🔍 Read the full analysis: A Closer Look At A16z’s AI-Speed Plan For Infrastructure Defense on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Andreessen Horowitz published a proposal on Nov. 12 for a White House-led effort to secure selected operators and shared vendors across five critical-infrastructure sectors. It calls for signed security targets, monthly reporting and possible legal protections, but is not government policy and does not specify a cost.
Venture firm Andreessen Horowitz (a16z) published a proposal on Nov. 12 for a White House-led effort to strengthen cybersecurity at selected operators and shared vendors across five critical sectors: power, banking and payments, water, communications and hospitals. The plan, written by a16z General Partner and Head of Global Affairs Anne Neuberger, calls for measurable security targets and monthly progress reporting, but it is a proposal, not adopted government policy.
The plan’s central premise is that artificial intelligence could speed up both cyberattacks and defense. It argues that AI can help identify exposed systems, rank risks and generate fixes, while attackers may also use the technology to find and exploit weaknesses faster. For equipment that cannot be patched, the proposal says AI could help develop compensating controls, such as firewall rules or settings changes. Whether those defenses can be deployed quickly enough remains an open question in the plan itself.
Rather than attempting to secure every system, a16z would focus on what it describes as a few hundred operators and shared vendors whose failure could cause wider disruption. Examples named in the proposal include large electric transmission substations, payment networks, major-city water utilities, core telecommunications and 911 systems, regional trauma centers and health-record vendors.
Under the proposed governance model, the White House’s Super Intelligence Force would set national targets, convene monthly CEO reviews and address policy or funding barriers. A CEO council would include two or three executives from each sector; cloud and AI-lab executives would participate as non-voting members. Existing sector Information Sharing and Analysis Centers, or ISACs, would coordinate tools and fixes and report anonymized metrics. The plan also lists federal lead agencies for the sectors, including the Energy Department for power and the Health and Human Services Department for hospitals.
Each sector’s CEOs would sign targets covering zero internet-exposed control systems, passing 72-hour manual-operation drills and containing critical vulnerabilities—through a patch or another control—within a set period. The proposal says the highest-priority targets should be contained within six months. ISACs would submit monthly scorecards; a sector falling behind would face a CEO-level review with the Super Intelligence Force leader.
The proposal also calls for public-company boards to attest to progress metrics, with regulators accepting those attestations in place of duplicate audits. It suggests that larger organizations help smaller ones, such as major utilities supporting municipal providers and large health systems assisting rural hospitals. To encourage participation, a16z seeks long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and proposes considering a safe harbor for companies meeting outcomes-based targets.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
A Targeted Model for Critical Services
The proposal would shift attention from broad, organization-by-organization cybersecurity efforts toward a defined set of operators and vendors whose disruption could affect essential services. If implemented, the targets could give companies and federal agencies shared measures for preparedness, including whether facilities can operate manually and whether serious vulnerabilities are contained.
That approach could also make accountability more visible: executives would sign targets, ISACs would track progress and lagging sectors could face leadership reviews. The proposed assistance for smaller providers recognizes that local utilities, rural hospitals and community banks may have fewer resources than national firms, even when their services matter to the same networks.
Those consequences are conditional. The source describes a plan from a venture firm, not a federal directive, and provides no cost estimate. It also proposes a role for cloud and AI companies while seeking liability protections for participating companies. That makes the design and independence of oversight relevant to any future government consideration.
Products Worth Considering
FLEXISPOT Electric Adjustable Workbench, 55 x 28 Inches, White
HP OfficeJet 250 Wireless Mobile All-in-One Inkjet Printer
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
As an affiliate, we earn on qualifying purchases.
From Government Cyber Work to a16z
Neuberger’s background is part of the proposal’s framing. She says she worked on infrastructure security in the U.S. government, first at the National Security Agency and later as Deputy National Security Advisor for Cyber and Emerging Technology. She is now an a16z general partner and leads the firm’s global affairs work.
The proposal is directed toward the White House’s Super Intelligence Force. According to NBC News, President Donald Trump announced the task force on Oct. 4, 2026, and named National Intelligence Director Jay Clayton to lead it. The source material says the president described its remit as including engagement with critical-infrastructure providers and superintelligence companies. The a16z plan presents that force as the body that would set targets and review sector performance.
a16z says the plan was also outlined in a Wall Street Journal opinion piece. Its governance table is labeled “for illustrative purposes only,” a qualification that underscores that the proposed roles and reporting arrangements are not confirmed operating structures.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— a16z’s plan
Policy, Cost and Oversight Remain Open
No government adoption, implementation timetable or funding commitment is established in the source material. The proposal names a six-month goal for top targets, but does not specify when that period would begin or how many operators would be covered in practice.
It also gives no cost estimate or detailed funding plan. The proposed safe harbor is not defined: the source does not say what liabilities it would cover, what standards companies would have to meet or how compliance would be verified. Nor does the material specify how the CEO council would be selected, how disputes over scorecards would be handled, or which information could be made public.
The plan’s claims about concentrated national risk and AI’s ability to accelerate defense are arguments advanced by a16z. The supplied material does not provide independent validation, operational results or evidence that the proposed targets are achievable across all five sectors. a16z’s investments in frontier AI labs and security companies also create a relevant interest to disclose when evaluating its recommendations; the source does not establish that any specific portfolio company would receive a role or benefit.
Whether the White House Takes It Up
The next confirmed step is not a scheduled implementation milestone but a question of whether the White House or relevant agencies consider the proposal. If officials pursue it, they would need to define the participating operators, baseline measures, reporting rules, costs and relationship between the proposed CEO council, ISACs and existing regulators.
Congressional action would also be needed for the requested long-term reauthorization of the Cybersecurity Information Sharing Act of 2015. Any safe-harbor proposal would require further detail about eligibility and accountability. Until those steps are announced, the six-month target and monthly scorecards remain elements of a16z’s suggested framework, not requirements for infrastructure companies.
Key Questions
What did a16z propose?
a16z proposed a White House-coordinated program to set cybersecurity targets for selected operators and shared vendors in power, banking and payments, water, communications and hospitals. It calls for CEO oversight and monthly sector scorecards.
Is the plan already U.S. government policy?
No. The source describes it as a proposal published by a16z on Nov. 12, 2026. It does not report that the White House or Congress has adopted it.
What security targets does the proposal name?
It calls for zero internet-exposed control systems, successful 72-hour manual-operation drills and critical vulnerabilities to be contained within a set time. The plan says top targets should be contained within six months.
Who would oversee the proposed effort?
The plan assigns target-setting and monthly review to the White House’s Super Intelligence Force, with a CEO council accountable for sector results and existing ISACs coordinating work and reporting metrics.
What remains unknown about the proposal?
The source gives no cost estimate or confirmed implementation schedule. The details of a proposed legal safe harbor, participation rules, oversight and verification are also unresolved.
Source: ThorstenMeyerAI.com
