🔍 Read the full analysis: Inside A16z’s Plan To Defend US Infrastructure At AI Speed on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Andreessen Horowitz published a proposal by General Partner Anne Neuberger on Nov. 12, 2026, to speed cybersecurity defenses for critical U.S. infrastructure using AI. It focuses on a few hundred operators and shared vendors across five sectors, with measurable targets and a proposed federal-private oversight structure. The plan is not government policy, and its costs and implementation details are not specified.
Andreessen Horowitz published a proposal on November 12, 2026 calling for a White House-led effort to protect the operators and vendors whose failure could disrupt essential U.S. services. Written by a16z General Partner and Head of Global Affairs Anne Neuberger, the plan would use AI to help identify and address cyber weaknesses, while setting security targets for companies in power, banking and payments, water, communications and hospitals. It is a proposal, not an adopted government program.
The proposal concentrates on what it describes as a few hundred critical operators and shared vendors, rather than attempting to secure every organization equally. Examples named in the plan include large transmission substations, payment networks such as Fedwire and ACH, major-city water utilities, core telecommunications and 911 systems, regional trauma centers, and health-record vendors. a16z argues that disruption at these points could spread beyond an individual company or community.
Its proposed governance structure has three levels. The White House’s Super Intelligence Force would set national targets, hold monthly reviews with company leaders and address policy or funding obstacles. A CEO council, with two or three company chief executives from each sector, would sign on to sector goals and answer publicly for progress. Industry Information Sharing and Analysis Centers, or ISACs, would coordinate work, use shared AI tools and report anonymized sector metrics each month. Cloud and AI-lab CEOs would participate as non-voting members, according to the plan’s illustrative governance table.
The targets would include zero internet-exposed control systems, passing drills to operate manually for 72 hours, and containing critical vulnerabilities—through a patch or compensating control—within a set period. The plan says its top targets should be contained within six months. A sector falling behind would face a CEO-level review. For public companies, boards would attest to progress, with regulators accepting those attestations in place of duplicate audits, as proposed. The plan also calls for larger companies to support smaller ones, including rural utilities, hospitals, carriers and community banks.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Protecting Services That Could Fail Together
The proposal’s central argument is that the consequences of a cyber incident depend not only on which organization is breached, but on whether it provides a service or technology used across a sector. By prioritizing shared vendors and nationally consequential operators, a program could direct limited security resources toward points where a failure might affect many communities or businesses at once.
The plan also treats response speed as a central issue. Neuberger argues that AI can help defenders discover exposed systems, rank risks and generate fixes more quickly, but attackers may use similar capabilities to find weaknesses. The proposal’s targets and monthly reporting are intended to turn that concern into measurable work and executive accountability. Whether AI tools can safely and reliably accelerate remediation is not established by the proposal itself.
For infrastructure companies, the suggested legal protections could shape whether they share information and take part. a16z calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and proposes considering a safe harbor for companies that meet outcome-based targets. Those changes would require government action and further definition; they are not protections currently granted by this plan.
Popular right now
Bose QuietComfort Wireless Headphones – Twilight Blue (Limited Edition)
Dyson V9 Motorbar Cordless Vacuum
Roborock Q7 M5+ Robot Vacuum and Mop
As an affiliate, we earn on qualifying purchases.
From Government Cybersecurity to a16z
Neuberger presents the proposal as informed by her prior government experience. She says she spent several years working on infrastructure security at the National Security Agency and later as deputy national security adviser for cyber and emerging technology. She now works at a16z, a venture firm that invests in frontier AI labs and security companies. That background is relevant to the proposal’s authorship and perspective; it does not establish that the plan has federal backing.
The proposed audience is the White House’s Super Intelligence Force. The source report says President Donald Trump announced the task force on Oct. 4, 2026, and named National Intelligence Director Jay Clayton to lead it, citing NBC News. The plan says the force would coordinate with critical infrastructure providers and AI companies. Its proposed arrangement would retain federal sector agencies, including the Energy Department for power, Treasury for banking, EPA for water, the FCC for communications and HHS for hospitals.
a16z also described the plan in a Wall Street Journal opinion piece, according to the firm. The document’s governance table is labeled “for illustrative purposes only.” Those details reinforce that the suggested chain of command and roles are recommendations, not a description of an operating government program.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z General Partner and Head of Global Affairs
The proposal does not name a budget, funding source or detailed implementation schedule. It says the top targets should be contained within six months, but the source material does not specify when that period would begin, how targets would be selected, or what would count as satisfactory evidence of completion.
It is also unclear whether the White House or Congress will adopt any part of the proposal, how the suggested CEO council would be formed, and what authority the Super Intelligence Force would have to require participation. The plan’s requests for a reauthorized information-sharing law and possible safe harbor are proposals, not enacted legal changes. Details on how liability protections would work, what standards companies would need to meet, and how regulators would verify results are not provided.
The proposal gives cloud and AI-lab leaders a non-voting role, but does not explain how conflicts of interest would be handled. a16z invests in AI and security companies, creating a relevant financial interest in sectors discussed by the plan. The source material does not identify a specific investment tied to any recommendation or establish that such interests shaped the proposal.
Whether Washington Takes Up the Plan
The next concrete step would be a decision by the White House on whether to use the proposal as a basis for policy, convene the suggested CEO council or ask agencies and ISACs to develop sector targets. The plan does not announce that any of these actions have been scheduled or accepted.
Further decisions would be needed on the proposed legal protections, funding, target-setting process and reporting rules. If officials pursue the approach, companies and regulators would need to clarify how manual-operation drills are evaluated, what qualifies as vulnerability containment and how anonymized monthly scorecards would be checked. Until those decisions are made, the plan remains a private-sector recommendation, rather than a defined federal cybersecurity program.
Key Questions
What did a16z propose?
a16z proposed a White House-led cybersecurity effort focused on critical infrastructure operators and shared vendors, with AI-supported defense work, sector targets, monthly reporting and CEO-level accountability.
Which infrastructure sectors are included?
The proposal names power, banking and payments, water, communications and hospitals. It prioritizes organizations whose disruption could have wider effects, along with shared technology vendors.
Is the plan now U.S. government policy?
No. It is a proposal published by a16z on November 12, 2026. The source material does not say that the White House or Congress has adopted it.
What security targets does it recommend?
It proposes eliminating internet-exposed control systems, passing 72-hour manual-operation drills, and containing critical vulnerabilities within a set period. The plan says top targets should be contained within six months.
What remains unknown?
The proposal does not set out a budget, establish a start date, define a detailed implementation process or say whether its proposed legal protections will be pursued.
Source: ThorstenMeyerAI.com
