🔍 Read the full analysis: A16z’s US Infrastructure Strategy: AI-Speed Defense And Readiness Drills on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Andreessen Horowitz published a proposal on Nov. 12 for defending five U.S. critical-infrastructure sectors against cyber threats accelerated by AI. It calls for measurable security targets, CEO accountability and monthly reporting, but it is not government policy and does not specify costs.
Venture firm Andreessen Horowitz (a16z) published a proposal on Nov. 12 for a U.S. cyber defense effort that would set measurable security targets for operators in power, banking and payments, water, communications and hospitals. Written by a16z General Partner Anne Neuberger, the plan would put the White House’s Super Intelligence Force in a coordinating role and ask company leaders to oversee readiness as AI accelerates both cyberattacks and defensive work.
The proposal says the government should prioritize a few hundred infrastructure operators and shared vendors whose disruption could have national consequences, rather than trying to secure every system at once. It names examples including large transmission substations, payment networks, major-city water utilities, core telecom and 911 systems, regional trauma centers and health-record vendors. That estimate and prioritization are a16z’s assessment, not a government finding.
For each sector, participating CEOs would sign targets covering zero internet-exposed control systems, passing 72-hour manual-operation drills, and containing critical vulnerabilities—through a patch or compensating control—within a set period. The plan says top targets should be contained within six months. Industry Information Sharing and Analysis Centers, or ISACs, would coordinate shared AI tools, vendor fixes and mutual aid, then submit anonymized metrics monthly. A sector falling behind would face a CEO-level review.
The proposed governance structure assigns target-setting and monthly review to the White House’s Super Intelligence Force. A CEO council would include two or three CEOs per sector; cloud and AI-lab executives would participate as non-voting members. Existing federal sector agencies would remain involved. The plan also proposes board attestations for public companies, potentially accepted by regulators instead of duplicate audits, and asks Congress to reauthorize the Cybersecurity Information Sharing Act of 2015 and consider a safe harbor for companies meeting outcome-based targets.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
A Narrower Focus for Infrastructure Defense
The plan’s central argument is that AI may compress the time between finding a weakness and exploiting it, leaving organizations that rely on slower, manual processes at risk. It also argues that AI could help defenders identify exposed systems, rank risks and generate fixes. For equipment that cannot be patched, the proposal points to compensating measures such as firewall rules or configuration changes. These are the plan’s claims about potential uses, not evidence that those capabilities are already deployed broadly or work reliably in every setting.
Its focus on a limited set of operators could make national efforts more manageable: shared vendors and highly connected systems can affect many services at once. The proposed drills would test whether essential operations can continue during a prolonged disruption, rather than measuring security only through audits or written plans. Monthly scorecards could also make progress visible to senior leaders. The trade-off is that choosing which organizations and systems qualify as top priorities would shape where attention and resources go.
For companies, the proposal pairs accountability with requested legal protection and possible relief from duplicate audits. That may make participation more attractive, but the safe harbor is only a request, and the article does not specify its legal scope or safeguards. Because a16z invests in frontier AI and security companies, its proposal also raises a governance question: how cloud providers and AI companies would participate in decisions affecting infrastructure security, even with non-voting status.
Products Worth Considering
DJI Osmo Mobile 8 Phone Gimbal with Mic Mini Transmitter, Infinity Black
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Bose QuietComfort Wireless Noise-Cancelling Headphones, White Smoke
As an affiliate, we earn on qualifying purchases.
Neuberger’s Government and Policy Links
Neuberger wrote that she had worked on infrastructure security inside the U.S. government, including at the NSA and as deputy national security adviser for cyber and emerging technology. She is now a general partner and head of global affairs at a16z. The plan is therefore a proposal from a venture firm, authored by someone with prior government experience; it is not an announcement by the White House.
The plan is addressed to the White House’s Super Intelligence Force. The source article reports that President Donald Trump announced the task force on Oct. 4, 2026, and named National Intelligence Director Jay Clayton to lead it. The plan describes the force as a potential coordinator, but publication does not establish that the administration has accepted or is implementing a16z’s recommendations.
a16z also said Neuberger outlined the plan in an opinion piece in The Wall Street Journal. Its governance table is marked “for illustrative purposes only,” a qualification that underscores that the proposed council and reporting chain are not confirmed operating arrangements.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z general partner and head of global affairs, in the proposal
The plan is a proposal, not policy. It does not say whether the White House or the Super Intelligence Force will adopt it, whether the named agencies and companies would participate, or what legal authority the proposed force would use to set targets and review results. The source provides no cost estimate, funding plan or implementation schedule for the wider program.
Several operating details are also unresolved. The proposal does not identify which organizations would count among the priority operators, how sector targets would be tailored to older or difficult-to-replace equipment, or how results and sensitive infrastructure data would be protected. It calls for a possible safe harbor but does not spell out eligibility, liability limits or enforcement. The source gives no independent evidence that the proposed six-month timeline is feasible across all five sectors.
It is also unclear whether the task force has considered the proposal, how any CEO council would be selected, or what role companies with investments in AI and cybersecurity would have beyond the described non-voting participation for cloud and AI-lab CEOs. Those questions matter because the plan assigns major responsibilities to private operators while requesting legal protections for them.
Watch for White House and Congressional Action
The next meaningful developments would be an official response from the White House or the Super Intelligence Force, followed by any decision to convene the proposed CEO council or ask agencies and ISACs to develop sector targets. Until that happens, the plan’s targets and monthly scorecards remain recommendations rather than obligations.
Congress would need to act on the proposal’s request for a long-term reauthorization of the Cybersecurity Information Sharing Act of 2015. Any safe harbor would also require a defined legal approach; the source does not identify a bill, deadline or formal process. If officials take up the recommendations, details to watch include funding, which organizations are covered, how progress is verified, and how public reporting would avoid exposing sensitive security information.
a16z has not provided a confirmed implementation timetable in the source material. The proposal’s immediate next step is therefore consideration by policymakers and infrastructure operators, not a scheduled nationwide rollout.
Key Questions
What did a16z propose?
a16z proposed a U.S. cyber defense effort focused on power, banking and payments, water, communications and hospitals. It would set sector targets, assign oversight to company leaders and use monthly ISAC scorecards.
Is the plan now U.S. government policy?
No. It is an a16z proposal. The source does not report that the White House or the Super Intelligence Force has adopted it.
What readiness targets does it recommend?
The proposal calls for zero internet-exposed control systems, successful 72-hour manual-operation drills and containment of critical vulnerabilities within a set period. It says top targets should be contained within six months.
Who would oversee the work?
The proposed structure gives the White House’s Super Intelligence Force a coordinating role, with a CEO council accountable for results and sector ISACs handling coordination, reporting and shared tools. These arrangements are illustrative, not confirmed.
What remains unknown?
The proposal does not provide a cost estimate, implementation timetable or confirmed list of participating operators. Its requested safe harbor, target-setting authority and treatment of sensitive reporting data also remain undefined.
Source: ThorstenMeyerAI.com
