NEWS AND EVENTS
DigiForum: From opportunities to control in the municipal sector.
Reflections from one of the most important arenas for digital security in the municipal sector – and what we must dare to face.
Author: Adil Lakrimi, SecureNOK
When digitalization has outrun the overview
Over time, DigiForum has developed into one of the most important meeting places for the municipal sector in digitalization and security. It brings together municipal chief executives, IT managers and specialists who, day to day, face demanding trade-offs between efficiency, operations and ever stricter security requirements.
For Secure-NOK, it was natural to be there together with NetSecurity. Not to present solutions, but to be close to the discussions that actually shape how municipalities work with security in practice.
And one thread runs through almost all the conversations we had:
Digitalization has come a long way, perhaps further than the ability to maintain full control.
Systems are connected, services are digitalized, and new solutions are adopted at a rapid pace. At the same time, many describe an everyday reality in which the overview has not kept up. This is where the risk actually lives: not in a lack of measures, but in a lack of insight.
Between opportunities and chaos
Torgeir Waterhouse put this well into perspective when he described the situation as a tension between understanding the opportunities and handling the chaos. This is precisely the field of tension in which many municipalities now operate.
The opportunities are great. The complexity is greater. And when you don't know what is actually happening in your own systems, you don't know where the risk lies either.
This is not a theoretical concern. NSM's Risk 2026 report, presented earlier this year, points to a clearly heightened risk picture: an increased likelihood of sabotage and cyberattacks against critical infrastructure, vulnerabilities that recur across sectors, and a threat in which state actors, according to PST, may carry out acts of sabotage against targets in Norway in 2026.
This is the reality municipalities must now navigate.
The threat landscape is changing pace, not just direction
Several talks pointed to how digital attacks are increasingly tied to a larger geopolitical picture. Both actors and motivations can be unclear. It is no longer a given that you know who is attacking, or even that you will detect it at all.
In the talk “Industrial Cyber-attacks 101”, Svein Rune Stangeland put developments into historical perspective, from the first known incidents in the 1980s to the present day. A central point was how the pace has changed:
- Attacks used to be rare and often targeted.
- Today, vulnerable devices are continuously scanned and mapped.
- The activity is automated, low-threshold and happens at far higher speed than before.
The time from when a vulnerability exists until it is exploited has been dramatically reduced. For OT environments – where systems often have long lifespans, specialized technology and limited scope for rapid change – this means that visibility and responsiveness are no longer a “nice-to-have”. They are a prerequisite for keeping operations running.
In brief: OT (operational technology) is the systems that control physical processes: pumps, valves, treatment plants, production lines. PLCs (programmable logic controllers) are the “brains” of these systems. When attackers get in here, it is not data that is at stake; it is operations, supply and societal functions.
Legal requirements are moving responsibility upwards
At the same time, regulations are tightening. The Digital Security Act entered into force on 1 October 2025, implementing what is known internationally as NIS1. NIS2 is expected to be introduced into Norwegian law during 2026 and will significantly broaden the scope, including to water and wastewater, waste management, food production and parts of public administration.
The concrete shift is not just technical requirements. It is that responsibility is explicitly moved up the organization. Security is no longer something handled exclusively by the IT department. It is a management responsibility that requires overview, prioritization and documentation.
For many municipalities, this means a change of mindset: from a technical discipline to integrated corporate governance. And this is where many discover they lack the most basic thing of all – a fact-based picture of their own situation.
The gap between IT and OT is still under-communicated
Municipalities largely have good routines and control mechanisms on the IT side. But in OT environments, where water is delivered, wastewater is handled and buildings are operated, insight is often far weaker.
These environments are characterized by:
- Long equipment lifespans (15–25 years is not unusual)
- Specialized, often proprietary technology
- Increasing connectivity to IT networks and the cloud
- Unclear ownership between the IT department and the operations organization
This combination makes them both vulnerable and hard to get an overview of. And let's be clear about one thing: IT security does not cover OT. They are different disciplines, with different protocols, different risk profiles and different consequences when things go wrong. An IT breach stops email. An OT breach stops the water supply.
