🔍 Read the full analysis: How AI Speed Shapes A16z’s Plan For US Infrastructure Defense on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Andreessen Horowitz published a proposal calling for U.S. officials and industry leaders to focus cyber defenses on a few hundred infrastructure operators and shared vendors. It would set measurable security targets, use monthly sector scorecards and seek legal protections for participating companies, but it is not government policy and gives no cost estimate.
Andreessen Horowitz published a proposed U.S. infrastructure cyber defense plan on November 12, urging the White House and major companies to secure a few hundred operators and shared vendors whose disruption could affect the country. Written by Anne Neuberger, a16z’s general partner and head of global affairs, the plan would set measurable security targets and use monthly scorecards; it is a proposal, not adopted government policy.
The plan’s premise is that AI is shortening the time between finding a software weakness and exploiting it. Neuberger argues that defenders relying on slower, manual processes may not keep pace. The proposal also points to defensive uses for AI, including finding exposed systems, prioritizing risks and helping generate fixes or workarounds for equipment that cannot readily be patched. Whether those tools can be deployed quickly enough remains an open question in the plan itself.
Rather than try to protect every system equally, the proposal concentrates on power, banking and payments, water, communications and hospitals. It describes a few hundred operators and shared vendors as potential points of national-level failure, including major transmission infrastructure, payment networks, large-city water utilities, core telecommunications and emergency services, and health-care providers and vendors.
Under the proposed governance structure, the White House’s Super Intelligence Force would set national targets and convene monthly reviews. A CEO council would answer for sector results, while existing Information Sharing and Analysis Centers (ISACs) would coordinate work and submit anonymized monthly metrics. The plan lists relevant federal agencies for each sector, including the Departments of Energy and Treasury, the Environmental Protection Agency, the Federal Communications Commission and the Department of Health and Human Services.
Sector leaders would sign three kinds of targets: no internet-exposed control systems, passing drills to operate manually for 72 hours, and containing critical vulnerabilities through a patch or compensating control within a specified period. The proposal says top targets should be contained within six months. It also calls for board attestations at public companies, with regulators accepting those metrics in place of duplicate audits, and for larger companies to help smaller operators improve defenses.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
A Shift Toward Measurable Defenses
The proposal would shift attention from broad cyber guidance toward named outcomes, executive accountability and recurring measurements. If adopted, it could change how infrastructure companies report security progress and how regulators evaluate it. Its emphasis on shared vendors also recognizes that a weakness in a supplier can affect multiple operators, rather than just one company.
The focus on AI makes the timing relevant to both public officials and infrastructure owners. The plan’s argument is that attackers may use AI to identify and exploit weaknesses faster, while defenders could use similar tools to find and address them. That is the proposal’s rationale, not evidence that the suggested tools have already delivered these results at national scale.
The approach could also affect smaller utilities, rural hospitals and community banks. The plan proposes that larger organizations sponsor or support them, but does not specify the funding, staffing or technical commitments that would make such assistance reliable. Any new reporting duties or accountability rules would also require decisions by government and industry leaders.
Products Worth Considering
Samsung Odyssey G3 G30D 27-Inch FHD Gaming Monitor
Kindle Paperwhite Signature Edition 32GB E-Reader, 7-Inch Display, Seaglass Green
LG UltraGear 32-Inch QHD 180Hz Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Federal Cyber Roles to a16z
Neuberger’s experience includes work at the National Security Agency and as deputy national security adviser for cyber and emerging technology, according to the plan. She now works at a16z, a venture firm that invests in AI and security companies. That background informs the proposal, while the firm’s investments are relevant context when considering its calls for AI-sector participation.
The plan is addressed to the White House’s Super Intelligence Force. The source material says President Donald Trump announced the task force on October 4, 2026, and named National Intelligence Director Jay Clayton to lead it, citing NBC News. A16z’s proposal would have the force set targets and clear policy or funding barriers, with CEOs and ISACs responsible for carrying out and tracking the work.
The proposal also asks Congress to renew the Cybersecurity Information Sharing Act of 2015 for the long term and considers a possible safe harbor for companies that meet outcomes-based targets. These are requests in the plan, not enacted legal changes.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z general partner and head of global affairs
The proposal does not provide a cost estimate, funding commitments or implementation schedule. It does not say which entities would be included among the targeted operators, how the six-month containment goal would apply across different systems, or what consequences would follow if a sector missed its targets.
It is also unclear whether the White House, Congress, regulators or infrastructure companies will adopt any part of the plan. The proposed safe harbor and long-term reauthorization of the 2015 information-sharing law would require decisions beyond a16z. The source describes the CEO council governance table as illustrative, so its membership and authority are not settled.
Finally, the proposal’s estimates of where national risk is concentrated and its expectations for AI-assisted defense are claims advanced by a16z. The material does not provide independent validation of the proposed targets, a complete list of affected operators, or evidence that AI tools can meet the plan’s timelines across all five sectors.
Decisions for the White House and Industry
The next step would be for the White House’s Super Intelligence Force and infrastructure leaders to decide whether to pursue the proposal and define who would participate. If they move forward, they would need to set sector-specific timelines, determine how ISACs would collect and protect metrics, and identify the resources required for smaller operators.
Congress would need to consider the plan’s request to renew the Cybersecurity Information Sharing Act, while regulators and lawmakers would have to resolve whether an outcomes-based safe harbor is appropriate. Until those decisions are made, the plan remains a framework from a16z rather than an active federal program.
Key Questions
Has the U.S. government adopted the a16z plan?
No. It is a proposal published by a16z, and the supplied material does not report that the White House or Congress has adopted it.
Which infrastructure sectors would the plan prioritize?
It names power, banking and payments, water, communications and hospitals, with particular focus on operators and shared vendors whose failure could have wider effects.
What security targets does the proposal set out?
It proposes eliminating internet-exposed control systems, passing 72-hour manual-operation drills, and containing critical vulnerabilities through patches or compensating controls within set timelines. It says top targets should be contained within six months.
How would companies be held accountable?
Sector CEOs would sign targets, and ISACs would report anonymized monthly scorecards. A sector falling behind would face a CEO-level review under the proposed structure.
What remains unknown about implementation?
The plan does not specify its cost, funding, final participants or implementation date. Its governance structure, legal protections and targets would also require decisions by government and industry.
Source: ThorstenMeyerAI.com
