🔍 Read the full analysis: Where A16z Sees Gaps In Defending US Infrastructure At AI Speed on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Andreessen Horowitz published a proposal on Nov. 12 for securing key U.S. infrastructure as AI accelerates both vulnerability discovery and cyberattacks. It calls for measurable sector targets, CEO accountability and monthly reporting, but it is not government policy and does not specify costs.
Andreessen Horowitz published a proposed U.S. critical-infrastructure cyber defense plan on Nov. 12, calling for the government and industry to protect a few hundred operators and shared vendors whose failure could disrupt services nationwide. Written by a16z General Partner and Head of Global Affairs Anne Neuberger, the plan would set measurable security targets for power, banking and payments, water, communications and hospitals as artificial intelligence speeds up the discovery and exploitation of software weaknesses.
The proposal would assign the White House’s Super Intelligence Force to set national targets, lead monthly reviews with company executives and help clear policy or funding barriers. A council of two or three CEOs from each sector would sign the targets and be publicly accountable for results. Cloud and AI-lab CEOs could join as non-voting members, according to the plan’s illustrative governance table.
Existing Information Sharing and Analysis Centers (ISACs), industry groups that exchange cyber-threat information, would coordinate much of the operational work. The plan says they should run shared AI tools, coordinate fixes with vendors, organize mutual aid and submit anonymized sector-wide metrics each month. A sector falling behind would face a CEO-level review with the task force leader.
Proposed targets include zero internet-exposed control systems, passing 72-hour drills in manual operations, and containing critical vulnerabilities—through a patch or compensating control—within a deadline. The plan says its top targets should be contained within six months. For publicly traded companies, boards would attest to progress metrics, which regulators could accept instead of duplicate audits. The proposal also asks for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and consideration of a safe harbor for companies meeting outcome-based targets.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
A Shortlist for National Cyber Defense
The proposal’s central argument is that defenders cannot secure every system at once as AI shortens the time between finding a weakness and exploiting it. Instead, a16z would prioritize operators and vendors whose disruption could spread across essential services. That focus could direct limited technical support and public attention toward systems with potentially broad consequences, including payment networks, major utilities, telecom infrastructure and hospital services.
The plan also shifts emphasis from sharing threat alerts to measuring whether defenses change. Signed targets, drills and monthly scorecards would give officials and executives a way to track progress, while larger companies could help smaller utilities, hospitals, banks and rural carriers. Those arrangements could matter where smaller operators lack the staff or resources to build equivalent cyber defenses independently.
These are proposed benefits, not demonstrated outcomes. The document does not provide a budget, a cost estimate or evidence that its proposed governance structure would improve security at the stated pace. Its call for legal protection also raises practical questions about how participation and compliance would be judged.
Popular right now
Vitamix 5200 Blender with 64 oz Container, Black
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds with Immersive Audio and Wireless Charging Case, Black
Ninja AF181 Air Fryer XL, 6.5 Qt, 6-in-1, Dark Grey
As an affiliate, we earn on qualifying purchases.
From Government Cyber Work to a16z
Neuberger’s plan draws on her previous government roles. She wrote that she had worked on infrastructure security at the National Security Agency and later as deputy national security adviser for cyber and emerging technology. She now works at a16z, a venture firm that invests in frontier AI labs and security companies. That background is relevant to the proposal’s technical and policy arguments, as is the firm’s investment activity when considering its recommendations and its call to include AI-lab leaders in the governance structure.
The proposal is addressed to the White House’s Super Intelligence Force. President Donald Trump announced the task force on Oct. 4, 2026, and named National Intelligence Director Jay Clayton to lead it, according to NBC News. Trump said it would coordinate federal engagement with critical-infrastructure providers and superintelligence companies. a16z’s document says the proposed effort would be accountable to the task force, but it does not establish that the administration has accepted or begun implementing the plan.
Neuberger also outlined the plan in a Wall Street Journal opinion piece, according to a16z. The proposal frames AI as a tool for both attackers and defenders: it says AI may help identify exposed systems, rank risks and generate fixes, including workarounds for equipment that cannot be patched. Whether those capabilities can be deployed quickly enough is an open question in the plan itself.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z General Partner and Head of Global Affairs, in the plan
Policy, Costs and Safeguards Unsettled
The document is a proposal, not adopted federal policy. The source material does not say whether the White House or the Super Intelligence Force has endorsed it, whether any companies have agreed to participate, or when a formal decision might be made.
The plan names no implementation cost or funding source. It also leaves key operating details open, including how the government would define the highest-priority operators and vendors, verify target completion, set deadlines for all vulnerabilities and respond when organizations miss targets. The source does not specify how a proposed safe harbor would work or what legal protections it would provide.
It is also unclear how AI tools would be tested and deployed across older industrial systems, what safeguards would govern their use, or how responsibilities would be divided among the task force, sector CEOs, lead agencies and ISACs. The governance table is labeled illustrative, so it should not be read as a confirmed organizational arrangement.
Watch for White House Action
The next clear development would be a response from the White House or Super Intelligence Force indicating whether it will consider the proposal. If officials move ahead, the key details to watch would include the sectors and companies covered, target-setting timelines, funding, reporting rules and any legislation or regulation required to establish the program.
Industry participation is another unresolved step. The proposal relies on CEOs signing targets and existing ISACs coordinating work, but the source material identifies no companies that have committed. The plan’s suggested six-month containment period for top targets would apply only if the proposal were adopted and the relevant targets were set; it is not a current government deadline.
Key Questions
What did a16z propose?
a16z proposed a coordinated cyber defense effort focused on a few hundred high-impact infrastructure operators and shared vendors across five sectors: power, banking and payments, water, communications and hospitals. The proposal includes CEO-signed security targets and monthly reporting.
Is the plan U.S. government policy?
No. It is an a16z proposal published on Nov. 12, 2026. The source material does not report that the White House has adopted it.
What security targets does it recommend?
The proposed targets include zero internet-exposed control systems, passing a 72-hour manual-operation drill and containing critical vulnerabilities by a set deadline, through patching or a compensating control. The plan says top targets should be contained within six months.
Who would oversee the proposed effort?
The White House’s Super Intelligence Force would set targets and review results, while a sector CEO council would sign targets and be accountable for progress. Existing ISACs would coordinate tools, fixes, mutual aid and monthly metrics.
What remains unknown?
It is not clear whether officials will act on the proposal, how much it would cost, which organizations would be covered or how its proposed safe harbor would work. No company commitments are identified in the source material.
Source: ThorstenMeyerAI.com
