02 · Cybersecurity
We help teams see the risks that matter, reduce exposure and build secure habits into how products are designed and shipped.
Why now
NSM raised the national cyber risk level to high in October 2026. Small suppliers are a common way in to larger targets. Security is now a sales question as much as a technical one.
Security advice often arrives as a late audit and a long list. We work alongside delivery, so security becomes part of how a product is built rather than a review at the end.
We start from NSM's basic principles for ICT security, then focus on the risks that could affect your business. In practice that often means identity, suppliers, AI agents and incident reporting.
Field notes
The rules, standards and platforms we design around today. Each note links to its source.
NSM raised the national cyber risk level to high. Successful attacks on Norwegian organisations tripled in six months, and suppliers are a frequent way in.
Our advice: Review supplier access and admin accounts first. They are the most common way in.
Makers of products with digital elements sold in the EU must report actively exploited vulnerabilities within 24 hours. Full requirements follow in December 2027.
Our advice: If you sell software products in the EU, set up a vulnerability intake and a 24 hour reporting route now.
Passkeys now carry 36% of sign-ins in the FIDO Passkey Index. They succeed 93% of the time, against 78% for classic MFA.
Our advice: Offer passkeys for customer and staff sign-in, and keep a strong account recovery flow.
NSM tells all organisations to plan their move to post quantum cryptography by 2030. The first step is an inventory of where you use cryptography.
Our advice: Start with an inventory of where you use cryptography. Then prioritise data that must stay secret beyond 2030.
Related work
An AI agent workflow that handles routine support cases end to end, with human approval for anything that touches money.
A move from passwords and SMS codes to passkeys for clinical and office staff, with a recovery flow that works on a night shift.
Ways to work together
Most engagements begin with a short, focused piece of work.
A structured look at your product, architecture and process, with a prioritised list of what to fix first.
We embed with your team and build security into design, delivery and release, including your AI features.
We prepare you for incidents and reporting deadlines, run exercises and turn lessons into better practice.
Questions
No. We work on design, process and resilience, and we coordinate with a testing partner when you need one.
It depends on what you build and who you sell to. The Digital Security Act has applied in Norway since October 2025, DORA covers finance, and the Cyber Resilience Act applies to products sold in the EU. We map what is relevant to you.
NSM's basic principles for ICT security, the NIST Cybersecurity Framework and secure by design practice, adapted to your size and context.
The aim is the opposite. A decision made early usually costs less than a fix made late.