🔍 Read the full analysis: Can A16z’s AI-Speed Plan Protect US Infrastructure? on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Andreessen Horowitz published a proposal on Nov. 12 for protecting critical U.S. infrastructure against faster AI-assisted cyber threats. It focuses on a few hundred operators and shared vendors across five sectors, with measurable security targets and White House and CEO oversight. The proposal is not policy, and its costs and implementation details are not specified in the source material.
Andreessen Horowitz published a critical-infrastructure cyber defense proposal on Nov. 12, calling for the White House and company leaders to secure a targeted group of operators and vendors in five essential sectors. The plan, written by a16z General Partner Anne Neuberger, proposes signed security targets, monthly progress reviews and legal protections for participating companies; it is a proposal, not current government policy.
The plan argues that AI is shortening the time between discovering a vulnerability and exploiting it, putting infrastructure operators at risk if their defenses move at a slower pace. It also says AI could help defenders locate exposed systems, prioritize risks and develop fixes or workarounds for equipment that cannot readily be patched. The source does not establish how well those uses work in practice; a16z itself identifies the speed of deployment as an open question.
Rather than attempt to secure every system at once, the proposal prioritizes what it calls a few hundred operators and shared vendors whose failure could have national consequences. Its five sectors are power, banking and payments, water, communications and hospitals. Examples named in the plan include major transmission substations, payment networks, large-city water utilities, core telecommunications and 911 systems, trauma centers and health-record vendors.
The proposed governance structure has the White House’s Super Intelligence Force set national targets and chair monthly reviews. A CEO council, with two or three CEOs from each sector, would sign up to meet the targets and answer for results. Existing Information Sharing and Analysis Centers, or ISACs, would coordinate work and submit anonymized monthly metrics. The plan also calls for large companies to help smaller operators, such as utilities supporting city systems and health networks supporting rural hospitals.
Each sector would commit to three kinds of outcomes: no internet-exposed control systems, passing 72-hour manual-operation drills and containing critical vulnerabilities within a set period, through a patch or compensating control. The proposal says top targets should be contained within six months. A sector falling behind would face a CEO-level review. For public companies, boards would attest to progress, with regulators accepting those attestations in place of duplicate audits, as described in the proposal.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Targets for High-Impact Operators
The proposal’s central choice is to concentrate effort on systems and suppliers whose disruption could affect many people or services at once. If implemented, common targets and monthly reporting could give federal officials and companies a shared way to identify gaps and press for remediation across sectors that operate under different rules.
That focus also raises practical questions. Passing a manual-operation drill, removing internet exposure and containing a vulnerability require different work in different environments. Some infrastructure uses older equipment or depends on vendors, so operators may not be able to meet a uniform deadline in the same way. The plan’s emphasis on shared vendors recognizes that risk can cross company and sector boundaries, but the source does not lay out how responsibilities would be divided when a supplier serves multiple customers.
Legal protections could affect whether companies share information or participate. a16z calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and says policymakers should consider a safe harbor for companies that meet outcomes-based targets. The proposal does not specify the legal design of that protection or how it would interact with existing regulatory obligations.
Products Worth Considering
LG UltraGear 27G810A-B 27-Inch 4K UHD IPS Gaming Monitor
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
As an affiliate, we earn on qualifying purchases.
From Government Service to Proposal
The proposal was written by Anne Neuberger, now a general partner and head of global affairs at a16z. The source says she previously worked on infrastructure security at the National Security Agency and as deputy national security adviser for cyber and emerging technology in the White House. a16z says she also outlined the plan in a Wall Street Journal opinion piece.
The intended federal counterpart is the White House’s Super Intelligence Force. According to the source material, President Donald Trump announced the task force on Oct. 4, 2026, and named National Intelligence Director Jay Clayton to lead it. The proposal assigns that body a coordinating role, but the source does not report that the force has adopted a16z’s plan or that the government has authorized its proposed targets.
a16z presents the governance chart as illustrative. Its proposed CEO council would include cloud and AI-lab executives as non-voting members, while existing sector agencies would remain involved: Energy for power, Treasury for banking, the EPA for water, the FCC for communications and HHS for hospitals. The plan also comes from a venture firm that invests in frontier AI labs and security companies, an interest relevant to readers assessing its recommendations.
“whether it can be applied fast enough.”
— a16z plan
The source describes no estimated price tag, funding mechanism or detailed implementation schedule beyond its statement that top targets should be contained within six months. It also does not establish whether the Super Intelligence Force has accepted the proposal, whether companies or sector agencies would participate, or what authority the proposed body would have to require action.
The terms for the proposed legal safe harbor remain unspecified, as do the consequences for companies that miss targets. The plan calls for measurable outcomes but does not provide sector-by-sector baselines or explain how regulators would verify board attestations. It is also unclear how the targets would account for equipment that cannot be patched, shared vendors with many customers, or the varying technical constraints of smaller operators.
Finally, the source presents a16z’s account of AI-related cyber risk and potential defensive uses; it does not provide independent evidence that AI tools can reliably find and fix infrastructure vulnerabilities at the proposed pace. The plan’s effectiveness cannot be assessed from the proposal alone.
Federal and Industry Response
The next relevant development is whether the White House’s Super Intelligence Force, sector agencies and infrastructure companies respond to the proposal or adopt any of its recommendations. Under a16z’s suggested model, the force would set targets, a CEO council would review progress monthly, and ISACs would coordinate fixes and report metrics. Those steps describe the proposal, not a confirmed schedule.
Readers should watch for any formal federal announcement addressing the plan, a decision on the proposed CISA reauthorization or safe harbor, and details on funding, target definitions and oversight. Until then, the confirmed development is the publication of a16z’s plan; its adoption and practical effect remain unsettled.
Key Questions
What did a16z propose?
It proposed a White House-coordinated cybersecurity effort focused on key operators and shared vendors in power, banking and payments, water, communications and hospitals, with company targets and monthly reporting.
Is the plan U.S. government policy?
No. The source identifies it as an a16z proposal and does not report that the White House or agencies have adopted it.
What targets would companies sign?
The plan calls for zero internet-exposed control systems, passing 72-hour manual-operation drills and containing critical vulnerabilities within a set time. It says top targets should be contained within six months.
What role would the Super Intelligence Force play?
Under the proposal, it would set national targets, chair monthly CEO reviews and help clear policy or funding obstacles. The source does not establish what authority the task force will exercise or whether it will take on this role.
What remains unknown about implementation?
The proposal gives no cost estimate and leaves open how targets would be funded, enforced and measured across sectors. The scope of any legal safe harbor and the plan’s adoption status are also unclear.
Source: ThorstenMeyerAI.com
