Norway Raises Its National Cyber Risk Level to HIGH: What It Means and What to Do Now

On 27 October 2026, Norway's National Security Authority (Nasjonal sikkerhetsmyndighet, NSM) raised the national cyber risk level from MODERATE to HIGH, the second-highest step on its five-step scale. It is the first time NSM has ever published the level openly. The message to every Norwegian organisation is direct: at HIGH, preventive measures need to start now, not at the next budget cycle.

NSM backed the change with a striking figure. Over the last six months it has seen a threefold increase in successful cyber operations against Norwegian organisations. Alongside the warning, it published 21 baseline measures it expects every organisation to put in place, from multi-factor authentication to tested backups.

This article explains what the new level means, who NSM sees as most exposed, why artificial intelligence is part of the picture and how to work through the 21 measures in a sensible order. If your organisation operates in Norway, supplies Norwegian customers or depends on Norwegian infrastructure, it applies to you too.

What NSM Has Changed and Why It Matters

NSM assesses cyber risk to public and private organisations continuously. Its national scale has five steps: very low, low, moderate, high and extremely high. MODERATE is the normal state, in which cyber operations against Norwegian organisations are expected as part of everyday life.

Moving to HIGH is a deliberate signal. Until now NSM has kept its assessment of the national level classified. Publishing it, and publishing it at the second-highest step, tells boards and leadership teams that this is no longer a matter for the IT department alone. NSM's position is that stronger baseline security across Norwegian organisations will, in turn, help bring the national level back down.

The government has reinforced the message. Minister of Justice and Public Security Astri Aas-Hansen urged all organisations to review their IT security and close vulnerabilities quickly. The Norwegian Communications Authority (Nkom) said it is following the situation closely with telecoms providers and data centre operators, and that NSM's measures will form part of its dialogue with the organisations it regulates. NSM director Arne Christian Haugstøyl was candid about the starting point: preparedness varies widely, and many organisations have a lot of ground to make up.

A Threefold Increase in Successful Attacks

The headline number is about successful operations, not attempts. That distinction matters. Scanning and phishing attempts rise and fall all the time. A tripling in operations that actually achieve their goal means defences are being beaten more often.

NSM describes the activity against the most exposed sectors as reconnaissance, attempted and successful compromises, ransomware and denial-of-service attacks. It has not attributed the increase to any particular actor. The wider backdrop is a tense security policy environment in Europe, with several governments warning of hybrid activity, including cyber operations, linked to the war in Ukraine.

Norway has already seen what this looks like in practice. In the spring, a cyber attack on Lørenskog municipality outside Oslo led to a large amount of data being stolen and offered for sale. Last week, two critical PHP vulnerabilities were disclosed that can let attackers take over web servers without a password, exactly the kind of flaw that is exploited at scale within days. We covered them in Two Critical PHP Flaws: What Every Website Owner Needs to Know.

Who NSM Sees as Most Exposed

NSM names five groups facing a high risk:

• The defence sector
• The defence industry
• The space sector
• Critical infrastructure
• Service providers to organisations that are important to national security

The last group is the one many organisations underestimate. NSM says it is aware of cyber operations aimed at subcontractors as a route to organisations higher up the chain. A small IT provider, a software supplier or a managed service partner can be the easiest way into a far better defended target.

Sectors that are not named should take little comfort from that. Finance, healthcare, logistics, energy and the public sector all run on the same telecoms networks, cloud platforms, data centres and software suppliers as the sectors NSM lists. When shared infrastructure is targeted, the effects travel. Our view is simple: if you operate in Norway, treat NSM's measures as written for you.

Why AI Is Raising the Stakes

NSM points to the rapid growth in the use of artificial intelligence as one of the factors behind the new level. AI can analyse large volumes of data and find vulnerabilities faster than people can, which shrinks the window between a weakness existing and someone exploiting it.

NSM is careful to say that the use of large language models and agentic AI systems in cyber operations has not yet been documented in Norway. The potential for harm is still serious enough to influence the national level. The practical consequence is the one NSM draws itself: if attackers can move faster, security measures have to be put in place faster too.

Speed is the theme to plan around. Patch cycles measured in months, asset lists refreshed once a year and detection that depends on someone reading logs on Monday morning were already risky. Against attackers using AI to find and chain weaknesses, they are not enough.

