Summary

• Norway's NSM has increased its national cyber-risk level from moderate to high.
• The authority reports a threefold increase in successful cyber operations over the previous six months.
• Its recommendations emphasise phishing-resistant authentication, system visibility, network segmentation, supplier controls and tested recovery arrangements.

Norway’s National Security Authority (NSM) has raised the country’s national cyber-risk level from moderate to high, following a sustained increase in successful attacks against Norwegian organisations and growing exposure across critical infrastructure.

The authority says successful cyber operations have tripled over the preceding six months. Some incidents have caused serious consequences, while certain compromises continue to present potential risks to national security after the initial intrusion.

For the first time, NSM has publicly released an unclassified assessment of the national cyber-risk level. The decision gives businesses and government organisations a common reference point for reviewing security arrangements and introduces a set of practical measures the authority expects them to consider.

Norway uses five categories of cyber risk, ranging from very low to extremely high. Moderate is regarded as the normal condition, under which hostile activity against Norwegian organisations is already expected. Raising the assessment to high therefore signals a deterioration beyond the background level of cyber threats.

Critical services face heightened exposure

NSM identifies defence organisations, military suppliers, the space sector and critical infrastructure as particularly exposed. Companies supporting nationally important organisations are also at risk, because an attacker may exploit a less protected supplier to reach a larger customer.

The authority reports reconnaissance, attempted intrusions, successful compromises, ransomware and denial-of-service attacks. These activities carry different consequences, ranging from interruptions to public-facing services to unauthorised access affecting important operational systems.

Norway’s communications regulator, Nkom, has highlighted the implications for telecommunications networks and data centres. Mobile connectivity, broadband and hosting infrastructure support many other public and commercial functions, so disruption can affect organisations that are not themselves the direct targets of an attack.

Nkom has also cautioned that a higher risk assessment does not establish that telecommunications networks have been compromised. The distinction is important because the national level describes an assessed threat environment, not the operational status of every network or service.

Businesses increasingly depend on interconnected suppliers for identity management, cloud computing, communications, payments and specialist software. A disruption affecting one provider can therefore interrupt several customers even where their own systems have not been attacked.

Resilience planning must consequently establish which external services are essential, how long an interruption can be tolerated and which alternatives remain available when a provider fails.

AI increases potential attack capability

NSM has included the growing capabilities of artificial intelligence among the factors influencing its assessment. Language models and agent-based systems could enable attackers to analyse information, identify vulnerabilities and automate parts of offensive operations.

The authority explicitly states that the use of such AI systems in cyber operations against Norway has not been documented in the manner described. Their potential to increase the speed and scale of attacks nevertheless contributes to its assessment of future risk.

Existing security weaknesses remain exploitable regardless of the technology used by an attacker. Unpatched applications, exposed credentials, misconfigured services and poorly controlled supplier access are all potential entry points without any need for advanced AI.

However, tools that accelerate vulnerability discovery or automate repetitive activity may shorten the interval between a weakness becoming known and attempts being made to exploit it. That places additional pressure on organisations to maintain accurate inventories and apply appropriate mitigations promptly.

AI can also support defensive investigation, but its effectiveness depends on the data and controls available to the security team. Automated analysis cannot compensate for missing system records, ineffective logging or unclear responsibilities when an incident requires intervention.

Foundational controls return to the foreground

NSM’s response focuses on established security practices rather than a single new technology. It has highlighted 21 measures drawn from its principles for ICT security, including stronger authentication, system hardening, monitoring, vulnerability management and replacement of obsolete equipment.

Phishing-resistant multifactor authentication is a particular priority because stolen credentials remain a common route into business systems. Controls designed to resist credential interception and fraudulent login requests can reduce the risks associated with ordinary passwords and weaker authentication methods.

For critical infrastructure, NSM recommends separating networks into appropriate zones and controlling traffic between them. These arrangements can restrict movement between systems and help preserve essential functions when part of the infrastructure is compromised.

Operational technology introduces additional constraints because equipment controlling physical processes may have long replacement cycles or limited support for modern security features. Changes to access rules, network connections or software can require testing to avoid unintended effects on production or service continuity.

Organisations must also understand their dependence on suppliers. Software providers, equipment manufacturers, connectivity companies and contractors may all have access to information or infrastructure that forms part of a customer’s security exposure.

NSM recommends requirements extending appropriately through supplier relationships, alongside clearer information about the technologies and services organisations use. Accurate inventories are needed to determine which systems could be exposed when a new vulnerability is disclosed.

Recovery capability must be demonstrated

The authority places particular emphasis on checking that security measures operate as intended. Authentication controls need to resist realistic attempts at circumvention, monitoring systems must collect useful information and recovery arrangements should be tested before a serious incident occurs.

Backups provide limited protection if restoration has never been exercised or the information required to recover an essential system is missing. Similarly, network segmentation is effective only when actual access policies enforce the intended boundaries.

For essential services, NSM recommends maintaining minimum capabilities capable of operating during a cyber incident. The appropriate arrangements depend on the systems involved and the operational consequences of losing connectivity or access to central services.

Norway’s revised assessment calls for stronger preparation across both government and industry. NSM’s recommended actions concentrate on identifiable weaknesses in existing systems, reflecting its view that improvements in individual organisations can reduce the country’s collective exposure to cyber operations.