🔍 Read the full analysis: The Gaps In A16z’s Plan To Defend Infrastructure At AI Speed on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Andreessen Horowitz published a proposal on Nov. 12 for protecting five U.S. infrastructure sectors against cyber threats accelerated by AI. It calls for CEO-signed security targets, monthly reporting and White House oversight, but it is not government policy and does not specify costs or settle the terms of proposed legal protections.
Venture firm Andreessen Horowitz (a16z) published a proposal on Nov. 12 for protecting U.S. critical infrastructure against cyber threats that it says are accelerating with AI. Written by partner Anne Neuberger, the plan would set measurable targets for operators in five sectors and put the White House’s Super Intelligence Force in charge of oversight; it is a proposal, not adopted policy.
The plan’s central premise is that the government should prioritize the few hundred operators and shared vendors whose failure could cause wider disruption, rather than attempt to secure every organization equally. Its five sectors are power, banking and payments, water, communications, and hospitals. Examples named in the proposal include large transmission substations, payment systems, major-city water utilities, core telecom networks and 911 systems, trauma centers, and health-record vendors.
For each sector, the proposal calls for CEOs to sign three outcome-based targets: zero internet-exposed control systems, successful drills showing staff can operate manually for 72 hours, and critical vulnerabilities patched or addressed with compensating controls within a set period. The proposal says its top targets should be met within six months, although it does not provide a complete sector-by-sector timetable.
Under the proposed governance structure, the White House Super Intelligence Force would set national targets, chair monthly CEO reviews and address policy or funding barriers. A council of two or three CEOs per sector would answer for results, while existing Information Sharing and Analysis Centers, or ISACs, would coordinate shared tools and fixes and send anonymized monthly metrics. The plan also proposes board attestations for public companies in place of duplicate regulatory audits.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Targets for Five Infrastructure Sectors
The proposal would shift cyber defense toward measurable operational outcomes and shared accountability. Rather than rely mainly on threat alerts or company-by-company audits, it would ask sector leaders to demonstrate that exposed control systems have been removed, manual operations have been tested, and serious vulnerabilities have been contained. That could give government and operators a common way to track preparedness, if the targets are defined and adopted.
Its focus on shared vendors reflects the possibility that a failure at a common service provider could affect multiple operators at once. The plan argues that AI could help defenders find exposed systems, rank risks and generate fixes faster. It also says AI might help address equipment that cannot be patched, for example through firewall rules or settings changes. Those are claims in the proposal, not independently established results presented in the source material.
The approach would also make senior executives publicly accountable and ask larger companies to support smaller ones, including rural utilities, hospitals, carriers and community banks. That could spread security resources beyond the largest organizations, but the proposal does not explain how much that support would cost or how responsibilities would be divided.
Products Worth Considering
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
DJI Osmo Mobile 8 Phone Gimbal with Mic Mini Transmitter, Infinity Black
As an affiliate, we earn on qualifying purchases.
Neuberger’s Shift to a16z
Neuberger wrote the plan after serving in U.S. government cybersecurity roles. She said she had worked on infrastructure security at the National Security Agency and later as deputy national security adviser for cyber and emerging technology. a16z identifies her as a general partner and head of global affairs. The firm says she also outlined the proposal in a Wall Street Journal opinion piece.
The proposal is directed at the White House’s Super Intelligence Force. According to NBC News, President Donald Trump announced the task force on Oct. 4, 2026, and named National Intelligence Director Jay Clayton to lead it. The proposal describes the force as the body that would set targets and oversee CEO reviews; the source material does not establish that the task force has accepted or acted on the plan.
a16z’s governance table is labeled “For illustrative purposes only.” It assigns federal agencies existing sector roles: Energy for power, Treasury for banks, the Environmental Protection Agency for water, the Federal Communications Commission for communications, and Health and Human Services for hospitals. The plan would retain those agencies while elevating coordination through the White House and sector councils.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z general partner, in the proposal
Costs and Legal Terms Remain Open
The document does not name a budget, funding source or cost estimate for its targets, shared tools, drills or proposed support from large companies. It also does not give a full implementation schedule beyond saying top targets should be contained within six months. The meaning and measurement of targets such as “zero internet-exposed control systems” would need to be worked out by sectors and regulators.
The proposal asks for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and suggests a potential safe harbor for participating companies that meet outcomes-based targets. It does not specify the legal terms, eligibility rules or scope of liability protection. The proposal’s status with the White House and the Super Intelligence Force is also unclear.
a16z invests in frontier AI labs and security companies, while the proposal would give cloud and AI-lab executives non-voting roles on sector councils. That is relevant context when evaluating the plan, but the source material does not show that any named investment would receive a particular benefit. The proposal does not provide independent evidence for its claims about how quickly AI can discover or help fix vulnerabilities.
White House Response Will Matter
The next step would be for the Super Intelligence Force and federal agencies to decide whether to consider the proposal, define sector targets or develop a separate plan. No adoption decision, implementation date or formal government response is established in the source material.
If officials pursue the approach, they would need to settle how CEOs are selected and held accountable, how ISACs report comparable metrics, how smaller operators receive support, and how regulators treat board attestations. Congress would also have a role if long-term reauthorization of the 2015 information-sharing law is pursued. Until those steps are confirmed, the plan remains an a16z proposal rather than a federal cyber program.
Key Questions
What did a16z propose?
a16z proposed a White House-led cyber defense program focused on high-impact operators and shared vendors across five infrastructure sectors, with CEO-signed targets and monthly reporting.
Is the plan U.S. government policy?
No. The material describes it as an a16z proposal. It does not establish that the White House or the Super Intelligence Force has adopted it.
Which sectors would the plan cover?
The plan names power, banking and payments, water, communications, and hospitals.
What security targets does it set out?
It proposes zero internet-exposed control systems, successful 72-hour manual-operation drills, and containment of critical vulnerabilities within a set period. The proposal says top targets should be contained within six months.
What remains unresolved?
The plan does not specify its costs, complete timetable or proposed safe-harbor terms. It is also unclear whether the White House will consider or adopt the recommendations.
Source: ThorstenMeyerAI.com