NSM's 21 Baseline Measures

The 21 measures are drawn from NSM's Basic Principles for ICT Security (Grunnprinsipper for IKT-sikkerhet). None of them is new or exotic, and that is the point. They are the foundations that decide whether an attack becomes a contained incident or a crisis. Use the self-check below to see where you stand.

NSM is clear that the measures do not remove all risk. What they do is strengthen your ability to handle an attack and reduce the consequences when one gets through. Organisations that act also help lower the national risk level, because attackers have fewer easy targets to work through.

Four Areas NSM Singles Out

Alongside the list, NSM's announcement draws particular attention to four areas. They are where we would focus first, too.

Phishing-Resistant Multi-Factor Authentication

Not all MFA is equal. Codes sent by text message and push approvals can be phished, intercepted or approved by a user who has been talked into it. NSM recommends moving to phishing-resistant authentication, such as security keys and passkeys based on the FIDO2 standard. Start with administrators, remote access and email, where a stolen login does the most damage.

Supply Chain Risk Management

NSM asks organisations to manage supply chain risk as a whole: where hardware, components, services and software come from, and what information flows through orders and specifications. Suppliers should have sound security management and should require the same of their own subcontractors. A practical first step is to list every supplier that can reach your systems or data, how they connect and what they could do with that access.

Knowing What You Have

You cannot protect devices and software you do not know about. NSM recommends using tooling to keep inventories current and suggests standard product identifiers, such as NIST's Common Platform Enumeration (CPE), so you can tell within minutes whether a newly announced vulnerability affects you. Our live Threat Watch feed of actively exploited vulnerabilities becomes far more useful when you can match it against an accurate inventory.

Proving Your Controls Work

A control that exists on paper is not the same as a control that works. NSM asks organisations to verify that measures are implemented correctly and behave as intended, for example that MFA cannot be bypassed by a convincing phone call or a fake login page. Penetration testing, phishing simulations and attack simulation are how you find the gaps before someone else does.

For operators of industrial and operational technology, NSM adds specific advice: security zones and conduits with authenticated, controlled traffic, restrictions on which software can run, strong access control and the ability to keep essential functions running during an incident.

Five Questions Every Board Should Ask This Month

NSM's decision to publish the level openly puts cyber risk squarely on the leadership agenda. Boards do not need to understand every technical control, but they should be able to get clear answers to five questions:

1. Where do we stand against NSM's 21 measures? A one-page view of what is in place, what is partly in place and what is missing, with owners and dates.
2. Could a stolen password get someone in? If any remote access, email or administrator account still relies on a password alone, or on MFA that can be phished, that is the first gap to close.
3. Which suppliers could hurt us most? The handful of providers with privileged access to our systems or data, and what we know about their security.
4. How quickly would we know? Who watches for attacks out of hours, and how long it would take to spot and contain an intruder.
5. Could we recover, and how long would it take? When we last restored critical systems from backup, and whether the result met the business's expectations.

If the answers are vague, that in itself is useful information. It tells you where to point the first wave of effort.

A Practical Plan for the Weeks Ahead

Twenty-one measures can feel like a lot at once. The sequence below front-loads the actions that cut the most risk quickly, then builds towards the measures that take longer to embed.

What This Means Beyond Norway

Norway is not alone in raising expectations. Across Europe, regulation is moving in the same direction, from the EU's NIS2 Directive to the UK's Cyber Security and Resilience Bill. The common thread matches NSM's list: know your assets, secure your identities, manage your suppliers, detect quickly and be ready to respond.

For groups with Norwegian subsidiaries, offices or suppliers, the new level is a timely prompt to check that security standards are consistent across borders. Attackers look for the weakest entity in a group. A local office running older remote access, or a regional IT supplier with broad permissions, can become the way into everything else.

How Cybergen Can Help

Cybergen is already supporting organisations operating in Norway as they work through NSM's guidance. We help you move quickly, in the right order, and with evidence your board can rely on:

• A rapid gap assessment against NSM's 21 measures, with a prioritised action plan
• Identity hardening, including phishing-resistant MFA and privileged access
• Round-the-clock managed detection and response, so attacks are spotted and contained quickly
• Supplier and third-party risk management built around real access, not questionnaires
• CREST penetration testing and attack simulation to prove your controls hold
• Threat intelligence focused on the sectors and suppliers you depend on

If you would like a second pair of eyes on your position against NSM's measures, speak to our team. We will give you a straight answer on where you stand and what to do first.

Frequently Asked Questions