The White House Executive Order, Promoting Advanced Artificial Intelligence Innovation and Security, comes at an important moment.

As frontier AI models—the most advanced models currently available or in development—become more capable and more prevalent, they will directly affect cybersecurity, even more than their predecessors. The EO takes meaningful steps by prioritizing collaboration, voluntary early engagement on advanced AI models, and faster vulnerability response at scale.

The same advances that help defenders identify vulnerabilities, analyze malware, correlate activity, and respond faster can also help attackers improve reconnaissance, automate social engineering, accelerate exploit development, and scale intrusion activity. The critical issue our society faces is not whether AI will impact cybersecurity. It already has, so how the industry responds to these potential security risks is going to be fundamental to our success.

A key question that AI presents is how government and industry can collaborate to address the risks that AI can bring if misused by an adversary, without stifling creativity and innovation, while also leveraging AI to strengthen vital systems and services.

The U.S. EO focuses on four practical areas: strengthening federal cyber defenses, improving vulnerability discovery and patch coordination, expanding cybersecurity talent, and establishing a voluntary process to assess the cyber capabilities of advanced frontier models. This is a constructive direction because AI security cannot be framed as a choice between innovation and protection. The country needs both.

Importantly, the EO is explicit that the voluntary assessment framework is not intended to create a mandatory government licensing, preclearance, or permitting requirement for AI model development or release. This framing matters: it signals that the Administration intends to balance security and innovation rather than impose regulatory barriers on the pace of AI development.

The real test for the EO will be operationalization, particularly around AI-assisted defense and coordinated vulnerability remediation. Insights that stay inside a closed ecosystem do not reduce risk. The measure of success will be whether government, AI developers, cybersecurity providers, and critical infrastructure operators can turn vulnerability discovery into timely guidance, practical mitigations, and importantly actions taken that can achieve measurable risk reduction across the systems that matter most.

AI-Enabled Defense Must Translate into Customer Outcomes

For most organizations, the most important question is not how frontier models are reviewed within government. It is whether AI can help defenders reduce risk in the environments they are responsible for protecting. That means faster vulnerability detection, improved prioritization, enhanced threat identification, and more efficient responses across federal agencies, state and local governments, and critical infrastructure operators.

This is where public-private coordination can make a practical difference. Many critical infrastructure providers, including rural hospitals, community banks, utilities, transportation agencies, and local governments, deliver essential services with limited security resources and little tolerance for disruption. They do not need more abstract risk language. They need timely guidance, practical tools, and actionable intelligence to identify exposed systems, apply mitigations, and respond before cyber incidents disrupt essential services.

AI can help security teams move faster, but only when it is connected to real operational context. Defenders need to understand which vulnerabilities are exploitable, which assets are exposed, which systems support essential functions, and which actions will most quickly reduce risk. The value of AI-assisted defense will be measured by whether it helps organizations make better decisions under pressure, not by whether it can create another stream of reports for already-overloaded teams.

Vulnerability Response Depends on Execution

The EO’s proposed AI cybersecurity clearinghouse is relevant because it points to a familiar operational challenge: coordinating vulnerability response at scale is already difficult. Agencies and critical infrastructure operators face a constant stream of vulnerabilities across software, cloud services, devices, identity systems, third-party tools, and internet-facing assets. AI will intensify pressure on both sides. While defenders can use AI to identify weaknesses earlier and prioritize remediation more effectively, attackers can use AI to find exploitable systems, adapt techniques, and move faster from disclosure to exploitation.

The goal of any coordination mechanism should be actionable prioritization. Agencies and critical infrastructure operators need to know which vulnerabilities matter most, which systems are exposed, what mitigations are available, and how urgently action is required. Fortinet brings a practical perspective to this discussion through its robust secure product development lifecycle (SPDLC), which is designed to identify, validate, remediate, and responsibly communicate software security issues throughout the product lifecycle.

Cybersecurity must remain grounded in operational reality. A vulnerability on an isolated system differs from the same vulnerability on an exposed, business-critical asset. A patch that is straightforward in a standard IT environment can be far more complex in healthcare, finance manufacturing, energy, or operational technology environments, where uptime and safety considerations shape every decision. 

In these cases where critical organizations need to “mitigate in minutes,” solutions like virtual patching become critical in rapid protection against exploitation until a full patch can be deployed.

Frontier Model Assessment Should Stay Focused on Cyber Capabilities

The EO also calls for a classified benchmarking process to assess the advanced cyber capabilities of AI models and to determine when a model should be designated a covered frontier model. It also directs the development of a voluntary framework for AI developers to engage with the federal government before covered models are released more broadly.

This section of the EO should remain technically grounded. The focus should be on measurable cyber capabilities rather than broad assumptions about AI risks. Relevant questions include whether advanced models can significantly aid in vulnerability detection, exploit development, malware creation, evasion strategies, privilege escalation, automated targeting, or other offensive workflows. The same assessment should also consider how these capabilities can be leveraged for defense.

Details are crucial, as model behavior is shifting rapidly with expanding capabilities, added tools, and evolving use cases. A voluntary framework allows trusted public and private partners to gain early insights into potential risks without framing every AI release as a regulatory event. The EO emphasizes that this process is not intended to establish mandatory government licensing, preclearance, or permits for new AI models.

That distinction matters. Security and innovation must advance together. The objective should be to improve visibility, strengthen preparedness, and support responsible deployment, not to slow the development of useful AI capabilities.

The EO also reinforces the need to treat AI-enabled threats as actual cybercrime. It highlights the importance of focusing law enforcement efforts on attackers who use AI to illegally access systems, cause damage, or steal data. While AI might increase the speed, scale, and complexity of malicious actions, the necessity for accountability remains unchanged when attackers exploit these tools to compromise public or private systems.

Federal Adoption Can Set a Practical Example

The federal government can help set the standard by demonstrating how AI-enabled cyber defense should be responsibly implemented. Ensuring the security of federal civilian, national security, and defense systems involves more than just adding AI tools to existing processes. It requires embedding AI within a comprehensive security framework that includes telemetry, analytics, threat intelligence, automation, and policy enforcement. Achieving this will also depend on adequate personnel and funding, which is why the EO’s mention of advanced AI vulnerability detection grants and expanded cybersecurity hiring pathways is important.

AI is most effective for defenders when it has the right context. Security teams need visibility across users, devices, applications, workloads, identities, networks, and cloud environments. They need to correlate activity across these areas, detect patterns, and respond quickly to malicious behavior. AI can make this work faster and more scalable, but only when it is supported by trusted data and clear governance.

The same principle applies to critical infrastructure. AI-enabled security should not be limited to large enterprises with mature security teams. Smaller and resource-constrained organizations also need access to tools, guidance, and services that help safeguard essential operations.

It is important that cyber inequity is not allowed to grow as security is critical for all organizations and for the health of the economy, so it is critical that smaller organizations are not left behind.

From Policy to Practice

The cybersecurity community has a responsibility to make AI safer, more resilient, and more beneficial for defenders. An effective approach should support innovation, foster trust, and enhance the security of systems used daily by individuals, businesses, and public institutions.

Fortinet’s efforts in AI-enabled security, threat intelligence, secure software development, and partner collaboration are aligned with this challenge. The practical work ahead must focus on helping organizations leverage AI to enhance visibility, prioritize risks, accelerate responses, and reduce exposure across complex environments.

That is where the EO’s success will be measured. While the policy direction is clear, the impact will depend on whether government and industry can translate coordination into faster action, stronger defense, and measurable risk reduction across the systems that matter most.