🔍 Read the full analysis: A16z’s Strategy For Defending US Infrastructure In The AI Era on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Andreessen Horowitz published a proposal on Nov. 12 for defending five U.S. infrastructure sectors against faster, AI-enabled cyber threats. It calls for White House-set targets, CEO accountability and monthly scorecards, but remains a proposal; costs, implementation details and government adoption are unclear.
Venture firm Andreessen Horowitz (a16z) published a proposal on Nov. 12 for a U.S. cybersecurity program that would focus on a few hundred operators and shared vendors whose failure could disrupt essential services. Written by Anne Neuberger, a16z’s general partner and head of global affairs, the plan would set measurable security targets for five sectors and place senior executives under recurring review; it is a proposal, not current policy.
The plan targets power, banking and payments, water, communications and hospitals. Rather than attempt to secure every organization equally, it argues that national risks are concentrated among operators and vendors whose systems underpin services across the country. Examples named in the proposal include large transmission substations, Fedwire and ACH payment systems, major-city water utilities, core telecom networks and 911 systems, regional trauma centers and health-record vendors.
Its proposed governance structure has the White House’s Super Intelligence Force set national targets, chair monthly reviews and address policy or funding barriers. A council of two or three CEOs per sector would sign the targets and answer publicly for progress. Cloud and AI-lab CEOs would participate as non-voting members, according to a16z’s illustrative governance table. Existing sector Information Sharing and Analysis Centers, or ISACs, would coordinate work, share metrics and help organize fixes with vendors.
Each sector’s executives would sign up to three outcomes: zero internet-exposed control systems, passing drills for operating manually for 72 hours, and containing critical vulnerabilities—through a patch or another control—within a specified time. ISACs would send anonymized sector-wide scorecards to the proposed White House body each month. A sector that fell behind would face a CEO-level review. The proposal says public-company boards could attest to progress, with regulators accepting that attestation instead of duplicate audits.
The suggested response also includes support for smaller organizations. The plan proposes that large utilities help municipal providers, major health systems support rural hospitals, large banks fund tools for community banks, and national carriers assist rural carriers. It calls for a long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and a potential safe harbor for companies that meet outcome-based targets. Those measures, like the rest of the plan, are recommendations rather than enacted commitments.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
A Narrower Target for Cyber Defense
The proposal’s central policy choice is to concentrate effort on high-impact operators and shared vendors, rather than treating every organization as an equal priority. If adopted, common targets and regular reporting could give government agencies and infrastructure companies a shared way to identify weak points and track whether they are being addressed. The proposed 72-hour manual-operation drills also focus attention on whether essential services can continue when digital systems are unavailable.
The plan argues that AI can accelerate both attacks and defense: tools may help find weaknesses and generate fixes more quickly, while attackers may use similar capabilities to exploit them. That is a risk assessment made by a16z, not evidence in the source material that every system is already facing AI-driven attacks. The practical value of the proposal would depend on whether organizations can meet its targets, whether regulators recognize the scorecards, and whether the government provides funding and legal protections.
There is also a governance question. a16z invests in frontier AI labs and security companies, and its plan gives AI-lab and cloud executives a role in discussions as non-voting members. That creates a reason to scrutinize how participation would be structured and how conflicts of interest would be managed. The source material does not describe a formal process for doing so.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
Apple MacBook Pro 14.2-Inch Laptop with M6 Chip, Space Black
LG UltraGear 32-Inch QHD 180Hz Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Government Cybersecurity to a16z
Neuberger’s proposal draws on her prior public service. She said she worked on infrastructure security inside the U.S. government, first at the National Security Agency and later as deputy national security adviser for cyber and emerging technology. She now leads global affairs at a16z, which published the plan and said she also outlined it in a Wall Street Journal opinion piece.
The proposal is addressed to the White House’s Super Intelligence Force. The source material says President Donald Trump announced the task force on Oct. 4, 2026, and named National Intelligence Director Jay Clayton to lead it, citing NBC News. The plan describes the body as responsible for coordinating federal engagement with critical infrastructure providers and AI companies. It does not establish that the task force has accepted or is implementing a16z’s recommendations.
For day-to-day coordination, the plan would build on sector ISACs rather than replace them. It proposes expanding their role from sharing threat alerts to operating shared AI tools, coordinating remediation with vendors, organizing mutual aid and reporting progress. The sector lead agencies listed in the proposal are the Energy Department for power, Treasury for banks, the Environmental Protection Agency for water, the Federal Communications Commission for communications and the Department of Health and Human Services for hospitals.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z general partner and head of global affairs, as quoted in the plan
Adoption, Costs and Safeguards
No federal adoption of the plan is confirmed in the source material. It does not say whether the Super Intelligence Force, sector regulators, infrastructure companies or Congress have endorsed the recommendations. The proposed CEO council is described in an illustrative table, not as an established body.
The proposal provides no cost estimate or detailed funding mechanism. It also does not specify the deadlines for containing vulnerabilities, how compliance would be independently verified, or what consequences would follow if a sector missed its targets. The suggested legal safe harbor is described as potential, with no terms supplied; the scope of any reauthorization of the 2015 information-sharing law is also not detailed.
It remains unclear how the proposed targets would apply to different kinds of operators, how sensitive performance data would be protected, and how conflicts of interest involving participating AI and cloud companies would be handled. The source material also does not establish how quickly AI-assisted tools can be deployed across older systems that may be difficult to patch.
From Proposal to Federal Action
The next step would be a decision by the White House and relevant agencies on whether to take up any part of the plan. If they do, the proposal points toward sector-specific targets, a CEO council and expanded ISAC responsibilities, but the source material gives no confirmed timetable for those actions. Congress would also need to consider any requested long-term reauthorization of the information-sharing law or legislation creating legal protections.
Readers should watch for an official response from the Super Intelligence Force, named agencies or infrastructure-sector organizations, as well as details on funding, audit rules and the proposed safe harbor. Until those are announced, the targets and governance structure remain a16z recommendations, not obligations on U.S. companies.
Key Questions
What did a16z propose?
a16z proposed a White House-led cybersecurity program focused on high-impact operators and shared vendors in power, banking and payments, water, communications and hospitals. It would set sector targets, review CEO accountability and use monthly scorecards.
Is the plan U.S. government policy?
No. The source describes it as an a16z proposal. It does not confirm that the White House, the Super Intelligence Force, Congress or regulators have adopted it.
What security targets does the plan recommend?
It proposes zero internet-exposed control systems, passing 72-hour manual-operation drills, and containing critical vulnerabilities by a set deadline, through patching or another control.
Who would oversee the work?
Under the proposal, the White House’s Super Intelligence Force would set targets, a CEO council would answer for results, and existing sector ISACs would coordinate work and report monthly metrics.
What remains unknown?
Whether the plan will be adopted, what it would cost, how targets would be verified and what legal protections would cover participating companies are not specified or confirmed in the source material.
Source: ThorstenMeyerAI.com
