The threat assessment for Norwegian petroleum activities

When the Norwegian Intelligence Service, the Norwegian Police Security Service (PST) and the National Security Authority (NSM) published their open threat and risk assessments for 2026 in February, they described a security picture of enduring rivalry and shifting parameters for international cooperation.The services emphasise resilience work as core to the civilian sector, whilst warning against self-induced fear.  

“The threat landscape should not be used as a definitive answer, but as a description of the threats around us and the direction of development. It's about building resilience through systematic and holistic work over time," says Meriton Agushaj, who works in the Security field at Havtil.  

Geopolitical pressure 

The Norwegian Intelligence Service places Norway in a security policy landscape affected by geopolitical developments. Russia is described as an actor combining overt, covert and influence-oriented means to shape European decisions. It also indicates the development of capacities aimed at critical underwater infrastructure, relevant for pipelines, cables and other subsea systems in Norwegian waters.  

The assessments pinpoint military activity in northern sea areas - some within proximity of Norwegian civilian and commercial activities - and the use of measures potentially affecting navigation and infrastructure. This is seen as part of a broader geostrategic development.  

China is depicted in the same landscape, where the country develops its room for manoeuvre through economic and industrial means. 

Direct and indirect consequences

Norway is a stable supplier of oil and gas to Europe. Infrastructure on the shelf and onshore facilities is therefore of strategic interest to foreign states. PST assumes that activity will increasingly take place covertly. Mapping, influencing and the use of proxies are described as the most likely forms of activity. Sabotage is also seen as a possibility. Russian services are paying close attention to military conditions, allied activity, Norwegian support to Ukraine and infrastructure along the coast.  

“It is the sum of activity over time that is important to understand. Companies must consider both direct and indirect consequences in their risk assessments," says Agushaj.  

Holistic approach 

NSM's risk assessment for 2026 highlights holistic security management as a prerequisite for resilience. Their investigations reveal lack of anchoring, implementation and the ability to strengthen security measures when the risk level changes. This is consistent with Havtil's findings in the petroleum sector.  

NSM also points to personnel safety as a persistently challenging area. Inadequate follow-up and a poor information flow can make it difficult to identify vulnerabilities in time. Physical security measures may become outdated as threat actors develop new methods. Complex supply chains and unclear ownership structures can establish leverage points within value chains, making critical functions more vulnerable.  

The report emphasises that being proficient in individual areas is not sufficient. Security work must include digital and physical security, roles and responsibilities, planning, personnel safety and security culture.  

It is the sum of activity over time that is important to understand. Companies must consider both direct and indirect consequences in their risk assessments.

Meriton Agushaj, Havtil

Cyber security must be safeguarded

The threat landscape in the cyber domain is persistent and serious. According to PST, this is where the greatest threat lies. They consider it likely that Norwegian businesses will be affected by cyber operations in 2026, and that an increasing number of attacks will succeed. 

“In the cyber domain, it´s a matter of ensuring that the bar hasn´t been set too low and that the measures are adapted to the current risk landscape. It's about being prepared," says Linn Steensrud Øverland, who works within cyber security at Havtil. 

Technological developments make it easier for sophisticated actors to carry out advanced attacks. At the same time, those with fewer resources will have greater scope for opportunities.  

Artificial intelligence will be a key component in future cyber operations, particularly related to influence, espionage and sabotage operations. 
NSM points to vulnerabilities in unsecured industrial control systems, known as OT (Operational Technology) systems. They cite lack of segmentation, unsecured remote access, inadequate updating of software and insufficient surveillance that can be exploited when companies have an insufficient overview of their own systems. It is therefore important that the companies focus on building organizational and technological resilience. 

“Resilience is as much about overview and practice as it is about technology," emphasises Steensrud Øverland. 

Havtil's role 

Havtil is responsible for following up and safeguarding civil protection, security and emergency preparedness within our area of authority. Section 9-3 of the Petroleum Act requires licensees to implement and maintain security measures and to have contingency plans for deliberate attacks. Havtil is also the supervisory authority under the Security Act for the petroleum sector. 

The threat landscape for 2026 emphasises that security work requires close cooperation between the authorities, companies and the parties in the industry, and a continuous ability to adjust as the picture changes. 

Resilience is as much about overview and practice as it is about technology.

Linn Steensrud Øverland, Havtil

Read more articles from Dialogue no 1 - 2026: 

If the unthinkable should happen

The Total Defence Year 2026 will strengthen Norway's ability to prevent and manage security policy crises and war. "We must be prepared for the worst," says Havtil director Sigve Knudsen.

Before the crisis hits

If important societal functions are to be maintained in crisis and war, the business sector has an important role to play. The industry organisation Offshore Norge points to several key issues that should be discussed and clarified – before the crisis happens.

The threat assessment for Norwegian petroleum activities

The threat and risk assessments for 2026 paint a challenging picture of geopolitical tension, growing cyber threats and sustained interest in Norwegian energy infrastructure. This makes clear demands on the petroleum industry´s work on security and emergency preparedness.

Preparedness in their blood

In Finland, preparedness is not a plan. It is a way of shaping society. Join us in the country where cooperation between authorities and industry has turned crises into a driving force for innovation.

Founders arming up

In a former hospital in the heart of Helsinki, Finland has built one of Europe's most dynamic startup campuses. Here, technology communities are emerging at the intersection of research, industry and defence.

From bark beetles to NATO

Finnish company Kelluu was founded to monitor Finnish forests. Then Russia invaded Ukraine. Today, the company's unmanned airships are participating in Nato exercises across three countries in a single month.

Dual-purpose technology

At a time when both energy security and national security are under pressure, the so-called dual-use approach has become increasingly relevant. Oceaneering, which has been supplying subsea technology and services to the Norwegian continental shelf for years, is now also developing solutions for the defence sector.

Calls for a clear mineral strategy

Must we, should we, or can we permit ourselves to extract seabed minerals on the Norwegian continental shelf? Yes, says Professor Kåre Dahl Martinsen, who believes that security policy must play a far more significant role in the debate for or against mineral extraction.

New status for intervention

Intervention has traditionally been the "little brother" in drilling and well operations, for no obvious reason. This type of activity is both complex and important, with the potential for major incidents. The field is now receiving recognition.

The network beneath the waves

The development of subsea pipelines on the Norwegian Continental Shelf started as a direct consequence of the Ekofisk discovery in 1969. In order to produce at scale, oil and gas had to be transported safely and continuously to market, something which ships alone could not achieve.

Safe structures and robust material choices

On many of the facilities on the NCS, structural steel is the load-bearing element. The steel must withstand harsh environments, absorb the forces that affect it, distribute loads and cope with the wide variations in temperature, weather and operation that accompany a long service life offshore.