“Cybersecurity is "offense-dominant" for critical infrastructure because its software is not updated rapidly, making it difficult to patch vulnerabilities identified by AI.”