For the first time, Norway’s National Security Authority has publicly raised the national cyber risk level to high, citing escalating artificial intelligence threats, critical programming flaws, and a triple-fold increase in successful cyber operations against domestic organizations over the past year.
Escalating Cyber Risks Prompt First Public Assessment by NSM
Norway has officially moved its national cyber risk assessment to its second-highest tier. Director Arne Christian Haugstøyl of the National Security Authority, known as NSM, announced the shift on Tuesday. This marks the first time the agency has publicly released its national cyber risk evaluation, a decision driven by the shifting security landscape and recent months of high-profile digital incidents.
The agency pointed to a dangerous convergence of factors behind the heightened alert. Officials highlighted a tripling in one year in successful cyber operations targeting Norwegian enterprises. The data breach at Lørenskog Municipality earlier this year, where substantial quantities of stolen data were sold on the dark web, highlights the threat.
Artificial Intelligence and Software Vulnerabilities Drive the Threat Landscape
The rapid acceleration in how threat actors deploy artificial intelligence has fundamentally altered the timeline for network defenders. According to Arne Christian Haugstøyl, automated tools allow malicious actors to detect and exploit system vulnerabilities with unprecedented speed.
Adding to the pressure, critical vulnerabilities surfaced recently in PHP, a programming language that powers roughly 70 percent of websites worldwide. This technological exposure intersects with heightened geopolitical tensions, as foreign powers increasingly rely on digital disruptions and cyber attacks against critical infrastructure as part of hybrid warfare strategies.
A 21-Point Action Plan for Norwegian Enterprises and Public Infrastructure
With the risk level set to high, the agency expects all domestic organizations to bolster their digital resilience immediately. Officials published a comprehensive list of 21 measures designed to help businesses close security gaps. Vulnerabilities are particularly concentrated around high-value targets, including the defense sector, defense and weapons industries, space infrastructure, and broader society-critical systems.
Minister of Justice and Public Security Astri Aas-Hansen emphasized that strengthening digital defenses remains paramount for both institutions and individuals. She urged every organization to review its IT security posture and rapidly implement defensive measures. Meanwhile, the Norwegian Communications Authority, Nkom, is monitoring the situation closely alongside broadband and mobile network providers, noting that telecom networks serve as the backbone supporting nearly all critical societal functions.
Funding Boost and the Path Forward for National Defense
To combat these expanding digital threats, the government’s proposed 2027 state budget allocates an additional 180 million kroner to the security authority. The funding is earmarked specifically for artificial intelligence initiatives, enabling the agency to deploy machine learning tools capable of processing data volumes far beyond human capacity.
While some well-prepared enterprises maintain strong defenses, the agency director warned that many municipal authorities and businesses still have significant ground to cover before they can withstand targeted cyber operations.