Most Norwegian companies have an incident response plan. Far fewer practise it. That is why Atea has travelled around the country with a container where companies can experience a simulated cyberattack, before it happens for real.
A plan on paper is not enough
Atea's own security report for 2026 shows that around 67 percent of businesses have an incident response plan. But only one in four practise it regularly, says Torill Holm, a former Network and IT Security student at Noroff Vocational School. Today she works as a project manager at Atea.
– This means that many have an incident response plan sitting in a drawer. On the day an attack actually happens, it doesn't help to have it in the drawer. You need to have practised. You need to know what your role is, and what the person next to you is supposed to do, says Torill Holm.
She is project manager for IT security at Atea. She helps companies prepare for cyberattacks by making sure everyone understands their role, from the IT department to the boardroom.
– Responding to a cyberattack takes more than an IT team. The board and management are responsible when a crisis hits, so they also need to understand their roles and know who does what, Holm emphasises.
A cyberattack with an escape key
To get companies to practise, Atea has built its own cyber escape room inside a 40-foot container. It has been set up at Youngstorget in Oslo, during Arendalsuka and in several cities along the coast this autumn.
Inside the container, participants have played the management team of the fictional company Nordic Critical Systems, which has just been hacked. Their task was to stop the attack, limit the damage and regain control.
– The simulation is based on real incidents, but it is also gamified. Participants have to collaborate, communicate and respond to the press. They have to choose what gets power, and which backup they want to use, says Holm.
After an hour in the simulation comes an hour of evaluation with Atea's security advisers. Here they go through how their choices affected the outcome.
– The business takes useful insights back with them, and can prioritise what they want to work on next.
From the customer centre to project manager
Torill (36) completed the two-year programme in Network and IT Security at Noroff. She was working at the same time, and needed a study programme she could fit around her own everyday life.
– Noroff had a very flexible study programme. I was working alongside my studies, so I could study whenever it suited me, she says.
Her choice of subject came down to interest and the future.
– It's a really interesting field, and one I think will become even more important going forward. It offers good job opportunities.
While she was studying, she applied for a job at Atea's customer centre. After two years there, and a bit more studying, she was offered the position of project manager for IT security.
Today she doesn't work hands-on with the technology every single day. But she uses the knowledge from her studies all the time.
– I have a lot of background knowledge. It helps me in technical discussions, and in my dialogue with the regions and partners we work with.
– The industry needs more people
Torill is clear that the need for people with security expertise will only grow.
– We always need good people, and I think the demand will be big in the years to come. We need more applicants.
Her advice to you if you want to get into the industry is not to lock yourself in too early.
– I think some people tie themselves a bit too tightly to exactly what they want to work with. It's smart to gain experience. Be open to new opportunities.
Related studies
Two-year programme
Network and IT Security
Hands-on IT programme that teaches you how to combat hacking and cybercrime, while using AI tools to address security challenges. The growing demand for IT security offers excellent career opportunities.
Online
Oslo, Bergen
Read more
Two-year programme
Cloud Security and Infrastructure
Build the skills to design, manage, and secure modern cloud environments. This programme prepares you for in-demand roles across IT infrastructure and cybersecurity, with hands-on training that mirrors real industry needs.
Online
Read more
One-year programme
Network and System Administration
The demand for skilled system administrators has never been greater. You will learn how to manage and operate data networks and servers, and how to use AI tools to monitor networks, predict issues, and strengthen IT security.
Online
Oslo, Bergen
Read more
One-year programme
Cloud Foundations
This program offers practical education where you learn about physical infrastructure, server operations, and cloud technologies.
Online
Read more