🔍 Read the full analysis: US Infrastructure Security Meets AI Speed In A16z’s New Plan on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Andreessen Horowitz published a proposal on Nov. 12 for speeding up cybersecurity efforts across five critical infrastructure sectors as AI changes the pace of cyber threats. It would set measurable targets for a small group of high-impact operators, with White House oversight and monthly reporting through existing industry groups. The proposal is not government policy, and it does not specify costs.
Andreessen Horowitz published a critical-infrastructure cyber defense proposal on Nov. 12 that would focus U.S. cybersecurity efforts on a few hundred operators and shared vendors in power, banking and payments, water, communications and hospitals. Written by a16z General Partner Anne Neuberger, the plan calls for White House-set targets, CEO accountability and monthly progress reporting as AI may accelerate the discovery and exploitation of vulnerabilities.
The proposal would have the White House’s Super Intelligence Force set national goals, chair monthly reviews with company leaders and address policy or funding barriers. A council of two or three CEOs per sector would sign the targets and answer publicly for results. Cloud and AI-lab executives could take part as non-voting members, according to the plan’s governance table, which a16z labels illustrative.
Existing Information Sharing and Analysis Centers, or ISACs, would coordinate the operational work. The plan proposes giving them shared AI tools, a role in coordinating fixes with vendors, mutual-aid arrangements and responsibility for monthly, anonymized sector scorecards. A sector that falls behind would face a CEO-level review with the White House force.
The proposed targets are zero internet-exposed control systems, successful 72-hour manual-operation drills and containment of critical vulnerabilities within a set period, through a patch or compensating control. The plan says the highest-priority targets should be contained within six months. It also proposes board attestations for public companies and having regulators accept those attestations in place of duplicate audits. The source does not provide a cost estimate or specify the final deadlines for every target.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
How Sector Targets Could Change Cyber Defense
The proposal’s central shift is from broad calls to improve cybersecurity toward named, measurable outcomes for operators whose disruption could have effects beyond one company. A failed payment network, major power asset or hospital system can affect other organizations and the public. Concentrating effort on shared vendors and high-impact operators could direct limited expertise toward systems with wider consequences.
The plan also treats speed as a governing problem. Neuberger’s argument is that AI can help defenders identify exposed systems, rank risk and produce fixes, but that those tools must be deployed quickly enough to matter. The proposal would tie that effort to executive responsibility and recurring scorecards, rather than leaving coordination solely to technical teams.
That approach could bring more regular attention to readiness, including whether organizations can operate manually during a disruption. It could also create new reporting and coordination duties for companies, ISACs and agencies. The plan’s intended effect is a proposal, however; it does not establish that the targets are feasible, funded or likely to reduce incidents.
Products Worth Considering
LG UltraGear 27G810A-B 27-Inch 4K UHD IPS Gaming Monitor
Samsung 37-inch Odyssey G7 Curved 4K UHD Gaming Monitor (G75F)
DJI Mini 5 Pro Fly More Combo with DJI RC 2
As an affiliate, we earn on qualifying purchases.
From Government Cyber Work to a16z
Neuberger says she worked on infrastructure security inside the U.S. government, first at the National Security Agency and later as deputy national security adviser for cyber and emerging technology. She now leads global affairs at a16z, a venture firm that invests in frontier AI and security companies. That background is relevant both to her experience and to the proposal’s focus on AI. The source notes the firm’s investments but does not identify a particular company that would benefit from the plan.
The proposal is addressed to the White House’s Super Intelligence Force. According to NBC News, President Donald Trump announced the task force on Oct. 4, 2026, and named National Intelligence Director Jay Clayton to lead it. The source says the president described the force as coordinating federal engagement with critical infrastructure providers and superintelligence companies. The a16z document proposes that this body oversee the targets, but no government adoption is reported.
For legal support, a16z calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and suggests a potential safe harbor for companies that meet outcomes-based targets. These are requests in the proposal, not enacted protections. Its suggested division of work would retain relevant federal agencies, including Energy for power, Treasury for banks, EPA for water, the FCC for communications and HHS for hospitals.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z general partner, in the proposal
The document is a proposal, not adopted federal policy. The source does not say that the White House or the Super Intelligence Force has accepted its governance model, targets or reporting schedule. It also does not state how much the program would cost, how expenses would be divided, or what resources ISACs would need to run the proposed shared tools and coordination work.
Important implementation details remain open. The proposal describes some target timeframes, including a six-month goal for top priorities, but does not provide a complete schedule for each sector or explain how compliance would be independently verified. It also does not specify the scope or terms of a potential legal safe harbor. The source frames AI’s ability to help defenders—and whether it can be applied quickly enough—as an unresolved issue.
The proposed CEO council would include cloud and AI-lab leaders as non-voting members. How those participants would be chosen, how conflicts of interest would be handled, and how the plan’s public accountability would work in practice are not established in the source. Nor does it identify the operators and vendors that would be covered.
Whether Washington Takes Up the Plan
The next step would be a decision by the White House on whether to consider the proposal and give the Super Intelligence Force any role like the one a16z describes. The source reports no formal government response or implementation timetable. Any move to establish targets, a CEO council or monthly scorecards would require further decisions about authority, participation and reporting.
Congressional action would also be needed for the proposed long-term reauthorization of the 2015 information-sharing law; a safe harbor would require its own legal terms and approval. For now, the plan sets out a framework and requests policy changes. Whether companies, regulators and existing sector groups take part—and on what schedule—remains to be seen.
Key Questions
What did a16z propose?
Andreessen Horowitz proposed a White House-led cybersecurity program focused on high-impact operators and shared vendors in five sectors: power, banking and payments, water, communications and hospitals. It would combine sector targets, CEO accountability and monthly reporting through existing ISACs.
Is the plan U.S. government policy?
No. The source describes it as a proposal published by a16z on Nov. 12, 2026. It does not report that the White House or Congress has adopted it.
What cybersecurity goals does the plan set out?
It proposes eliminating internet-exposed control systems, passing 72-hour manual-operation drills and containing critical vulnerabilities within set timeframes. The document says its top targets should be contained within six months.
Who would oversee the proposed effort?
The White House’s Super Intelligence Force would set targets and review results; sector CEOs would sign up to them; and ISACs would coordinate implementation and report anonymized metrics each month. The proposed governance has not been adopted.
What remains unknown?
The proposal does not give a cost estimate, a full timetable for all targets or confirmed details about legal protections. It is also unclear whether the White House will act on the plan or how covered companies would be selected.
Source: ThorstenMeyerAI.com
