Source: Nasjonal sikkerhetsmyndighet (NSM)

Norway’s National Security Authority (NSM) announced on 27 October 2026 that it is raising the national cyber risk level to high, the second highest of five levels, and for the first time publishing this assessment openly and unclassified. NSM director Arne Christian Haugstøyl said the step was taken because it is absolutely necessary to strengthen both resilience and the ability to handle cyber operations in Norwegian organisations.

Successful attacks tripled in six months

NSM reports a tripling of successful cyber operations against Norwegian organisations over the last six months. Several of these had serious consequences and still carry a potential for damage to national security. As an example, the municipality of Lørenskog near Oslo had a large amount of data stolen in the spring, data that was later offered for sale on the dark web. The defence sector, defence industry, space sector and critical infrastructure are judged to be at particularly high risk, with repeated mapping, compromise attempts, ransomware attacks and denial of service attacks.

AI accelerates the threat

NSM also highlights how rapid growth in the use of artificial intelligence is affecting the risk level. According to Haugstøyl, AI can analyse large volumes of data and find vulnerabilities faster than humans have been able to, enabling attacks at a higher pace and larger scale. Although AI driven offensive operations are not yet documented in Norway, the damage potential alone raises the national risk level.

NSM is urging all Norwegian organisations to implement a package of preventive measures immediately, including phishing resistant multi factor authentication, hardening, good logging and detection capability, and timely updates and phasing out of old equipment.

The wider European picture

Norway’s warning fits a pattern seen across Europe, where several countries have raised alarms about heightened cyber activity in connection with the war in Ukraine. For European businesses the message is clear: baseline security hygiene is no longer optional, and regulators expect documented measures. If your organisation needs help prioritising security hardening, logging and detection, or preparing for NIS2 obligations, contact us for professional guidance.