For critical infrastructure operators and agencies, the EO warrants particular attention through a resilience lens. The convergence problemFor decades, critical infrastructure security operated under a relatively stable model. Agencies will increasingly expect critical infrastructure operators to have mature AI security and governance in place. Agencies will increasingly expect critical infrastructure operators to have mature AI security and governance in place. In critical infrastructure, vulnerability management cannot be driven by common vulnerabilities and exposures (CVE) score alone.