Nimblr, SoSafe, KnowBe4 and MetaCompliance are four security awareness platforms Norwegian organizations can compare.
NIS2 is not yet Norwegian law, but the regulatory landscape is already changing. DORA has applied to Norwegian financial entities since July 2025, the digitalsikkerhetsloven has been in force since October 2025, and Norwegian groups with operations in EU countries may already encounter NIS2 requirements there.
For organizations choosing security awareness training now, it makes sense to consider both today's requirements and what NIS2 will mean once it is introduced in Norway. Security awareness platforms are usually chosen for several years, so the one you pick now will likely be the one you run when NIS2 arrives.
Methodology: Based on each vendor's public information and Nimblr product information reviewed in September 2026. Features change, so verify current capabilities directly with each vendor. This is not legal advice and not an exhaustive list of vendors active in Norway.
Does NIS2 apply in Norway?
No, not yet. The digitalsikkerhetsloven entered into force on 1 October 2025 and brings the original EU NIS Directive into Norwegian law. According to NSM, NIS2 will be introduced into Norwegian law later, together with the CER Directive.
What applies to Norwegian organizations today?
Norwegian organizations can be in one or more of three positions:
Covered by digitalsikkerhetsloven: Providers of essential services and digital services within its scope.Covered by DORA: financial entities within its scope. DORA has applied in Norway since 1 July 2025. Article 13(6) requires ICT security awareness programs and digital operational resilience training for employees and senior management.
Preparing for NIS2: organizations likely to fall within NIS2's wider scope once it is implemented, as well as Norwegian groups with operations in EU countries where NIS2 already applies.
What to consider while NIS2 is pending
Prepare for NIS2 now. NIS2 lists basic cyber hygiene practices and cybersecurity training among its risk-management measures (Article 21(2)(g)). When choosing a platform, consider whether it can support these activities as part of your wider NIS2 preparations.
Include management. NIS2 requires members of management bodies to follow training (Article 20(2)). Check that leadership can be trained and that participation can be documented.
Make sure you can document it. Look for records of training, simulation results and behavior over time without extensive manual compilation.
Check Norwegian content. Training and simulations should be available in Norwegian, with scenarios relevant to Norwegian employees and working life.
For a deeper look at the requirements and evaluation criteria, see Security Awareness Training for NIS2 and DORA.
Four platforms to compare
|
Platform |
Approach |
What to check for Norway |
|
Nimblr |
Continuous, automated Human Risk Management with phishing and smishing simulations, Role-Based Learning and behavioral measurement |
Norwegian content, management and role-based training, reporting |
|
SoSafe |
Adaptive Human Risk Management based on behavioral science; names NIS2 and DORA among its compliance focus areas |
Norwegian content, which capabilities are in which tier |
|
KnowBe4 |
Broad security awareness and Human Risk Management ecosystem; public product page does not name NIS2 or DORA |
Norwegian simulations, NIS2 and DORA reporting, administration |
|
MetaCompliance |
Security awareness combined with policy and compliance management, with audit-ready reporting and policy tracking |
Norwegian content, simulation approach, reporting |
For a more detailed comparison of the four platforms, see Best Security Awareness Training Platforms: KnowBe4, SoSafe, MetaCompliance and Nimblr.
Buying through your IT provider
Some Norwegian organizations buy and manage security services through an existing IT provider rather than directly from each security vendor.
If that applies to your organization, ask whether your provider can include security awareness as part of its existing service and how training, simulations and reporting will be managed.
Nimblr works with IT service providers that deliver security awareness as part of their cybersecurity offering. Iver is one example.
FAQ: Security awareness training in Norway
Which security awareness training supports NIS2 compliance in Norway?
NIS2 is not yet Norwegian law. Security awareness platforms can still support activities included in NIS2, such as cybersecurity training, management training, awareness measurement and documentation.
Nimblr, SoSafe, KnowBe4 and MetaCompliance are four platforms Norwegian organizations can compare.
What are the best security awareness training platforms for companies in Norway?
Nimblr, SoSafe, KnowBe4 and MetaCompliance are four established platforms to consider.
Compare them on factors such as Norwegian content, training approach, management and role-based training, simulation realism, reporting and ongoing administration.
Does NIS2 apply in Norway?
Not yet. The digitalsikkerhetsloven, in force since 1 October 2025, implements the original NIS Directive. NIS2 is expected to be introduced later, together with the CER Directive.
Norwegian organizations with operations in EU countries may already encounter NIS2 requirements through those operations.
Does DORA require security awareness training in Norway?
Yes, for financial entities within its scope. DORA has applied in Norway since 1 July 2025, and Article 13(6) requires ICT security awareness programs and digital operational resilience training for employees and senior management.
Does Nimblr support Norwegian?
Yes. Nimblr delivers training in more than 30 languages, including Norwegian.
Build security behavior continuously
Nimblr combines automated security awareness training, phishing and smishing simulations, Role-Based Learning, Instant Learning and behavioral measurement in one continuous Human Risk Management program.
See how Nimblr supports your security awareness program.
