Under a multi-dimensional, open-ended definition of ‘security’ there are many ways of categorizing risks and challenges. Reflecting Euro-Atlantic institutional statements, this paper will distinguish non-military threats from human action (eg terrorism); other risks inherent in human activity (eg financial or infrastructure breakdown); and natural hazards (natural disasters, pandemics). It can be shown that all these factors affect the security of small states, albeit in widely varying patterns, and – like traditional threats – may hit them disproportionately hard, with disproportionately little recourse. In addition small states are increasingly expected to ‘export security’ in non-military ways such as peace missions, development aid, and compliance with global regulation. What are the practical and political challenges for the governance system of a small state in forming a policy response – a comprehensive strategy – for this whole range of still-evolving challenges? Can any useful guidelines or elements in solutions be identified?