In our conversations at the stand, three questions in particular kept coming up:
- How do we actually get an overview of the OT environment?
- How do we know what normal activity is?
- How do we detect deviations early enough to act?
These are not questions solved with more tools. They are solved with better insight.
When “pulling the cable” is no longer an option
One theme that came through clearly was preparedness, not as plans on paper, but as a real ability to handle incidents.
Historically, you could physically isolate systems. Pull the cable. Go manual. That is no longer an option in an interconnected reality where SCADA systems, remote monitoring and cloud-based services are part of daily operations.
The experiences of recent years illustrate this brutally well. The attack on Østre Toten municipality in 2021 required weeks of manual operation. Stavanger municipality was hit in 2023. And in 2025, the threat picture became even more concrete through several incidents. The most serious was the Bremanger‑sabotage of April 2025, in which attackers took control of the control systems of a dam at Risevatnet. The valves stood open for four hours, releasing around 500 liters of water per second. The incident was a direct attack on operational technology and showed that digital intrusions are not just about data; they can have physical consequences for life, the environment and infrastructure. The sabotage was assessed as a targeted influence operation, and it is now regarded as one of the most serious OT attacks in Norwegian history. Also in 2025, several municipalities were hit indirectly through a data attack on an external supplier, underlining how dependent municipalities are on third parties and how quickly an attack can spread through digital chains. Together, these incidents show that the threat is no longer theoretical. It is concrete, targeted and increasingly directed at critical infrastructure.
The last example also underlines one of the most important insights from the conference: the supply chain is today one of the greatest real risks. Attackers don't need to break in. They log in, through someone else.
The basics are still the hardest part
It is tempting to believe the solution lies in more technology. More tools. New platforms. The truth – as we hear it from the municipalities themselves – is more sober:
It starts with understanding what you actually have. And what is actually happening.
Without a real picture of how the OT environment operates, it becomes difficult to prioritize correctly, document control or react in time. All the measures in the world cannot compensate for a lack of visibility.
This recognition is where real maturity lies. Not in buying more – but in seeing more.
Why arenas like this actually matter
DigiForum gives a fairly clear picture of where the municipal sector stands today. Across size and geography, the challenges are largely the same: complexity is increasing, requirements are tightening and the need for a better basis for decisions is becoming ever more pressing.
For us at Secure-NOK, taking part in arenas like this is about being present where these discussions actually happen. Together with NetSecurity, we gain insight into how municipalities experience their own situation – and what it actually takes to move from uncertainty to control.
Good solutions are shaped where experience, needs and technology meet. And that is why these arenas are so important – not just for suppliers, but for the entire sector. This is where decision-makers get to see themselves in a larger context, hold their challenges up against those of others, and come home with a clearer language for what they are facing.
If you have the opportunity to attend DigiForum or similar arenas: do it. Not to find the answer, but to sharpen the questions. That is where real movement begins.
From lack of overview to actual control
Many municipalities we meet know they have measures in place, but lack an overview of what is actually happening in the OT environment.
A structured health check provides a fact-based starting point for understanding your own situation and making the right decisions. Not as a sales pitch, but as a baseline measurement before prioritizing the next step.
Development will not stop. Digitalization will continue, systems will become more complex and security requirements will increase. The question is not whether critical infrastructure must deal with this, but how.
It starts with something quite fundamental: understanding what you actually have, and what is actually happening.
Only then is it possible to handle both the opportunities and the complexity that come with it.
See more, fear Less. Explore
OT cybersecurity insights.
Insights from Norway’s cybersecurity experts
My first Attack conference: Golf, good conversations and a more serious backdrop
How do you present a cybersecurity company to potential customers while you are still learning about it yourself? I got to practise that when I attended my very first conference, the Attack conference, with SecureNOK on 13 October.
SNOK Health Check picks up speed – we are delivering OT overview after OT overview
What equipment is connected to the OT network, and who is communicating with whom? After several projects with the SNOK Health Check, I see how useful it is to get answers to these questions before deciding on the next security measure.
