🔍 Read the full analysis: How A16z’s Plan Tackles US Infrastructure Defense At AI Speed on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Andreessen Horowitz published a proposal on November 12 for protecting key U.S. infrastructure as AI speeds up cyberattacks and defense. It calls for measurable targets across five sectors, a White House-led oversight structure and legal protections for companies that meet the targets; it is not government policy, and the proposal gives no cost estimate.
Andreessen Horowitz (a16z) published a proposal on November 12 for a White House-led effort to defend key U.S. infrastructure against cyber threats accelerated by AI. Written by a16z General Partner and Head of Global Affairs Anne Neuberger, the plan would focus on a few hundred operators and shared vendors in five sectors, set cybersecurity targets for their CEOs and track progress through monthly scorecards. It is a proposal, not government policy.
The plan’s central choice is to prioritize organizations whose disruption could affect services across the country, rather than try to secure every system at once. It identifies power, banking and payments, water, communications, and hospitals as the sectors for an initial effort. Examples named in the proposal include large transmission substations, major payment systems, urban water utilities, core telecom networks and emergency services, regional trauma centers, and health-record vendors.
For each sector, the plan proposes that CEOs sign up to three targets: zero internet-exposed control systems, passing manual-operation drills that last 72 hours, and containing critical vulnerabilities—by patching or using a compensating control—within a set period. The proposal says the top targets should be contained within six months. It does not provide a full implementation schedule for every target.
The proposed oversight chain would put the White House’s Super Intelligence Force in charge of setting national targets, holding monthly CEO reviews and addressing policy or funding obstacles. A CEO council would answer for sector results, while existing Information Sharing and Analysis Centers (ISACs) would coordinate technical work, share tools, arrange vendor fixes and report anonymized metrics each month. If a sector fell behind, the plan says it would trigger a CEO-level review. The governance table describes the structure as “for illustrative purposes only.”
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Targets Put CEOs on the Hook
The plan would shift some infrastructure cybersecurity work from voluntary information-sharing toward measurable sector targets and named executive responsibility. That could make it easier for government and companies to see whether high-impact systems are becoming more resilient, rather than relying only on threat alerts or broad commitments. The proposal also calls for boards of public companies to attest to progress, with regulators accepting those attestations in place of duplicate audits.
Its focus on a limited set of operators reflects a risk-management argument: a failure at a major provider or shared vendor could affect many customers and services. The proposal says AI could help defenders find exposed systems, rank their importance and create fixes faster. It also warns that attackers may use AI to identify weaknesses more quickly. These are the proposal’s rationale and expectations, not evidence that the proposed tools have already delivered the promised speed or results.
The plan asks for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and proposes potential safe-harbor protections for companies that meet outcomes-based targets. Those provisions could affect how organizations share threat information and how they approach compliance, but the source does not specify the legal design or boundaries of the safe harbor.
Products Worth Considering
DJI Mini 5 Pro Fly More Combo with DJI RC 2
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds with Immersive Audio and Wireless Charging Case, Black
Apple Watch SE 3 GPS 44mm Smartwatch
As an affiliate, we earn on qualifying purchases.
From Threat Sharing to Measurable Targets
Neuberger’s proposal frames AI as shortening the time between discovery of a weakness and its exploitation. It argues that defenders could use AI to detect exposed equipment and develop fixes, including workarounds for older systems that cannot be patched. The plan itself leaves the key operational question open: whether those defensive uses can be applied quickly enough.
Neuberger says she worked on infrastructure security in government, first at the National Security Agency and later as deputy national security adviser for cyber and emerging technology. a16z says she also outlined the plan in a Wall Street Journal opinion piece. The proposal is directed to the White House’s Super Intelligence Force. President Donald Trump announced the task force on October 4, 2026, and named National Intelligence Director Jay Clayton to lead it, according to NBC News, as cited by the source material.
The plan would use sector ISACs rather than create a wholly new operational network. It also assigns roles to federal lead agencies: the Department of Energy for power, Treasury for banking, the Environmental Protection Agency for water, the Federal Communications Commission for communications, and the Department of Health and Human Services for hospitals. Large firms would help smaller providers, including utilities, rural hospitals, community banks and rural carriers, according to the proposal.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z General Partner and Head of Global Affairs, in the proposal
Costs and Legal Safeguards Unspecified
The source material reports no government decision to adopt the plan, and it gives no cost estimate, detailed funding mechanism or complete timetable. It also does not define how operators and shared vendors would be selected, how targets would be tailored to different systems, or what evidence would count as meeting each target.
The proposed safe harbor remains broad: the plan calls for considering legal protection for companies meeting outcomes-based goals but does not specify which liabilities or enforcement actions it would cover. The proposal also does not explain how monthly metrics would be verified, what consequences would follow repeated failures, or how public reporting would balance accountability with sensitive security information. Its claim that risk is concentrated in a few hundred operators is a planning premise, not an independently confirmed count in the supplied material.
Adoption Would Require Federal Action
The next step would be for the White House and relevant agencies to decide whether to adopt, revise or reject the proposal. If officials proceed, they would need to establish the task force’s authority, select participating operators, define sector targets and determine how ISACs, regulators and companies would report and verify progress.
Congress would also have a role if the effort depends on reauthorizing the 2015 information-sharing law or creating a safe harbor. Until those decisions are made public, the plan remains a set of recommendations from a venture firm, rather than a binding cybersecurity program. The source material does not identify a formal review date or government response.
Key Questions
What did a16z propose?
a16z proposed a White House-led cybersecurity effort focused on high-impact operators and shared vendors in five infrastructure sectors, with CEO-signed targets and monthly progress reporting.
Is the plan U.S. government policy?
No. The source describes it as a proposal. It does not report that the White House or Congress has adopted it.
What cybersecurity targets would companies face?
The proposal lists zero internet-exposed control systems, passing 72-hour manual-operation drills and containing critical vulnerabilities within a set period. It says the top targets should be contained within six months.
Which sectors would be included?
The proposed initial scope is power, banking and payments, water, communications, and hospitals.
What remains unknown about implementation?
The proposal gives no cost estimate and does not settle how participants would be chosen, how compliance would be verified, or what legal protections a safe harbor would provide. No formal adoption timetable is reported.
Source: ThorstenMeyerAI.com
