🔍 Read the full analysis: A16z’s Plan For Infrastructure At AI Speed Leaves Questions To Explore on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Andreessen Horowitz published a proposal for securing critical U.S. infrastructure against cyber threats accelerated by AI. It would set measurable targets for five sectors and make industry groups responsible for tracking progress, but it is not government policy and leaves costs and legal protections unresolved.
Venture firm Andreessen Horowitz (a16z) published a proposal on November 12 for a White House-led effort to secure critical infrastructure against AI-accelerated cyber threats. Written by General Partner Anne Neuberger, the plan would set cybersecurity targets for power, banking and payments, water, communications and hospitals, but it is a proposal—not adopted U.S. policy.
The plan argues that artificial intelligence is reducing the time between discovering a software weakness and exploiting it, putting infrastructure operators under pressure to respond faster. It proposes focusing on a few hundred operators and shared vendors whose disruption could have effects across a sector or nationally, rather than attempting to protect every system equally. Examples listed include major transmission substations, payment networks, large-city water utilities, core telecom systems and health-record vendors.
For each sector, participating CEOs would sign up to three targets: zero internet-exposed control systems, successful 72-hour manual-operation drills, and containment of critical vulnerabilities through patches or other controls within a specified period. The plan says the highest-priority targets should be contained within six months. Existing Information Sharing and Analysis Centers, or ISACs, would coordinate shared tools and fixes and submit anonymized sector metrics monthly.
Under the proposed governance model, the White House’s Super Intelligence Force would set targets, chair monthly reviews and address policy or funding barriers. A CEO council would be publicly accountable for results, while sector lead agencies would remain involved. The plan also calls for a long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and says the government should consider legal safe harbor for companies meeting the targets. It does not specify program costs.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Targets Would Put CEOs on the Hook
The proposal would shift infrastructure cybersecurity from a primarily technical and company-by-company concern toward measurable sector-wide obligations. Monthly reporting and CEO-level reviews could make weak performance more visible and create pressure to address known vulnerabilities before they contribute to wider outages.
Its focus on shared vendors reflects how a single supplier or service can connect many operators. A failure in a widely used technology provider may affect multiple organizations at once, while outages in power, communications or payments can disrupt other essential services. The plan’s emphasis on manual-operation drills also recognizes that patching and automated defenses may not be enough: operators need ways to keep services running when digital systems fail.
However, the proposal’s impact depends on whether firms participate, what the targets mean in practice and how compliance is verified. The suggested legal protections and reauthorization could shape companies’ willingness to share information, but those measures would require government action. The document does not establish that AI tools can find and fix vulnerabilities quickly enough to meet the proposed timetable.
Popular right now
Ninja Foodi 10-Qt DualZone XL Air Fryer, 6-in-1, Gray (DZ401)
Hisense 75-Inch U7 Mini-LED ULED 4K UHD Smart Google TV (75U7SG)
Dyson Supersonic Travel Hair Dryer
As an affiliate, we earn on qualifying purchases.
From Government Cybersecurity to a16z
Neuberger brings prior government experience to the proposal. According to a16z, she worked on infrastructure security at the National Security Agency and later served as deputy national security adviser for cyber and emerging technology. She is now a general partner and the firm’s head of global affairs.
The plan is directed to the White House’s Super Intelligence Force. The source article says President Donald Trump announced the task force on October 4, 2026, and named National Intelligence Director Jay Clayton to lead it. The task force was described as coordinating federal engagement with critical infrastructure providers and AI companies. The a16z proposal would give it a central role in setting targets and reviewing progress.
The governance table in the proposal is labeled “for illustrative purposes only.” It assigns lead-agency roles to the Energy Department for power, Treasury for banks, the Environmental Protection Agency for water, the Federal Communications Commission for communications and the Department of Health and Human Services for hospitals. The plan also envisions cloud and AI-lab executives as non-voting members of the CEO council.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z general partner and head of global affairs, in the proposal
Costs and Legal Terms Remain Open
The document does not say how much the proposed program would cost, who would pay for shared tools and upgrades, or how financial support for smaller operators would be organized. It describes large organizations sponsoring smaller utilities, hospitals, banks and carriers, but does not set out binding funding commitments.
It is also unclear whether the White House or Congress will adopt any part of the plan, how the proposed targets would be defined for different kinds of systems, or what penalties—if any—would apply when a sector falls behind. The suggested safe harbor is described as a possibility, not an enacted protection. The plan also does not provide independent evidence that its proposed AI defenses can identify and contain vulnerabilities at the required speed.
a16z invests in frontier AI laboratories and cybersecurity companies. The source material notes that the proposal would give cloud and AI-lab executives a place on the council, albeit as non-voting members. The proposal does not explain how potential conflicts of interest would be managed.
Policy Decisions Would Set the Pace
The next step would be a decision by the White House and relevant agencies on whether to develop the proposal into a government program. That would require clarifying the Super Intelligence Force’s authority, deciding which operators qualify as priority targets and setting sector-specific standards and timelines.
Congress would have a role if the government pursues the proposed long-term reauthorization of the Cybersecurity Information Sharing Act or creates a legal safe harbor. Until those decisions are made, the plan’s CEO councils, monthly scorecards and six-month target are recommendations rather than scheduled requirements. No adoption timetable or official response is provided in the source material.
Key Questions
What did a16z propose?
a16z proposed a White House-led cybersecurity program focused on high-impact operators and shared vendors in power, banking and payments, water, communications and hospitals. It would set targets and track sector progress monthly.
Is the plan now U.S. policy?
No. The plan was published as a proposal. The source material does not report that the government has adopted it or announced an implementation schedule.
What targets would companies have to meet?
The proposed targets are to eliminate internet-exposed control systems, pass 72-hour manual-operation drills and contain critical vulnerabilities within a set period. The plan says the highest-priority targets should be contained within six months.
Who would oversee the proposed program?
The proposed White House Super Intelligence Force would set national targets and review progress. A CEO council would be accountable for results, while existing sector ISACs would coordinate work and report anonymized metrics.
What remains unresolved?
The proposal does not specify costs, final target definitions, enforcement or an adoption timetable. Its suggested legal safe harbor and reauthorization of the Cybersecurity Information Sharing Act would require further government action.
Source: ThorstenMeyerAI.com
