The world we live in now is one in which AI can discover and exploit vulnerabilities within 15 minutes, while companies that operate critical infrastructure take months to discover and recover from cyber incidents. This mismatch is worth emphasizing: minutes to exploit, months to recover. Infrastructure operators should anticipate a glut of unsupported software and firmware this year, combined with an uptick in the pace of software patch releases. Critical infrastructure operators and suppliers must adapt. In the longer term, critical infrastructure operators need to manage risk across the lifecycle of their assets.