🔍 Read the full analysis: A16z’s Plan To Defend US Infrastructure: The AI-Speed Challenge on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Andreessen Horowitz published a proposal on Nov. 12 for protecting U.S. critical infrastructure against cyber threats accelerated by AI. It would set measurable targets for operators in five sectors and assign oversight to a White House task force, but it remains a proposal with no stated cost or adopted federal mandate.
Venture firm Andreessen Horowitz (a16z) published a plan on Nov. 12 urging the U.S. government and major companies to strengthen cyber defenses at a limited set of infrastructure operators whose disruption could have national consequences. Written by a16z General Partner and Head of Global Affairs Anne Neuberger, the proposal calls for measurable security targets across power, banking and payments, water, communications and hospitals; it has not been adopted as government policy.
The plan argues that artificial intelligence is compressing the time between discovery of a software weakness and its exploitation. It proposes using AI defensively to find exposed systems, prioritize risks and help generate fixes. For equipment that cannot be patched, the essay says AI could help develop compensating measures, such as firewall rules or configuration changes. Whether those defenses can be deployed quickly enough remains an open question, the authors acknowledge.
Rather than attempt to secure every system at once, a16z says the government should concentrate on a few hundred operators and shared vendors whose failure could cascade across sectors. Examples listed in the proposal include major transmission substations, payment networks, large-city water utilities, core telecommunications and 911 systems, regional trauma centers and health-record vendors.
The proposed governance structure assigns the White House’s Super Intelligence Force responsibility for setting national targets, convening monthly CEO reviews and clearing policy or funding obstacles. A council of two or three CEOs per sector would sign performance targets and answer publicly for results. Existing Information Sharing and Analysis Centers, or ISACs, would coordinate operational work, including shared AI tools, vendor fixes, mutual aid and monthly sector scorecards. The plan says cloud and AI-lab CEOs could participate as non-voting members.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Targets for High-Impact Operators
The proposal would shift attention from broad calls for better cybersecurity toward specific outcomes at selected operators. CEOs would sign targets covering zero internet-exposed control systems, successful 72-hour manual-operation drills, and containment of critical vulnerabilities within a set period. The plan says the highest-priority targets should be contained within six months.
That focus could make progress easier to track, but it would also place responsibility on a relatively small group of companies and their shared suppliers. A failure at a key operator can affect services beyond that company; the proposal’s emphasis on dependencies reflects the possibility that risks in vendors or connected systems could cross sector lines.
a16z also proposes that large companies help smaller organizations, including utilities supporting municipal providers and large health systems assisting rural hospitals. If implemented, that approach could address uneven security resources. The document does not specify how such support would be funded or what obligations participating firms would face.
Popular right now
Dyson V8 Motorhead Origin Cordless Vacuum
Ninja Foodi DualZone Smart XL Air Fryer, 10 Qt, 6-in-1, Black (DZ550)
Philips 2200 Series Fully Automatic Espresso Machine with Classic Milk Frother
As an affiliate, we earn on qualifying purchases.
From Cyber Alerts to Accountability
The plan is addressed to the White House’s Super Intelligence Force, which the source material says President Donald Trump announced on Oct. 4, 2026, naming National Intelligence Director Jay Clayton to lead it. According to NBC News, Trump described the task force as coordinating federal engagement with critical infrastructure providers and AI companies. The proposal’s suggested role for that body is not evidence that it has accepted the plan.
Neuberger says she worked on infrastructure security inside the U.S. government, at the National Security Agency and later as deputy national security adviser for cyber and emerging technology. She now works at a16z. The firm’s essay also calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and consideration of a safe harbor for companies that meet outcomes-based targets.
The proposal describes the CEO council and governance arrangements as illustrative. It leaves existing sector agencies in the structure: the Department of Energy for power, Treasury for banks, the Environmental Protection Agency for water, the Federal Communications Commission for communications and the Department of Health and Human Services for hospitals.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z General Partner and Head of Global Affairs
The document is a proposal, not an announced federal program. It does not establish whether the White House task force will adopt it, whether sector CEOs or ISACs would agree to take on the proposed responsibilities, or how any targets would be enforced. The governance table is described by a16z as illustrative, rather than a finalized structure.
No cost estimate or detailed funding mechanism is provided. The plan also does not spell out the measurement rules for each target, the timeline for every sector, or how a safe harbor would work in practice. Its call for legal protection and changes to information-sharing law would require further policy decisions.
a16z invests in AI companies and cybersecurity firms, sectors that could be involved in the approach it proposes. That relationship is relevant context for readers, but it does not by itself establish that the proposal would benefit any particular portfolio company. The source material does not identify specific firms that would receive contracts or other advantages.
Whether Washington Takes It Up
The next step is unclear: a16z has published its recommendations, but the source material reports no government decision, implementation timetable or formal response from the Super Intelligence Force. Readers should distinguish the essay’s suggested targets and reporting structure from requirements currently in force.
If federal officials pursue the proposal, the main milestones would include deciding which operators qualify, setting sector-specific deadlines and measures, and determining funding and legal protections. The plan proposes monthly scorecards and a CEO-level review when a sector falls behind, but those processes would need agreement and operational detail before they could be treated as an active program.
Key Questions
What did a16z propose?
a16z proposed a White House-led cybersecurity effort focused on key operators and shared vendors in five sectors: power, banking and payments, water, communications and hospitals. It calls for signed security targets, operational drills and monthly scorecards.
Is the plan now U.S. government policy?
No. The source describes it as a proposal. It does not report that the White House or the Super Intelligence Force has adopted it.
What targets would companies face under the proposal?
CEOs would sign targets covering zero internet-exposed control systems, passing 72-hour manual-operation drills and containing critical vulnerabilities within a set time. The plan says top-priority targets should be contained within six months.
How would smaller infrastructure providers be included?
The proposal suggests that larger organizations support smaller ones, such as utilities helping city providers and large health systems assisting rural hospitals. It does not specify the cost or exact obligations for those arrangements.
What remains unknown?
It is not clear whether officials will adopt the plan, how it would be funded, how targets would be measured or enforced, or what legal protections participating companies would receive.
Source: ThorstenMeyerAI.com
