Norway’s National Security Authority (NSM) says the number of successful cyberattacks against Norwegian organisations has tripled over the past six months, prompting a warning that national resilience must improve more quickly.
The assessment, published on 27 October 2026, highlights growing risks to defence and space companies, critical infrastructure and service providers linked to organisations important to national security. The NSM also identified the rapid development of artificial intelligence as a serious risk because it can help attackers find weaknesses faster and operate on a larger scale.
Norway cyberattacks increase sharply
The NSM said organisations in Norway are increasingly facing reconnaissance activity, ransomware and distributed denial-of-service (DDoS) attacks. It did not attribute the rise to a particular country or group in the report.
The agency’s assessment covers attacks it described as “successful”. That term indicates incidents in which attackers achieved an effect against their targets, although the source material does not provide a numerical total or a detailed breakdown of the affected organisations.
NSM Director Arne Christian Haugstøyl said the authority had not previously made this type of assessment public. He said the disclosure was intended to strengthen organisations’ ability to withstand and manage cyber operations.
Which sectors face the greatest cyber risk?
The warning extends beyond central government networks. Norway’s defence industry and space sector were identified as particularly exposed, while critical infrastructure and important service providers were also highlighted.
These sectors can have consequences far beyond an individual company. Disruption to infrastructure or digital services may affect public administration, communications, transport, energy, supply chains and organisations that support national security.
- Defence and space: valuable intellectual property, research and sensitive operational information can make these sectors attractive targets.
- Critical infrastructure: cyber incidents can disrupt services on which households, businesses and public authorities depend.
- Service providers: attackers may use suppliers and contractors as a route into more important networks.
- Businesses and public organisations: ransomware and DDoS attacks can interrupt operations even when national-security systems are not directly compromised.
Artificial intelligence adds to the threat
The NSM said artificial intelligence is changing the speed and scale of cyber operations. AI systems can process large volumes of information and identify weaknesses more rapidly than traditional human-led methods, according to the agency.
That capability may allow attackers to assess more potential targets in less time. It could also help them tailor phishing, discover vulnerable systems and automate parts of an intrusion. The report’s warning is not that every use of AI is malicious, but that organisations must account for the way the technology may strengthen offensive cyber capabilities.
For businesses, the message is that conventional security measures cannot remain static. Faster threat detection, timely software updates, strong access controls, network monitoring and tested recovery plans are increasingly important. Organisations also need to assess risks created by suppliers and cloud-based services.
European security context
The Norwegian warning comes amid broader concern across Europe about cyber operations and other forms of hybrid activity. European governments have increasingly discussed the use of cyberattacks, online influence operations and disruption campaigns alongside more traditional security threats.
Norwegian media reported in August that a Russian hacker group had claimed responsibility for a DDoS attack affecting several government digital services and had declared war on Norway. However, the NSM’s latest report did not identify a specific actor, so that reported incident should not be treated as proof that Russia was responsible for the wider increase described by the agency.
Norway is not a member of the European Union, but it is closely connected to European security through its role in NATO, its participation in the European Economic Area and extensive cross-border digital and commercial links. A serious cyber incident in Norway could therefore have implications for companies, suppliers and public bodies elsewhere in Europe.
What happens next?
The NSM’s announcement is a national security assessment rather than a new European Union law or regulation. The source material does not indicate that Norway has introduced a new legal requirement, announced sanctions or assigned responsibility to a named foreign government.
The immediate focus is likely to be on improving organisational resilience. Businesses and public bodies can reduce exposure by prioritising:
- rapid installation of security updates and patches;
- multi-factor authentication and least-privilege access;
- segmentation of critical networks;
- regular offline backups and recovery testing;
- incident-response exercises involving suppliers and public authorities; and
- clear reporting procedures for suspected cyber incidents.
For European organisations, the report reinforces the importance of cooperation between governments, regulators, national cybersecurity agencies and private operators. Cyber threats cross borders quickly, while the systems targeted by attackers often depend on international suppliers and shared infrastructure.
Why the warning matters
The significance of the NSM assessment lies in both the reported increase and the decision to publish it. By making the warning public, Norway’s security authority is signalling that cyber risk is no longer confined to specialist technology teams. It is a strategic issue affecting national security, economic continuity and essential services.
AI may make attacks faster, but the practical response remains grounded in basic resilience: knowing which systems are critical, limiting unnecessary access, detecting unusual activity and preparing to restore operations. Organisations that delay those measures may face greater disruption as attackers gain more powerful tools.
Conclusion
Norway’s National Security Authority says successful cyberattacks against Norwegian organisations have tripled in six months, with defence, space, critical infrastructure and key service providers facing particular exposure. The agency has not named a culprit, but its warning places cyber resilience and artificial intelligence firmly within the wider European security debate. The clearest takeaway is that organisations must accelerate preventive measures and recovery planning before attacks become faster and more difficult to contain.