🔍 Read the full analysis: What’s Behind A16z’s Push For AI-Speed Infrastructure Defense? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Andreessen Horowitz published a proposal for accelerating cybersecurity across five U.S. critical-infrastructure sectors, with AI tools, CEO-signed targets and monthly scorecards. It is not adopted policy; its costs, legal protections and implementation details remain unsettled.
Venture firm Andreessen Horowitz (a16z) published a proposal on November 12 for a White House-led effort to speed up cyber defenses at critical U.S. infrastructure, arguing that AI is shrinking the time defenders have to respond to vulnerabilities. The plan would set targets for five sectors—power, banking and payments, water, communications and hospitals—but it is a proposal, not current government policy.
The plan, titled the Super Intelligence-Era Critical Infrastructure Cyber Defense Plan, was written by Anne Neuberger, an a16z general partner and head of global affairs. The firm said Neuberger also outlined the proposal in an opinion piece for The Wall Street Journal. It focuses on a few hundred operators and shared vendors whose failure, a16z argues, could cause wider disruption, rather than attempting to protect every organization equally.
Under the proposed governance structure, the White House’s Super Intelligence Force would set national targets and convene monthly reviews. A council of two or three CEOs from each sector would sign up to sector-specific outcomes and answer publicly for progress. Industry Information Sharing and Analysis Centers, or ISACs, would coordinate defensive work, operate shared AI tools and submit anonymized monthly scorecards. Relevant federal agencies would remain involved, including the Energy Department for power and the Health and Human Services Department for hospitals.
Three proposed measures are zero internet-exposed control systems, successful 72-hour manual-operation drills and containment of critical vulnerabilities—through a patch or compensating control—within a specified period. The plan says the top targets should be contained within six months. It also proposes board attestations for public companies and says regulators could accept those in place of duplicate audits. The source document describes its governance table as illustrative, not as an agreed arrangement.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Targets for Five Critical Sectors
The proposal’s significance lies in its attempt to turn a broad cybersecurity concern into measurable responsibilities and deadlines. If adopted, its approach could put chief executives—not only technical security teams—on the hook for operational readiness, while asking existing sector groups to coordinate responses and track results. Its focus on shared vendors also reflects the risk that a single supplier or service can affect multiple operators.
a16z argues that AI could help defenders identify exposed systems, rank risks and generate fixes faster, including workarounds for equipment that cannot readily be patched. That is the plan’s stated rationale, not evidence that those capabilities will be available or effective across all infrastructure. The proposal’s own central test is whether defensive tools can be applied quickly enough to keep pace with attackers.
The plan also pairs outcome targets with a request for legal protection. It calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and proposes considering a safe harbor for companies that meet outcomes-based targets. That could affect how firms share threat information and how they face legal exposure, but neither measure is enacted by publication of the proposal.
Products Worth Considering
Apple MacBook Pro 16.3-inch with PROLED XDR Display, Silver
Ledger Nano Gen5 Crypto Wallet, Black
LG UltraGear 34G600A-B 34-Inch Curved WQHD Gaming Monitor, 160Hz
As an affiliate, we earn on qualifying purchases.
A Proposal Addressed to Washington
Neuberger’s background is part of the proposal’s framing. She said she worked on infrastructure security inside the U.S. government, including at the National Security Agency and as deputy national security adviser for cyber and emerging technology, before joining a16z. The proposal is directed to the White House’s Super Intelligence Force, which the source says President Donald Trump announced on October 4, 2026, naming National Intelligence Director Jay Clayton to lead it. NBC News reported the announcement, according to the source material.
The plan says existing ISACs currently focus largely on sharing threat alerts among security leaders. It would give them a broader operational role: coordinating fixes with vendors, organizing mutual assistance and compiling sector-wide performance data. The proposal also describes large organizations helping smaller ones, such as utilities supporting municipal providers and large health systems assisting rural hospitals.
a16z has investments in frontier AI labs and security companies, including businesses that could be relevant to the proposal’s suggested role for AI and technology providers. The document gives cloud and AI-lab CEOs non-voting roles on the proposed sector councils. That connection is relevant when evaluating the proposal’s authorship and interests; it does not by itself establish that its recommendations are unsound.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, in a16z’s proposal
The proposal does not name a cost estimate, funding source or detailed timetable for all its targets. It also does not establish that the White House force, CEO council or expanded ISAC responsibilities have been approved. The source material describes the targets and reporting arrangements as recommendations, not commitments by companies or federal agencies.
Key legal details remain open, including what a proposed safe harbor would cover, who would qualify and how regulators would verify that a company had met the targets. The plan’s call to reauthorize the 2015 information-sharing law likewise does not mean Congress has acted. It is also unclear how the proposed metrics would account for differences among organizations, legacy equipment or threats that cannot be eliminated through patching.
The claim that risks are concentrated among a few hundred operators and vendors is the plan’s assessment; the provided material does not supply an independent estimate or list of all entities in that group. A16z’s investments in AI and security firms are also relevant background when assessing the proposal, but the source does not detail how any potential commercial interests would be managed.
From Proposal to Government Action
The next step would be a decision by the White House and relevant agencies on whether to adopt, revise or reject the proposed structure. Any implementation would require agreement on which operators and vendors are covered, how sector targets are defined, and how monthly reporting and public-company attestations would work. Those arrangements are not confirmed in the source material.
Congress would need to consider the requested reauthorization of the Cybersecurity Information Sharing Act, while lawmakers and regulators would have to resolve the proposed legal protections and oversight. Companies and ISACs would also need to determine whether they can meet the suggested targets, including the six-month timetable for top priorities. Until those steps occur, the plan remains a set of recommendations from a16z, not an active federal program.
Key Questions
What did a16z propose?
a16z proposed a White House-led cybersecurity effort focused on power, banking and payments, water, communications and hospitals. It would assign targets to sector CEOs and use ISACs to coordinate defenses and report monthly progress.
Is the plan U.S. government policy?
No. The November 12 document is an a16z proposal. The material provided does not show that the White House or Congress has adopted its targets or governance structure.
What targets does the proposal set out?
It calls for zero internet-exposed control systems, successful 72-hour manual-operation drills and critical vulnerabilities contained within a set period. The proposal says top targets should be contained within six months.
What legal changes does a16z seek?
The proposal calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and suggests considering a safe harbor for companies that meet outcomes-based targets. The terms and status of either measure are not established by the proposal.
Source: ThorstenMeyerAI.com
