🔍 Read the full analysis: How To Read A16z’s Plan For AI-Speed US Infrastructure Defense on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Andreessen Horowitz published a proposal on Nov. 12 for defending U.S. critical infrastructure against AI-accelerated cyber threats. It calls for federal targets, CEO accountability, monthly industry scorecards and legal protections for participating firms, but it is not government policy and does not specify costs.
Venture firm Andreessen Horowitz (a16z) published a proposal on Nov. 12 for speeding up cyber defenses at key U.S. infrastructure operators, arguing that artificial intelligence is shortening the time between a vulnerability’s discovery and its exploitation. The plan would put the White House’s Super Intelligence Force in charge of setting targets, with industry CEOs accountable for results and sector information-sharing centers coordinating implementation; it is a proposal, not current policy.
Written by Anne Neuberger, a16z’s general partner and head of global affairs, the plan rejects trying to secure every infrastructure asset at once. Instead, it prioritizes what it describes as a few hundred operators and shared vendors whose failure could have cascading effects. The five sectors named are power, banking and payments, water, communications and hospitals. Examples in the plan include large transmission substations, payment systems, major-city water utilities, core telecommunications and 911 systems, trauma centers, and health-record vendors.
The proposal sets out three layers of governance. The White House’s Super Intelligence Force would set national targets, chair monthly CEO reviews and address policy or funding obstacles. A CEO council would have two or three chief executives per sector; cloud and AI-lab CEOs would participate as non-voting members. Existing Information Sharing and Analysis Centers (ISACs) would coordinate tools, fixes, mutual aid and reporting. The plan’s illustrative governance table also assigns lead-agency roles to the Energy Department, Treasury, EPA, FCC and HHS for the respective sectors.
Sector CEOs would sign up to three measures: zero internet-exposed control systems, passed 72-hour manual-operation drills, and critical vulnerabilities patched or covered by a compensating control within a set time. The proposal says the top targets should be contained within six months. ISACs would send anonymized metrics monthly; a sector falling behind would face a CEO-level review. Public-company boards would attest to progress, with regulators accepting those attestations in place of duplicate audits. The plan also proposes that large organizations help smaller utilities, hospitals, banks and carriers build defenses.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
A Narrower Target for Cyber Defense
The proposal’s central policy choice is to concentrate effort on high-impact operators and shared vendors, rather than treat all infrastructure assets as equally urgent. If the plan’s risk assessment is right, that could focus scarce security staff and investment where a failure might disrupt services across regions or sectors. It would also make resilience—not just threat alerts—the measure of progress, through operational drills and vulnerability response deadlines.
The suggested use of AI cuts both ways. a16z argues that AI could help defenders find exposed systems, rank risks and generate fixes, including workarounds for equipment that cannot readily be patched. But the firm also warns that attackers may use the same technology to find and exploit weaknesses faster. The plan’s practical test is whether organizations can apply defensive tools fast enough to keep pace, especially where aging systems, limited budgets or dependencies on vendors complicate repairs.
Its proposed legal protections could affect whether companies participate and share information. a16z calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and a potential safe harbor for firms meeting outcomes-based targets. Those provisions would require government action and further definition; the proposal does not establish them.
Products Worth Considering
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
Amazon Kindle Paperwhite (12th Generation, 2024), 16GB, 7-Inch Display, Raspberry
As an affiliate, we earn on qualifying purchases.
From Government Cybersecurity to a16z
Neuberger says she spent several years working on infrastructure security in government, first at the NSA and later as deputy national security adviser for cyber and emerging technology. She now works at a16z, a venture firm that invests in frontier AI labs and security companies. That background and the firm’s investments are relevant when evaluating a proposal that gives cloud and AI-lab executives a place in the governance structure, even though their council role would be non-voting.
The plan is directed at the White House’s Super Intelligence Force. According to NBC News, President Donald Trump announced the task force on Oct. 4, 2026, and named National Intelligence Director Jay Clayton to lead it. Trump said it would coordinate federal engagement with groups including critical infrastructure providers and “Super Intelligence Companies.” The a16z document describes its proposed structure as illustrative, not as an adopted government arrangement.
The proposal also frames the threat as a race in which AI may accelerate vulnerability discovery and exploitation. It presents AI as a possible defensive tool as well, but does not provide independent test results or evidence that the suggested tools can meet the proposed timelines across all five sectors.
The document is a private-sector proposal; the source material does not report that the White House or Congress has adopted it. It does not name a cost, identify funding sources, or explain how the proposed targets would be enforced if a company failed to meet them. The six-month timeframe is presented for top targets, but the plan does not spell out the full schedule for every sector or define a common starting point.
It is also unclear which operators and vendors would qualify for the priority list, who would set the final measures, and how the government would protect sensitive scorecard information. The proposed safe harbor is described as a possibility rather than a settled legal mechanism. The source material does not include responses from federal agencies, infrastructure operators or the sector ISACs, nor evidence that the recommended AI tools have been tested at national scale.
Federal Response and Target Design
The next concrete step would be a decision by the White House’s Super Intelligence Force on whether to consider the proposal and how it would fit with existing cybersecurity responsibilities. If officials pursue a similar framework, they would need to identify participating operators, define sector-specific targets, determine who pays for implementation and set rules for reporting and oversight.
Congress would also have a role if the government sought to reauthorize the 2015 information-sharing law or create a safe harbor. For now, the published plan lays out a proposed structure and goals; no implementation timetable or federal approval is confirmed in the source material.
Key Questions
What did a16z propose?
It proposed prioritizing a few hundred infrastructure operators and shared vendors across five sectors, with federal target-setting, CEO accountability and monthly ISAC scorecards.
Is the plan U.S. government policy?
No. It was published by a16z as a proposal. The source material does not say that the White House or Congress has adopted it.
What security targets does the proposal name?
They include zero internet-exposed control systems, successful 72-hour manual-operation drills, and containment of critical vulnerabilities through patches or compensating controls within a set time.
How would AI be used under the plan?
a16z says AI could help defenders find exposed systems, rank risks and generate fixes, including workarounds for equipment that cannot be patched. The document also warns that attackers could use AI to accelerate exploitation.
What remains unresolved?
The proposal does not specify its cost, enforcement powers, participating companies or implementation timetable. Its suggested legal safe harbor would also require further definition and government action.
Source: ThorstenMeyerAI.com
