🔍 Read the full analysis: A16z’s AI-Speed Blueprint For US Infrastructure Comes With Gaps on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Andreessen Horowitz published a proposal on November 12 for speeding up cyber defense across five critical infrastructure sectors, using AI tools, CEO-signed targets and monthly scorecards. It is a proposal, not government policy; it does not specify costs, and its proposed legal protections and governance arrangements remain unresolved.
Andreessen Horowitz (a16z) published a proposed cyber defense plan on November 12 that would use AI tools, CEO commitments and monthly reporting to protect selected operators in five US infrastructure sectors: power, banking and payments, water, communications and hospitals. The proposal is addressed to the White House’s Super Intelligence Force, but it is not government policy, and it does not provide a cost estimate.
The plan, titled “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan,” was written by Anne Neuberger, an a16z general partner and head of global affairs. The firm said Neuberger also outlined the proposal in an opinion piece for The Wall Street Journal. It argues that AI is shortening the time between discovering a software weakness and exploiting it, while proposing that defenders use AI to find exposed systems, prioritize risks and generate fixes.
Rather than try to secure every organization, a16z says the effort should concentrate on a few hundred operators and shared vendors whose disruption could cascade nationally. Examples named in the plan include large transmission substations, payment networks, major-city water utilities, core telecom and 911 systems, regional trauma centers and health-record vendors. The firm’s view that the risk is concentrated is a claim made in the proposal, not an independently established count or assessment.
The plan gives the White House’s Super Intelligence Force responsibility for setting national targets and convening monthly reviews. A council with two or three CEOs from each sector would sign commitments and be publicly accountable for results; cloud and AI-lab CEOs would participate as non-voting members. Existing sector Information Sharing and Analysis Centers (ISACs) would coordinate tools, fixes and mutual aid, then submit anonymized metrics each month. The plan identifies the Department of Energy, Treasury, EPA, FCC and HHS as lead agencies for the five sectors.
Each sector’s CEOs would sign up to three targets: zero internet-exposed control systems, passing 72-hour manual-operation drills, and containing critical vulnerabilities—by patching or using a compensating control—within a set period. The proposal says top targets should be contained within six months, though it does not specify a complete schedule for every target. A sector falling behind would face a CEO-level review. Boards of public companies would attest to progress metrics, which regulators could accept instead of duplicate audits.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
How the Plan Would Change Cyber Response
The proposal would shift some infrastructure cyber defense from voluntary information-sharing toward measurable commitments and recurring executive scrutiny. A monthly scorecard and a review triggered by missed targets could make cyber readiness a matter for company leadership, not just security teams. The 72-hour manual-operation drill would also test whether essential services could continue when connected systems are unavailable.
That focus matters because power, payment, water, communications and hospital systems support daily life and can depend on common vendors. A weakness in a shared supplier may affect multiple operators. a16z proposes that larger organizations help smaller ones—for example, large health systems supporting rural hospitals and major utilities assisting municipal providers—but it gives no funding model or detailed account of how those commitments would be enforced.
The plan also recognizes that some older equipment cannot readily be patched. It suggests AI could help defenders devise compensating measures, such as firewall rules or settings changes. That could broaden the response beyond replacing equipment, but it does not establish that AI-generated fixes will be safe, effective or deployable quickly enough. The proposal itself frames speed as an open challenge.
Products Worth Considering
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
Dell UltraSharp U4025QW 40 5K2K WUHD Curved LED Monitor (21:9)
Apple MacBook Pro 14.2-Inch Laptop with M6 Chip, Space Black
As an affiliate, we earn on qualifying purchases.
From Government Cyber Work to a16z
Neuberger wrote that she had worked on infrastructure security inside the US government, first at the NSA and later as deputy national security adviser for cyber and emerging technology. She now works at a16z, a venture firm that invests in frontier AI labs and security companies. That background informs the plan, while the firm’s investments are relevant when considering its proposal to give cloud and AI-lab leaders a role in the process.
The proposed recipient, the Super Intelligence Force, was announced by President Donald Trump on October 4, 2026. NBC News reported that Trump named National Intelligence Director Jay Clayton to lead it. Trump said the task force would coordinate federal engagement with critical infrastructure providers and “Super Intelligence Companies.” The plan’s suggested governance model is separate from that announcement: a16z’s published material does not establish that the White House has accepted or adopted it.
Neuberger’s proposal describes AI as a tool for both attackers and defenders. It says models may help identify vulnerabilities faster, but argues that defenders could use them to discover exposed systems, rank their importance and generate remedies. The central premise is that response methods built around human-speed analysis may not keep pace. That is the author’s rationale for setting shared targets and organizing action around existing sector groups.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, in a16z’s plan
Costs, Legal Protections and Oversight
The proposal does not name a budget, funding source or cost allocation for AI tools, remediation work, drills or support for smaller operators. It also does not detail how the six-month target would apply across sectors with different equipment, risks and upgrade timelines, or how authorities would verify that companies meet the proposed measures.
a16z calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and suggests a potential safe harbor for companies meeting outcomes-based targets. Those are requests, not existing protections. The proposal does not set out the legal terms, eligibility rules or limits of such a safe harbor. It also remains unclear how the proposed CEO council would be established, how its membership would be selected, and how public accountability would work alongside anonymized monthly reporting.
The plan gives cloud and AI-lab executives non-voting roles, but does not explain how conflicts of interest would be managed. a16z invests in frontier AI and security companies, categories that could be involved in tools or services contemplated by the plan. The published material does not specify procurement rules or other safeguards related to those interests. Nor does it show that the White House or sector companies have agreed to participate.
Whether Washington Takes Up the Proposal
The next substantive step would be a decision by the White House’s Super Intelligence Force on whether to review, revise or adopt any part of the plan. The source material does not provide a government response or a timetable for action. It also does not report that the proposed CEO council has been formed or that sector targets have been signed.
If officials pursue the proposal, further details would be needed on financing, target deadlines, measurement, oversight and the suggested safe harbor. Companies and existing ISACs would also need to clarify their roles, especially the practical support available to smaller operators. Until those decisions are documented, the plan remains a16z’s policy proposal, not an active national program.
Key Questions
What did a16z propose?
a16z proposed a White House-coordinated cyber defense effort focused on selected operators in power, banking and payments, water, communications and hospitals. It would use CEO commitments, ISAC coordination, AI-assisted tools and monthly progress reporting.
Is the plan US government policy?
No. It was published by a16z on November 12, 2026, and the available source material does not say the White House adopted it. It remains a proposal.
What targets would companies be asked to meet?
The proposal calls for zero internet-exposed control systems, passing a 72-hour manual-operation drill and containing critical vulnerabilities within a set period. It says top targets should be contained within six months, but does not provide a full sector-by-sector schedule.
Would the plan give companies legal protection?
a16z asks for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and suggests a possible safe harbor for companies that meet outcome-based targets. Those protections are not established by the proposal; their terms and legal status remain unresolved.
What is still unknown?
The plan does not specify its costs, funding sources, enforcement arrangements or detailed verification process. It is also unclear whether the White House, infrastructure operators, ISACs or regulators will take part.
Source: ThorstenMeyerAI.com
