ORGSEC
Crisis capability under hybrid threats

Crisis capability under hybrid threats

For leadership teams in critical organisations, directorates and groups that must read a changed threat picture quickly, and want to know whether they can act together without searching through a plan.

Start the assessment

Why now

Many have documentation. Fewer have operational capability.

PST assesses that Russian intelligence may see it as worthwhile to carry out sabotage against targets in Norway in 2026, most likely against property and logistics linked to the support for Ukraine, but also against civilian infrastructure, and often through proxies. Iran uses Swedish criminal networks with a presence in Norway. The terror threat level is moderate. Public officials are more likely to face digital threats and harassment than violence, but anti-state actors may see them as legitimate targets. The cyber operation against the dam in Bremanger in 2025, with little damage but great attention, is NSM's example of how incidents are now used.

That PST in addition issued separate threat assessments after the incident at the US embassy in March and after the conflict between the USA, Israel and Iran in April says something about what is required of a leadership team: to read a changed picture quickly, without waiting for a plan. It is the people who are to use the systems who decide the outcome: whether they have trained together, whether they trust each other, and whether they know what to do without searching. Resilience is built in everyday work, through culture, training and leadership.

Sources: PST: National Threat Assessment 2026 (Norwegian) · NSM: Risk 2026 (Norwegian) · PST, threat assessment April 2026 (Norwegian)

Four perspectives in practice

What the perspectives say about a leadership team under pressure

1980s

Perrow

Risk can be reduced, but never removed. The leadership team must be prepared for something to happen, including what it has not planned for.

1990s

Reason

Safety lies in several layers. The job is to find the holes before they line up, and that requires someone daring to point at them.

2000s

HRO

Reliability is built through priority, training and attention throughout the system, not through plans alone.

2022

Proactive crisis management

Situational awareness means planning for how global events become local needs, from 0 to 500 days, and staying ahead of them.

The perspectives are described in Håndbok i krisehåndtering (Bråten, 2022), chapter 1. Read the article on the four perspectives →

In the ORGSEC assessment

Where the theme lands in the assessment

Area 06
Crisis capability
The leadership team's situational awareness, decisions and interaction under pressure, measured after a digital tabletop, not by questionnaire alone.
Area 02
Risk and threats
Whether the threat picture is used in the leadership team's assessments, and whether the organisation knows what makes it a target.

The tabletop in ORGSEC+ uses the same scenario several times with increasing pressure, so that the leadership team learns from it, rather than being evaluated. See the six areas →

What we deliver

Assessment, e-learning and talk

Assessment

Crisis capability after a tabletop

The leadership team's crisis capability measured after a digital tabletop, not by questionnaire alone, with findings on situational awareness, decisions and interaction. All services →

E-learning in ORGSEC+

Preparing for a digital tabletop

For the leadership team. The four perspectives as analytical tools, roles and decision rules under pressure, and the preparation that makes the exercise about you rather than about the scenario. About the subscription →

Talk

Four perspectives on crisis capability

Perrow, Reason, HRO and proactive crisis management meeting the 2026 picture – sabotage, influence and incidents that grow on social media.

Talk

The talk within the theme

Talk 05