Norway's security authority raises national cyber risk level to high

Norway's security authority raises national cyber risk level to high

27 October 2026: Norway's National Security Authority (NSM) has raised the national cyber risk level to HIGH, and for the first time it has published the level openly. NSM says successful cyber operations against Norwegian organisations have tripled over the past half year, and it has put out a package of measures that it expects every Norwegian organisation to read. Its director, Arne Christian Haugstøyl, says a high level requires organisations to act with preventive measures at once.

Not yet independently verified. This is our translation from the Norwegian original. The page does not name the previous level in words, and the tripling is NSM's own figure for successful operations against Norwegian organisations; we have not seen the underlying data. We will update this when it can be confirmed, and remove this note.

"NSM has not gone public with this kind of assessment before," Haugstøyl says in the release, adding that the step is needed to strengthen resilience and the ability to handle cyber operations.

A five-step scale with moderate as normal

NSM assesses risk in the cyber domain continuously for Norwegian public and private organisations. Its scale has five levels: very low, low, moderate, high and extremely high. Moderate counts as the normal state, one in which cyber operations against Norwegian organisations are expected anyway. NSM adds that better basic security in organisations helps bring the national level down, so the measures it asks for are meant to lower the level as well as protect each organisation.

Who is most exposed

The authority names critical infrastructure and the service providers of organisations that matter for national security among those at high risk, together with the defence and space sectors. They are regularly mapped, attacked, hit with ransomware and denied service. NSM also notes that operations reach firms that are subcontractors to those organisations, often as a route to the organisations above them in a supply chain.

"Over the past half year we have seen a tripling of successful cyber operations against Norwegian organisations," Haugstøyl says, adding that several had serious consequences and still carry potential harm to national security.

AI is counted in the level

NSM names the rapid growth in the use of artificial intelligence as a factor. It calls the use of language models and agentic AI systems in cyber operations a serious risk. This is not documented in Norway at present, but NSM says the potential damage still weighs on the national level. AI analyses large amounts of data, Haugstøyl says, and finds vulnerabilities faster than humans have done, so the pace of security work has to rise.

The measures NSM wants taken

NSM points to measures it says are not new, many of them in its basic principles for ICT security: phishing-resistant multi-factor authentication, hardening, logging and detection, and updating and retiring devices. For critical infrastructure it adds network zones and conduits and a minimum system that can keep the function running during an incident.

Three further asks stand out. Organisations should manage risk across their supply chains, including suppliers and their own subcontractors. They should map devices and software, and NSM suggests NIST Common Platform Enumeration (CPE) so that exposure to a new vulnerability can be found quickly. And they should test that controls work: for example, that MFA resists social engineering and phishing. NSM highlights 21 measures from its basic principles and tells organisations to start at cybersjekk.no, a self-assessment that gives concrete advice on where to begin.

Our authentication software category lists 6 products for stronger sign-in.

Related on TrustList:

• Entra ID adds passkeys for guest users, on by default
• Roundcube 2FA plugin flaws let a stolen password skip the second factor

Sources

• NSM (Nasjonal sikkerhetsmyndighet): NSM hever det nasjonale cyberrisikonivået til HØYT (Norwegian), 27 October 2026