🔍 Read the full analysis: A Question For A16z’s Plan: Can Infrastructure Defense Keep Up With AI? on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Andreessen Horowitz published a proposal on Nov. 12 for defending critical U.S. infrastructure as AI speeds up cyberattacks and defenses. It would focus on a few hundred operators and shared vendors, set measurable security targets and assign oversight to a White House task force, but it is not government policy and includes no cost estimate.
Venture firm Andreessen Horowitz published a proposed U.S. critical-infrastructure cyber defense plan on Nov. 12, calling for the White House to set security targets for key operators as AI accelerates the discovery and exploitation of software vulnerabilities. The plan, written by a16z General Partner Anne Neuberger, is a proposal—not adopted government policy—and would concentrate on several hundred operators and shared vendors across five sectors.
The plan would focus on power, banking and payments, water, communications and hospitals. Rather than attempt to secure every organization equally, it identifies operators and vendors whose failure could cause wider disruption. Examples named in the proposal include large transmission substations, payment systems, major-city water utilities, core telecommunications and 911 systems, trauma centers and health-record vendors.
For each sector, a CEO council would sign three targets: zero internet-exposed control systems, passing drills for 72-hour manual operation, and containing critical vulnerabilities—through a patch or compensating control—within a set period. The plan says top targets should be contained within six months. Existing Information Sharing and Analysis Centers, or ISACs, would coordinate work and send anonymized sector metrics to the White House task force each month.
The proposed governance structure assigns the White House’s Super Intelligence Force responsibility for setting national targets, chairing monthly CEO reviews and clearing policy or funding barriers. A council of two or three CEOs per sector would answer for results; cloud and AI-lab executives would participate as non-voting members. The plan also proposes legal protections, including long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and possible safe harbor for companies that meet outcome-based targets.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Targets for High-Impact Infrastructure
The proposal’s central argument is that AI could shorten the time between finding a vulnerability and exploiting it, making slow, organization-by-organization security efforts less effective. It argues that AI could also help defenders find exposed systems, rank risks and generate fixes, including workarounds for equipment that cannot be patched. Whether those tools can be deployed quickly enough is an open question raised in the plan itself.
Concentrating resources on operators whose failure could cascade nationally could give government and industry a clearer way to prioritize security work. The proposed drills and exposure targets are intended to measure readiness, not just the exchange of threat alerts. But the framework also relies on cooperation among companies, regulators and government, and would give CEO councils a public accountability role without specifying in the supplied material how targets would be enforced.
The proposal has a direct policy stake for a16z. The firm invests in frontier AI labs and cybersecurity companies, and its plan would include AI-lab leaders in the governance structure as non-voting members. That connection does not establish that the proposal is self-serving, but it is relevant context for readers evaluating who would shape and benefit from a federal approach to AI and infrastructure security.
Products Worth Considering
Canon SELPHY CP1500 Compact Photo Printer Bundle with Ink and Paper Set, White
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
Vari Ergo Electric Standing Desk, 54×26, Light Wood/White
As an affiliate, we earn on qualifying purchases.
Neuberger’s Proposal and the SI Force
Neuberger said she spent several years working on infrastructure security in the U.S. government, including at the National Security Agency and as deputy national security adviser for cyber and emerging technology. She is now a general partner and head of global affairs at a16z. The firm said she also outlined the plan in an opinion piece for The Wall Street Journal.
The plan is addressed to the White House’s Super Intelligence Force. According to NBC News, President Donald Trump announced the task force on Oct. 4, 2026, and named National Intelligence Director Jay Clayton to lead it. Trump said it would coordinate federal engagement with critical infrastructure providers and “Super Intelligence Companies.” a16z’s plan describes its proposed effort as accountable to that force and led by infrastructure-company CEOs.
The proposal would retain federal sector agencies in the process: the Department of Energy for power, Treasury for banks, the Environmental Protection Agency for water, the Federal Communications Commission for communications and the Department of Health and Human Services for hospitals. Its governance table is labeled by a16z as “For illustrative purposes only,” underscoring that the structure is proposed rather than a confirmed operating arrangement.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, writing for Andreessen Horowitz
The proposal does not provide a cost estimate in the supplied material, nor does it spell out how much funding or staff each sector would need. It also does not establish that the White House task force, CEO council or monthly scorecard system has accepted or begun implementing these recommendations.
Key design questions remain open: what counts as meeting each target; who independently verifies company-reported progress; what consequences follow when a sector falls behind; and how a safe harbor would work alongside existing legal and regulatory duties. The plan calls for legal protections but does not set out their final terms. Its specific six-month timeline applies to top targets, while the broader target deadlines are described as set periods rather than fully specified dates.
The plan’s account of AI-assisted attacks and defenses is an argument presented by its authors, not a reported finding that a particular attack has occurred. It is also not clear from the proposal how the system would address smaller organizations that lack technical capacity, although it suggests that larger companies could support local utilities, rural hospitals, community banks and rural carriers.
Whether Washington Adopts the Plan
The next step would be for the White House and the Super Intelligence Force to decide whether to take up the proposal, revise it or pursue a different approach. The source material reports publication of the plan, but does not identify a government response, implementation schedule or formal consultation process.
If policymakers advance it, the unresolved details would need to be addressed: sector targets and deadlines, funding, verification, agency responsibilities, the role of ISACs and the scope of any legal safe harbor. Until those decisions are made, the proposed councils and monthly scorecards remain elements of a16z’s suggested framework, not confirmed federal policy.
Key Questions
What did a16z propose?
a16z proposed a White House-led cybersecurity framework that would prioritize key infrastructure operators, set measurable sector targets and use monthly scorecards to track progress.
Which sectors would the plan cover?
The proposal names power, banking and payments, water, communications and hospitals, with attention to operators and vendors whose disruption could have wider effects.
Is the plan already government policy?
No. The plan was published by a16z on Nov. 12, 2026, as a proposal. The source material does not report that the government has adopted or begun implementing it.
What cybersecurity targets does it suggest?
It calls for zero internet-exposed control systems, successful 72-hour manual-operation drills and containment of critical vulnerabilities within set periods. The proposal says top targets should be contained within six months.
What remains uncertain?
The proposal gives no cost estimate and does not settle how targets would be independently verified, enforced or funded. The terms of any proposed legal safe harbor are also not specified in the supplied material.
Source: ThorstenMeyerAI.com
