Norway Raises National Cyber Risk Level to High as Attacks Triple

Executive Summary

Norway’s National Security Authority (NSM) raised its national cyber risk level to high on 27 October 2026. It is the first time the agency has published the rating openly and unclassified. High is the fourth step on a five-level scale where moderate counts as normal. NSM director Arne Christian Haugstøyl said successful cyber operations against Norwegian organisations had tripled in the past six months and that several had serious consequences. The agency names the defence sector, defence industry, space sector, critical infrastructure and suppliers to organisations important to national security as most exposed. It told all Norwegian organisations to act immediately and published 21 baseline measures. It named no threat actor.

NSM Takes Norway’s Cyber Risk Level Public

NSM says it assesses the national cyber risk level for Norwegian public and private organisations continuously. Until 27 October that assessment stayed internal. In its announcement, the agency said it had never gone public with this kind of rating and was doing so because stronger resilience in Norwegian organisations was “helt nødvendig” (absolutely necessary).

The scale runs from very low through low, moderate and high to extremely high. NSM treats moderate as the normal state, one in which cyber operations against Norwegian organisations are expected anyway. It also says better baseline security across organisations helps bring the national cyber risk level down.

The tripling figure comes with two timeframes. NSM’s written statement says the past six months. Haugstøyl was quoted at the afternoon press conference in Oslo as saying the past year, according to a published report. NSM gave no absolute numbers for either period.

Defence, Space and Their Suppliers Face the Highest Risk

NSM lists the defence sector, defence industry and space sector as facing high risk. Critical infrastructure is on the same list. So are service providers to organisations of importance to national security. Against these targets NSM reports reconnaissance, compromise attempts, actual compromises, ransomware and denial-of-service attacks.

The supplier warning is specific. NSM says it knows of cyber operations against subcontractors whose customers matter for national security where the attacker is trying to work further up the supply or value chain.

AI is the other driver. NSM rates language models and agentic AI systems used in cyber operations as a serious risk to Norwegian organisations while noting that such use hasn’t yet been documented in Norway. At the press conference Haugstøyl said organisations now have hours to close known vulnerabilities.

Phishing-Resistant MFA Heads the 21 Measures

None of the measures is new. NSM says most come from its Grunnprinsipper for IKT-sikkerhet, the baseline ICT security principles it publishes for Norwegian organisations. For critical infrastructure it singles out phishing-resistant MFA, hardening, logging with detection and the patching or retirement of devices. It also wants supply chain risk management that reaches subcontractors and requires every supplier to set the same security demands further down the chain.

Asset inventory gets its own section. NSM suggests NIST’s Common Platform Enumeration (CPE) so organisations can tell quickly whether a newly published flaw is exposed anywhere in their estate. The last point is validation: MFA that social engineering can get around doesn’t meet the bar. The full list of 21 controls starts with mapping devices and ends with an incident handling plan. NSM points organisations to cybersjekk.no, its self-assessment tool, as the place to begin.

NSM hasn’t said what the classified level was before 27 October or when it last changed. It gave no incident count and named no incident or threat actor.

Nor has it said how long the high rating will last.

In Sweden, the national cyber security centre, part of FRA since 2024 according to NCSC, summarised the Norwegian decision in its NCSC – CERT-SE weekly newsletter on 30 October. The newsletter didn’t say whether Sweden would publish a comparable rating.

NSM Asked for Phishing-Resistant Logins in 2024

The October package repeats advice NSM gave in 2024. Its alerts that year told organisations to move to passkeys or other FIDO2 methods and to replace SSL VPN with IPsec and IKEv2 by the end of 2025. Its Risiko 2025 report said adversary-in-the-middle phishing had hit a significant number of Norwegian businesses and that they could not wait for further warnings. The supplier category on the October list carries no nationality limit. Swedish firms supplying Norwegian defence, space or infrastructure customers fall inside it on NSM’s own wording.

References

1. NSM hever det nasjonale cyberrisikonivået til HØYT
2. Risiko 2025
3. Grunnprinsipper for IKT-sikkerhet 2.1
4. NSM anbefaler overgang til phishingresistent autentisering
5. NCSC – CERT-SE veckobrev v.44
6. Published report

This post is also available in: