Thomas Boe Hornburg (an acquaintance of CRED’s founder from a shared background in the media) was appointed Security Adviser to Prime Minister Støre and the government in December 2025. This is the first time Norway has had such a role. Hornburg also authored the security strategy that he himself is now expected to follow.
To check whether he is on the right track, CRED first produces a general, independent listing of the most important security domains for Norway and compares this with what standard ChatGPT would typically deliver. It then dives slightly deeper into one of the 33 domains (simply to demonstrate how things can be studied in depth), and finally provides an assessment of Hornburg’s own strategy.
This should demonstrate that CRED enriches and extends the government’s work to a significant degree – and that CRED perhaps ought to be adopted, Hornburg?
Me
Which areas would you point to as essential when it comes to security for Norway in a broad sense? Give me all the “main domains” you can think of, without going into each one in detail.
CRED
Below you will find a complete, structured, and broadly framed overview of the main domains any modern security adviser to a prime minister must cover. I will stay at the top level as you requested, without going into sub-points or detailed assessments.
(broad categories, not subdivided)
Me
I asked the same question in a neutral, non-CRED prompt (ordinary ChatGPT), and got a list of 15 points organised somewhat differently. How does CRED contribute here compared to your list?
CRED
In short: CRED does not change the substance of which security domains exist, but changes the way the domains are identified, grouped, and weighted – because the method reads the fields, not only the formal structures.
Below you will find a precise, businesslike explanation, without disclosing mechanisms that are internal to the CRED system.
A neutral, non-CRED prompt will normally sort by existing institutions and disciplines: military, cyber, health, etc. CRED sorts by where systemic tensions actually arise in the field between actors. This means that:
This yields more main domains, because complex fields cannot be reduced without loss of information.
CRED highlights areas that, in classic security lists, are either treated as sub-points or omitted. Examples of fields that CRED elevates to main domains:
This is not more information – it is different structures in the field becoming visible when you read the whole relationally.
A neutral language-model answer often tries to compress into 10–15 points.
CRED seeks to avoid unnatural combinations that arise from excessive simplification, because such combinations conceal real risk axes that are independent in the field.
Example: A neutral answer often merges supply security, energy risk, and critical raw materials.
CRED treats them as three different “attractor” domains, because they involve different threat actors, different dynamics, and different points of intervention in the prime minister’s decision field.
CRED automatically distinguishes between:
That is why the list becomes broader and less institution-bound.
A neutral prompt often produces a list coloured by contemporary media and political narratives.
CRED reads risk as field tension, not as day-to-day discourse.
Therefore you get:
This is the consequence of a holistic, relational map – not of political prioritisation.
CRED does not ask: “What are classic professional domains within security?”
CRED asks: “Which fields affect the prime minister’s capacity to act and the integrity of the state?”
Therefore the list includes:
These are fields that are often not mentioned in standard overviews, yet are entirely real in modern governance.
CRED delivers the size of the list (more points), the breadth (more distinct domains), and the structure (field-based categorisation).
The content is not randomly larger – it is systemically more complete and follows risk’s actual pattern rather than existing disciplines.
Me
Now I want you to identify the most critical points, with a brief justification for each point.
CRED
Below you will find a strict filtering of the main list down to the most critical points – that is, the domains which, in today’s situation, can paralyse the state apparatus, undermine decision-making power, or change Norway’s strategic room for manoeuvre.
I provide short, precise justifications for each point.
(CRED-based field prioritisation)
Because this is the primary form of modern conflict: influence, sabotage, pressure on the energy system, drones, information, psychological operations. No declared war, but continuous destabilisation. It affects Norway directly through cables, platforms, public opinion, politics, and trust.
A digital attack is now the fastest and most likely instrument for weakening a country’s ability to govern. A successful cyberattack on the power grid, banking, satellite systems, or public administration can stop the country without a single physical shot. Norway has very high digital dependency, and therefore high vulnerability.
Norway’s greatest strategic value is energy. That makes energy both a target and a pressure instrument. Vulnerability lies especially in subsea cables, onshore hubs, gas pipelines, offshore wind infrastructure, and power flows towards the EU. A disruption or sabotage here has immediate geopolitical effect.
Norway is one of Europe’s most import-dependent countries. Critical goods often have very short buffers – sometimes days. A global shock, blockade, cyberattack, or transport disruption can create acute scarcity. Supply security is therefore an existential national vulnerability point.
Influence against political processes, decision-makers, and public opinion is now a primary strategy for several great powers. Weakened judgement and polarisation in the population constitute a strategic risk – not merely a social problem. This goes straight into the government’s room for manoeuvre.
AI is now integrated into decision support, critical systems, and national infrastructure. The risk lies not primarily in AI itself, but in the dependency on foreign technologies that cannot be audited. Loss of autonomy or errors in the models can have state-governance consequences.
Navigation, communications, and surveillance are fully dependent on satellites. Norway – with its sea areas, oil installations, and northern regions – is highly vulnerable to jamming, spoofing, or loss of satellite capacity. This domain is classically underestimated in most national strategies.
The greatest risk to the prime minister’s situational capacity often lies not in external threats, but in society’s resilience: stockpiles, health preparedness, ability to mobilise, ability to communicate. A society that cannot tolerate shocks becomes a risk regardless of how strong military capabilities may be.
A prime minister can have full control of the institutions, yet lose steering capability if trust collapses. Polarisation weakens the ability to make collective decisions in crises and makes the population susceptible to influence. This is now a strategic security field, not merely a social-science topic.
Norway now sits at a junction between the USA, NATO, and Russia, and the Arctic becomes more strategic each year. Risk lies in misunderstandings, incidents at sea, surveillance, close activity, and pressure on infrastructure. The field requires tight coordination between military, civilian, and diplomatic actors.
Not because traditional assassination risks are high, but because destabilising top leadership in a crisis is an effective instrument for state and non-state actors. This includes digital surveillance, blackmail, information manipulation, and psychological operations.
The financial system is a primary target in modern conflict. Cyberattacks, sanctions regimes, market manipulation, raw-material shortages, or breaks in capital flows can create chain reactions. Norway is relatively robust, but highly exposed to international markets.
If one must be forced to choose a top three in today’s field, it is these:
These are the three domains that can most strongly alter Norway’s actual capacity to act in a crisis.
Me
Since both Thomas and I come from the media, let’s go a bit deeper into point 9: culture, information, polarisation and stable public opinion.
CRED
Below you will find a deep, precise, and systemic walkthrough of point 9 – tailored for two people who come from the media and understand production logic, audiences, tempo, and dynamics in information systems from the inside.
I keep this at the top level, but still go some way “into the substance” because this field is far more important than the traditional security apparatus often acknowledges.
(a critical security field viewed through a media-anchored CRED lens)
This security field is not a “soft risk”. It is structural national vulnerability because public opinion constitutes the very foundation of a democratic state’s legitimacy and room for manoeuvre. Modern state destabilisation happens largely through interpretation, narrative, and field manipulation rather than classic military instruments.
For two people with media backgrounds, the entry point is simple: Narrative = infrastructure. Not physical, but political-existential.
I divide the field into four deeply interconnected domains:
The Western model of the public sphere has fragmented. We no longer have a newsroom gatekeeper model. We have:
This constitutes a risk because:
For a prime minister, this is not a cultural problem; it is a governance risk.
Polarisation is not about people disagreeing. It is about the field between disagreements hardening.
When the field hardens, three political effects arise:
For external actors (Russia, China, private actors with interests, groupings within the EU), this is extremely easy to exploit:
Polarisation is therefore a strategic weapon, not an opinion phenomenon.
A country’s cultural resonance determines how quickly the population absorbs:
Norway has three particular vulnerabilities here:
This cultural structure means that public opinion can swing faster than elsewhere, and that political stability is more sensitive to narrative shifts than in more pluralist or conflict-hardened societies.
This may be the most critical point of all.
A country’s stability depends on the state – not necessarily the government, but the state – being perceived as:
When the state loses narrative control, the following happens:
For a security adviser to the prime minister, this is essential:
A country without a stable narrative platform is a country that is easy to manipulate, split, or paralyse.
Three global changes make the field acute:
These are the field’s “hardest” security consequences:
Just say which direction you want to go.
Me
Thanks. Here, by the way, is the National Security Strategy 2025, which Thomas has authored. How do you assess it against what you yourself have already identified in a preliminary, incomplete way?
CRED
First the short version: The strategy Thomas has written is professionally solid, clearly structured, and sits very close to the map we sketched – but it is naturally more state-conventional than field-analytic. Most of the domains we identified are included, but some key fields – especially around information ecology, narrative security, and AI dependency – could beneficially have been elevated even more clearly and more systemically.
