Summary
- NSM publicly classified Norway’s national cyber risk as HIGH on 27 October, its first unclassified release of the rating.
- NSM reported that successful cyber operations had tripled over the six months preceding the announcement.
- The assessment particularly identifies defence, space, critical infrastructure and sensitive suppliers.
Norway’s National Security Authority (NSM) publicly classified national cyber risk as HIGH on 27 October, the second-highest level in its five-tier framework. It is the first time NSM has openly released this type of national risk assessment; MODERATE is described as the normal baseline, rather than as a previously published rating.
NSM reported that the number of successful cyber operations targeting Norwegian organisations had tripled over the six months leading up to its 27 October announcement. The agency has not supplied a complete public breakdown of incident counts, affected organisations or the methods used to determine that figure.
Defence organisations, the defence industry, space operations, critical infrastructure and suppliers to security-sensitive businesses receive particular attention in NSM’s assessment. The agency describes persistent reconnaissance, attempts to compromise systems, ransomware and denial-of-service activity across the sectors. These are categories of observed pressure rather than evidence that every organisation in those fields has suffered a breach.
A public risk signal
NSM’s framework runs from very low through low, moderate and high to extremely high. Moderate is the expected baseline in a cyber environment where attempted attacks occur routinely. HIGH means the authority considers the combination of threat, vulnerability and possible consequences serious enough to warrant prompt additional protective measures.
The national label is not an incident declaration or an indication that telecommunications networks have already failed. Norway’s communications regulator, Nkom, explicitly made that distinction when responding to the announcement. Nkom said it was working with communications suppliers, data centre operators and relevant government bodies on security and preparedness.
For providers whose services underpin other sectors, the distinction is operationally important. A communications fault, compromise of a management system or loss of access to a data centre can affect customers beyond the originally attacked organisation. Security requirements therefore extend to the resilience of shared infrastructure and the arrangements for coordinating a response across operators.
NSM has accompanied its assessment with a package of preventive actions. The public announcement does not make those actions statutory requirements for every enterprise, but it increases the urgency with which public bodies, regulated operators and their suppliers are expected to examine exposure and continuity plans. The practical response may differ according to whether an organisation manages industrial assets, cloud infrastructure, identity services or sensitive records.
AI risk without an invented incident
The authority also points to rapid changes in artificial intelligence. Language models and agentic systems can potentially assist adversaries in aspects of an intrusion, from information gathering to automating parts of an operation. NSM is careful to say it has not documented that particular use in Norway at the time of its statement.
That qualification matters. The agency’s concern is based on prospective damage potential and the evolving threat environment, not a confirmed Norwegian incident involving autonomous AI attackers. Conflating a forward-looking risk assessment with an observed technique would overstate the evidence.
The threefold rise concerns successful cyber operations over the six months preceding the 27 October assessment. Without the underlying counts or methodology, it cannot be converted into an annual trend or used to conclude that the proportion of attempted attacks succeeding has trebled. The volume of reported incidents and the attack success rate are separate measures.
The publicly disclosed rating gives suppliers and customers a shared reference point for discussing security dependencies. It also exposes an accountability question: the effectiveness of the precautionary package will depend on adoption, independent testing and the reporting of material incidents, none of which follows automatically from a higher national score.
NSM director Arne Christian Haugstøyl said the authority was making its assessment public to strengthen organisational resilience and response. The accompanying preventive package addresses a period in which defence, space and essential-service dependencies are under particular scrutiny.
