity professionals, including SOC analysts, threat intelligence specialists and vulnerability management consultants. That lets an MSP add capacity quickly during a critical vulnerability or a growing client base.
Interim fits peaks, such as a large patch round after a critical vulnerability, building a SOC or preparing for NIS2 requirements. Permanent hiring fits roles that carry the service every day, such as SOC analysts and a CISO. Secondment through MVProfessionals is a middle option for longer projects, with the option to take the professional on permanently. Permanent hiring through MVPermanent typically takes 2 to 4 weeks.
Last updated by Mathijs Visser, Co-founder and Lead Consultant MVPeople Group.
MVPeople Group places cybersecurity professionals across all NIS2 sectors.
We introduce the first qualified interim candidates within 24 hours. 100% cybersecurity. 100% focus.
Help organisations strengthen their identity & access management. You advise on IAM strategy, lead SailPoint implementations, and build managed services for a growing cybersecurity-focused firm.