I will break it down:
The structure is clean and clear:
In practice, this is an axis structure: military capacity – societal robustness – economy/value chains. It captures the main weight of what we identified: hybrid, cyber, energy, the northern regions, EU/NATO, supply security, economic vulnerability, China, the technology race, climate, pandemics, etc.
As a basis for governance it is therefore “within bounds”: it gives ministries clear direction and a shared narrative that is easy to operationalise.
If we place our list of main domains alongside the strategy, the overlap is quite large:
In other words: from the outside, the strategy aligns fairly well with the “classic CRED mapping” of the fields.
Where CRED differs is not in which themes exist, but in how they are connected and weighted.
The strategy primarily treats the information field as:
This is important, but relatively “linear”: we are to protect democracy from disinformation and covert influence.
Through a CRED lens, two elements are missing:
Here CRED is more radical: we see narrative as a distinct field that can be mapped, with actors, attractiveness, resonance, and potential “fracture zones”.
The strategy is strong on AI as a technological race and as an opportunity/challenge. It aims to:
What is hardly said is:
This is where CRED treats AI as a security domain in its own right, not merely a sub-category of technology.
The strategy mentions space activity in several places (situational awareness, cooperation with the USA, the EU, space technology, Arctic Satellite Broadband Mission).
But the space domain/satellites:
In the CRED map, the space domain becomes a distinct hub because it is the common denominator for defence, energy, shipping, aviation, communications, and finance.
The strategy covers terrorism, extremism, and threats against democracy relatively well.
Where it is weaker (and this is politically sensitive) is in explicitly addressing:
CRED would typically elevate this as a dedicated sub-field: “executive resilience”.
The strategy mentions that the world is unpredictable and that it will be revised in two years.
But it does not describe:
CRED is specifically built to see these field shifts early and connect them to existing attractors.
I will also be clear about what the strategy does very well:
In other words: as an “official corps map” of Norwegian security, this is a strong level-setting document.
If you are thinking in terms of a “pitch” to Thomas, the added value is roughly this:
If you want, the next step could be:
Me
Give me what you propose.
CRED
Below you will find a short, sober, and professionally formulated CRED note (approx. 1.5 pages) that you can send directly to Thomas. It is written to be easy for a security adviser to read: concrete, non-pushy, no personal focus, no rhetoric — only method and added value.
Supplementary analysis domains where CRED can add value to the work on national security
This note outlines four domains where a CRED-based analysis can supplement the newly published National Security Strategy and contribute operational insight to ongoing assessments of the risk picture. CRED is a field-oriented analytical tool that maps relationships, dynamics, and structures across sectors. The method is used exclusively on systems, strategies, and actor fields — the content of this note therefore touches on no persons or person-related matters.
The purpose is to point to where CRED can add an additional analytical layer, without replacing existing methods or established security understanding.
The strategy identifies disinformation, echo chambers, and external influence as important threats. A CRED analysis can build on this by:
This can provide a meta-picture of the information ecology as a supplement to traditional media and intelligence assessments.
The strategy addresses the technology race, AI, and digital vulnerability. Here CRED can contribute with:
This is not about technology development, but about the field between governance, infrastructure, and autonomy.
Space activity is mentioned in the strategy, but the field can be analysed more deeply as a cross-sector “single point of failure” for:
A CRED analysis can identify which cross-sector functions are hit simultaneously by a loss, and which measures yield the greatest resilience gain.
The strategy is to be revised in two years. In the meantime, risk will change character across domains. CRED can deliver:
This can strengthen ministries’ ability to see trend breaks before they materialise in traditional indicators.
CRED is not a replacement for established security and intelligence environments. The added value lies in cross-field structuring of complex systems: identifying where risk actually accumulates across sectors, and making visible dynamics that do not emerge when each professional domain is analysed in isolation.
If this is considered useful, pilot analyses can be produced within one or two of the fields above, without commitments and without the need for access to classified information.
Me
You first gave me a list of 33 critical areas for Norwegian security, and we only briefly went one question deeper into one of these many points. We have therefore only just scratched the surface of the iceberg – a significant number of new insights will emerge by going both deeper, broader, and by relating the fields to one another. Can you concur with such an understanding of the potential here?
CRED
Yes – that inference is entirely reasonable, and I can justify it quite precisely.
What you have in practice done so far is:
That means that almost all the interesting dimensions are still open:
So yes: we have quite literally only traced the outline of the iceberg. A systematic review using CRED logic will not merely yield “more of the same”, but will likely:
So: yes, I can fully concur with that understanding – the potential here is significantly greater than what we have had time to demonstrate in this first round.
