🔍 Read the full analysis: 3 Parts Of A16z’s Plan For AI-Speed Infrastructure Defense on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Andreessen Horowitz published a proposal calling for coordinated, AI-assisted cybersecurity defenses across power, banking and payments, water, communications and hospitals. It would set signed sector targets, monthly progress reviews and a White House-led governance structure, but it is not government policy and does not specify costs.
Venture firm Andreessen Horowitz (a16z) published a proposal on November 12 for an AI-assisted cybersecurity effort focused on five U.S. infrastructure sectors: power, banking and payments, water, communications and hospitals. Written by a16z General Partner and Head of Global Affairs Anne Neuberger, the plan would have a White House task force set targets, infrastructure-company CEOs answer for progress and existing industry groups report monthly scorecards; it is a proposal, not adopted policy.
The proposal’s central choice is to focus on a limited set of operators and shared vendors whose failure could have effects across a sector or nationally. a16z describes these as a few hundred critical operators and vendors, including large transmission substations, major payment systems, big-city water utilities, core telecom networks and emergency-call systems, as well as regional trauma centers and health-record vendors. That list is the firm’s account of where risk is concentrated, not a government designation published with the plan.
For each sector, the plan calls for CEOs to sign three measurable targets: zero internet-exposed control systems, passing drills to operate manually for 72 hours, and containing critical vulnerabilities—through a patch or a compensating control—within a set time. The proposal says the highest-priority targets should be contained within six months. It does not specify the full schedule for every target or how compliance would be independently verified.
The proposed chain of responsibility runs from the White House’s Super Intelligence Force to a CEO council and then to existing Information Sharing and Analysis Centers, or ISACs. The task force would set national targets, chair monthly CEO reviews and clear policy or funding obstacles. CEOs would be publicly accountable for sector results. ISACs would coordinate shared AI tools and fixes, arrange mutual aid and send anonymized metrics each month. The plan says a sector falling behind would face a CEO-level review.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Accountability Across Five Sectors
The plan would shift infrastructure cybersecurity from a collection of company-level efforts toward shared sector targets and recurring executive reviews. Its focus on a limited number of operators and common vendors is intended to concentrate resources where a disruption could spread beyond one organization. That approach could matter for essential services that depend on interconnected networks, suppliers and software.
a16z argues that AI could help defenders identify exposed systems, rank risks and generate fixes more quickly. For equipment that cannot be patched, it says AI could help produce compensating measures, such as a firewall rule or settings change. These are potential uses described by the proposal, not evidence that the tools have been deployed at scale or that they can reliably meet the proposed timelines.
The plan also seeks legal protections: it calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and considers a possible safe harbor for participating companies that meet outcomes-based targets. Those provisions would require government action. The proposal could affect how firms share security information and report progress, but it does not establish new legal obligations by itself.
Products Worth Considering
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
LG UltraGear 27G810A-B 27-Inch 4K UHD IPS Gaming Monitor
Ledger Flex Cryptocurrency Wallet with 2.8-Inch Touchscreen
As an affiliate, we earn on qualifying purchases.
From Government Service to a16z
Neuberger’s background is part of the proposal’s framing. She says she worked on infrastructure security inside the U.S. government, including at the National Security Agency and as deputy national security adviser for cyber and emerging technology, before joining a16z. The firm says she also outlined the plan in a Wall Street Journal opinion piece.
The proposal is addressed to the White House’s Super Intelligence Force. The source material says President Donald Trump announced the task force on October 4, 2026, and named National Intelligence Director Jay Clayton to lead it. The plan envisions the force coordinating federal engagement with infrastructure providers and AI companies, while keeping sector lead agencies involved: Energy for power, Treasury for banks, the Environmental Protection Agency for water, the Federal Communications Commission for communications and Health and Human Services for hospitals.
a16z presents its governance diagram as illustrative. Its suggested council would include two or three CEOs from each sector, with cloud and AI-lab CEOs participating as non-voting members. The firm also invests in AI and security companies, a relevant interest because its plan gives technology companies a role in the proposed structure. That connection does not establish that the plan’s recommendations are motivated by those investments, but it is context readers should know.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z General Partner and Head of Global Affairs, in the proposal
The document does not provide a cost estimate, dedicated funding plan or implementation schedule for the proposal as a whole. It also does not explain how the six-month containment goal would apply across different equipment, vendors and sectors, or who would independently validate monthly scorecards and company attestations.
It remains unclear whether the White House task force or any participating agencies will adopt the framework, whether the proposed CEO council will be formed, and what legal language a safe harbor might contain. The proposal also does not establish how companies would be selected for participation or how disagreements over targets would be handled. Its AI-related claims describe expected capabilities; the source material does not provide performance data demonstrating that AI tools can find and remediate vulnerabilities within the proposed time frames.
Whether Washington Takes It Up
The next step would be for the White House and relevant agencies to decide whether to take up the proposal and define authority, funding, participation and oversight. If the government pursues it, the framework would need sector targets, reporting rules and a method for checking that claimed progress reflects effective protections.
The proposal also calls for Congress to reauthorize the Cybersecurity Information Sharing Act of 2015 over the long term. No adoption, legislative action or implementation timetable is established in the source material. Until those decisions are made, the plan remains a private-sector recommendation rather than an operational federal program.
Key Questions
What did a16z propose?
a16z proposed a White House-coordinated cybersecurity effort for power, banking and payments, water, communications and hospitals, using signed targets, AI-assisted tools and monthly sector scorecards.
Is the plan U.S. government policy?
No. The proposal was published by a16z on November 12, 2026. The source material does not say that the White House or Congress has adopted it.
What security targets does it call for?
Sector CEOs would sign targets for zero internet-exposed control systems, passing 72-hour manual-operation drills and containing critical vulnerabilities within a set time. The plan says top targets should be contained within six months.
Who would oversee progress?
The proposed White House Super Intelligence Force would set targets and review progress. A CEO council would answer for sector results, while existing ISACs would coordinate work and report monthly metrics.
What remains unknown about implementation?
The proposal provides no overall cost estimate or complete implementation schedule. It is also unclear whether government agencies will adopt it, how results would be independently verified or whether Congress will reauthorize the information-sharing law it references.
Source: ThorstenMeyerAI.com
