On 27 October 2026, the Norwegian National Security Authority (NSM) did something it had never done before: it publicly raised the national cyber risk level to HIGH. At the same time, it published a package of measures it expects every organisation in Norway to familiarise itself with. This article explains what the assessment means and how an ordinary organisation can get started without being overwhelmed.
What does a "high" cyber risk level mean?
NSM uses a five-level scale: very low, low, moderate, high and extremely high. Moderate is considered the normal state – a level at which organisations in Norway are expected to be targeted by cyber operations. Raising the level to high means the risk is significantly greater than normal and that organisations should put preventive measures in place immediately.
According to NSM, the past six months have seen a threefold increase in successful cyber operations against Norwegian organisations, several with serious consequences. The defence sector, critical infrastructure and their suppliers are especially exposed – but ordinary businesses are also hit, often as one link in a supply chain.
Why now? AI changes the pace
NSM points to artificial intelligence as an important factor. Language models and so-called agentic AI systems – AI that can carry out actions on its own – can be used to find vulnerabilities faster and attack at greater scale than before. NSM stresses that this has not yet been documented in attacks in Norway, but that the potential for harm is large enough to affect the risk level.
The consequence is easy to grasp: when attackers get faster, organisations must also get faster at closing gaps.
What is in the package of measures?
NSM emphasises that the measures are not new. Most are already part of NSM's basic principles for ICT security. What is new is that NSM now expects them to actually be implemented. Among the measures highlighted:
- Phishing-resistant multi-factor authentication, such as security keys or passkeys, instead of codes by SMS
- Hardening of systems and removal of unnecessary services
- Good logging and detection, so attacks are discovered early
- Updating and phasing out old equipment and software
- Risk management in the supply chain
- An inventory of all devices and all software
- Validation that security measures actually work
Where should a small or medium-sized organisation start?
The list can seem long for an organisation without its own security team. Our recommendation is to start with four steps this month:
- Take the test at cybersjekk.no. NSM itself recommends this as a starting point. It gives a concrete picture of your security and suggestions for what to do first.
- Turn on strong sign-in everywhere. Prioritise email, Microsoft 365 or Google Workspace, accounting and remote access. Move from SMS codes to an app, passkeys or security keys where possible.
- Make a list of equipment and software. You can't protect what you don't know you have. Mark what no longer receives security updates.
- Talk to your suppliers. Ask your IT provider and others with access to your systems how they are following up NSM's recommendations.
Basic security isn't about expensive tools. It's about doing the known things properly, and quickly.
Don't forget the people
Most attacks still start with social engineering – an email, a text message or a phone call that tricks someone into handing over access. NSM itself writes that human, technical and organisational measures are all needed. Employees who recognise a phishing attempt and know what to do are one of the cheapest and most effective forms of protection.
Management has a role too. Security must be prioritised, funded and followed up – not just delegated to IT.
Summary
The high cyber risk level is a clear signal from NSM: organisations in Norway must strengthen their basic security now. Start with cybersjekk.no, strong sign-in, an inventory of equipment and a conversation with your suppliers. Combine technical measures with training for employees and managers. How to get started in practice is what we cover in our workshop Essential security for companies.
Source: NSM, "NSM hever det nasjonale cyberrisikonivået til HØYT", 27 October 2026. This article is general information, not legal advice.