🔍 Read the full analysis: A16z Wants US Infrastructure Defenses To Move At AI Speed on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Andreessen Horowitz published a proposal on Nov. 12 for accelerating cyber defenses across five US infrastructure sectors as AI speeds up both vulnerability discovery and exploitation. The plan would set measurable targets for selected operators and vendors, but it is a proposal, not government policy, and it does not specify costs.
Venture firm Andreessen Horowitz (a16z) published a proposed US infrastructure cyber defense plan on Nov. 12, calling for White House coordination and measurable security targets for selected operators in power, banking and payments, water, communications and hospitals. Written by a16z General Partner Anne Neuberger, the plan argues that AI is accelerating the discovery and exploitation of cyber vulnerabilities; it is a proposal, not adopted government policy.
The proposal would concentrate effort on what it describes as a few hundred operators and shared vendors whose failure could cause wider national disruption. Examples named in the plan include large transmission substations, payment systems such as Fedwire and ACH, urban water utilities, core telecom and 911 systems, regional trauma centers and health-record vendors. The document argues that protecting this narrower set could address risks with consequences across multiple sectors, rather than attempting to secure every organization at once.
Its proposed governance structure has three levels. The White House’s Super Intelligence Force would set national targets, convene monthly reviews and help resolve policy or funding obstacles. A CEO council would sign sector commitments and answer publicly for results; the plan’s illustrative governance table proposes two or three CEOs per sector, with cloud and AI-lab executives as non-voting members. Existing Information Sharing and Analysis Centers (ISACs) would coordinate implementation and report anonymized sector-wide metrics each month.
Each sector’s leaders would sign up to three targets: zero internet-exposed control systems, passing 72-hour manual-operation drills, and containing critical vulnerabilities—through patches or compensating controls—within a set time. The plan says the highest-priority targets should be contained within six months. A sector falling behind would prompt a CEO-level review, while public-company boards could attest to progress and regulators could accept the attestations instead of duplicate audits. The proposal also seeks long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and suggests a potential safe harbor for companies meeting outcome-based targets.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
A Narrower Target for Cyber Defense
The plan’s central choice is to prioritize systems whose failure could spread beyond one organization. A disruption at a major payment network, communications provider or water utility can affect customers and other services that rely on it. Focusing on shared vendors as well as operators recognizes that a weakness in a supplier can reach multiple infrastructure sectors.
The proposed targets would also make progress easier to track than a general call for stronger cybersecurity. Internet exposure, manual-operation drills and vulnerability containment are presented as specific outcomes, with monthly reporting and executive review intended to keep attention on delivery. If adopted, the framework could shift some responsibility from individual security teams toward company leadership and sector-wide coordination.
That approach carries practical and policy questions. The plan offers legal protections and reduced duplicate audits as incentives, but it does not state how much implementation would cost, how costs would be divided, or how regulators would verify reported results. Its effect would depend on whether the federal government and companies agreed to the proposed commitments.
Products Worth Considering
Withings Sleep Under-Mattress Sleep Tracking Pad
Therabody Theragun Relief Massage Gun, 3-Speed, Navy
BowFlex Results Series SelectTech Adjustable Dumbbells, Pair
As an affiliate, we earn on qualifying purchases.
From Government Cybersecurity to a16z
Neuberger’s authorship gives the proposal a connection to federal cybersecurity work: according to the source material, she previously served at the National Security Agency and as deputy national security adviser for cyber and emerging technology. She is now a general partner and head of global affairs at a16z. The firm says she also outlined the plan in a Wall Street Journal opinion piece.
The proposal is addressed to the White House’s Super Intelligence Force. The source material says President Donald Trump announced the task force on Oct. 4, 2026, and named National Intelligence Director Jay Clayton to lead it. The plan would assign the force a coordinating role, but the source does not report that the administration has endorsed or begun implementing these recommendations.
a16z frames the threat as a race between attackers and defenders. It says AI could help identify exposed systems, rank their importance and generate fixes, including temporary workarounds for equipment that cannot be patched. The document’s argument is that defenders must apply such tools quickly; the speed and effectiveness of those uses are not established by the proposal itself.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z general partner and head of global affairs, in the plan
The source material describes a16z’s recommendations, not a federal directive. It does not establish whether the White House, the Super Intelligence Force, regulators or infrastructure companies have accepted the plan, or whether a CEO council will be formed. The task force’s announced existence does not by itself confirm that it will take on the responsibilities proposed by a16z.
The proposal gives no overall budget, funding source or detailed schedule beyond saying that the top targets should be contained within six months. It also leaves open how the target list would be selected, how compliance would be independently checked, and what consequences would follow if a company failed to meet a commitment. The proposed safe harbor is described as potential, and its legal scope and conditions are not specified.
There is also a potential conflict of interest for readers to weigh: a16z invests in frontier AI labs and security companies, while its proposal would give cloud and AI-lab CEOs non-voting roles and call for AI-based defensive tools. That fact does not establish improper influence, but the source material does not explain how the proposed governance would address financial interests or vendor selection.
Whether Washington Takes Up the Plan
The next development to watch is whether the White House’s Super Intelligence Force or relevant federal agencies respond to the recommendations. Adoption would require decisions about which operators qualify, what targets are binding or voluntary, how monthly metrics are protected and shared, and which agency would resolve disagreements across sectors.
Congressional action would also matter to the plan’s request for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015. Any safe harbor would need a defined legal basis and conditions. Until those steps are announced, the proposed six-month target period is a recommendation rather than a confirmed implementation deadline.
Key Questions
What did a16z propose?
a16z proposed a White House-coordinated cybersecurity effort focused on selected operators and shared vendors across five infrastructure sectors, with signed targets and monthly reporting.
Is the plan now US government policy?
No. The source describes it as a proposal. It does not report government adoption or implementation.
Which security targets does the plan name?
The proposed targets are zero internet-exposed control systems, passing 72-hour manual-operation drills, and containing critical vulnerabilities through patches or compensating controls within a set time.
Why does the plan focus on a few hundred operators?
a16z argues that failures at certain operators and shared vendors could cascade nationally. It names examples such as major power facilities, payment systems, core telecom networks and health-record vendors.
What remains unresolved?
Government and company participation, costs, funding, compliance checks, enforcement and the details of any legal safe harbor remain unspecified in the source material.
Source: ThorstenMeyerAI.com