Water supply and critical infrastructure in focus at the Homeland Security Conference in Denmark
What does it take to keep society running when critical infrastructure is exposed to attacks and disruptions? This question was central when I attended the Homeland Security Conference in Copenhagen on 7 October with the Norwegian Cybersecurity Cluster.
Halfway through the OT Roadshow – time for the conversations that often have to wait
Trondheim, Bergen and Stavanger are done, and we are halfway through the OT Roadshow. For me, this is a valuable opportunity to look up from technology development and discuss security with those who know the everyday reality of industry.
Full house as IVAR IKS shared its experiences with OT security
Interest in the webinar with IVAR IKS was greater than we had dared to hope. Through our October campaign on health checks for water and wastewater facilities, we are now making it easier for more organizations to take the same first step towards better overview and control of their OT environments.
ON 104 has been updated: New requirements for safer and more robust operations on the Norwegian continental shelf
From 1 June 2026, the updated version of Offshore Norge Guideline 104 (ON 104 Rev. 7) applies – one of the most important frameworks for cybersecurity in operational technology (OT) in the petroleum industry.
The Norwegian Food Safety Authority's new guide makes one thing clear: Waterworks must now take OT security seriously
The Norwegian Food Safety Authority (Mattilsynet) has now published the first official guide to the Digital Security Regulations for drinking water. It is an important milestone for Norwegian water supply – and a clear signal that the authorities are now stepping up work on digital security in the sector.
OT Konferansen shows the Nordics taking a leading role in OT security
Today, many industrial environments consist of industrial networks, virtual environments, Windows and Linux systems, remote access, patching and backup solutions, security tools, cloud services and integrations with IT.
OT security in the food industry starts with insight
As a project manager on OT security projects, I often encounter the same starting point at industrial companies: They know a great deal about production, processes and equipment – but far less about what the digital infrastructure actually looks like in practice.
Norwegian-developed OT security technology for industry and critical infrastructure
Norwegian industry is becoming increasingly digitalized. Production lines, process plants, energy systems and critical infrastructure are being connected more closely to modern IT systems, external suppliers and digital services. At the same time, there is a growing need for cybersecurity solutions actually developed for industrial environments.
Strong support for OT Konferansen 2026 – bringing together leading experts in Stavanger
OT Konferansen 2026 takes place on 29 April in Stavanger, and this year's edition already stands out with a programme that brings together some of the most central players in OT security and industrial digitalization.
Growing need for control in complex automation environments in oil and gas
In recent years, the digitalization of the oil and gas industry has brought significant gains in efficiency, better data and greater flexibility. At the same time, this development has led to a significant increase in complexity – and therefore also in risk.
How to gain control of the OT environment in practice – experiences from IVAR
For IVAR IKS, stable operations are not just a goal – they are a prerequisite for society to function. As a provider of water and wastewater services to around 360,000 residents in Nord-Jæren, the organization manages critical infrastructure where the consequences of failure are immediate and extensive.
The Preparedness Year 2026: Are water and wastewater in Norwegian municipalities secure enough?
Municipal water supply is among the societal functions covered by the Digital Security Act. The Act entered into force on 1 October 2025 and sets basic requirements for digital security in organizations of particular importance to society. The regulations also place responsibility for digital security clearly with the organization's top management.
Stricter Security Requirements for Critical Services from 1 October 2025 under theDigital Security Act
O nFriday, 20 June, the Norwegian government decided in a Council of State meeting that the Digital Security Act will enter into force on 1 October 2025. At the same time, the Digital Security Regulation was adopted, entering into force concurrently with the Act.
Bremanger Breach: Lessons from a Norwegian Dam Hack
Earlier this year, unidentified hackers breached the control system of a Norwegian dam at Risevatnet, in Bremanger. The hackers discovered that the dam had a Human Machine Interface (HMI) exposed on the Internet and was able to gain access by exploiting a weak password.p
Digitalization: Opportunities and New Risks
Digitalization offers enormous opportunities for efficiency, but it also introduces new risks. When OT systems (Operational Technology) are connected to the internet, vulnerability to attacks increases—attacks that threaten not only data, but also lives, health, and critical societal functions.