🔍 Read the full analysis: What A16z’s AI Plan Means For US Infrastructure Preparedness on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Andreessen Horowitz published a proposal on November 12 for securing key U.S. infrastructure against faster AI-enabled cyber threats. It would set sector targets, assign public accountability to company CEOs and use existing information-sharing centers to coordinate work; it is not government policy, and its costs and implementation details are not specified.
Venture firm Andreessen Horowitz (a16z) published a proposal on November 12, 2026, calling for a White House-led effort to protect the U.S. infrastructure operators and shared vendors it says could cause nationally cascading failures. Written by a16z General Partner and Head of Global Affairs Anne Neuberger, the plan would set cybersecurity targets across five sectors—power, banking and payments, water, communications and hospitals—but it is a proposal, not current federal policy.
The plan argues that artificial intelligence is shortening the time between discovery of a software weakness and its exploitation. It says AI could also help defenders find exposed systems, rank risks and generate fixes, including workarounds for equipment that cannot be patched. Whether those tools can be deployed quickly enough is an open question acknowledged in the proposal.
Rather than attempt to secure every organization at once, a16z recommends concentrating on a few hundred operators and shared vendors whose failure could have wider consequences. Examples cited include large transmission substations, payment networks, major-city water utilities, core telecommunications and 911 systems, regional trauma centers and health-record vendors. These are examples in the plan, not a published final list of designated entities.
The proposed governance structure gives the White House’s Super Intelligence Force responsibility for national targets and monthly reviews. A council of two or three CEOs from each sector would sign onto targets and answer publicly for progress; cloud and AI-lab executives would participate as non-voting members. Existing sector Information Sharing and Analysis Centers, or ISACs, would coordinate shared tools, vendor fixes and mutual aid, then submit anonymized monthly metrics. The plan also assigns roles to agencies including the Departments of Energy and Treasury, the Environmental Protection Agency, the Federal Communications Commission and the Department of Health and Human Services.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Targets for Essential Services
The proposal would shift some infrastructure cybersecurity work from voluntary coordination toward measurable sector targets and executive accountability. Its suggested benchmarks are zero internet-exposed control systems, passing 72-hour manual-operation drills and containing critical vulnerabilities—through a patch or compensating control—within a set period. The plan says its top targets should be contained within six months, though it does not specify a complete schedule for every sector.
That focus matters because disruption in infrastructure can affect services beyond the organization initially attacked. A power, communications or payment outage can impede hospitals, businesses and public agencies. The proposal’s approach is to prioritize systems with the potential for cascading effects, rather than treat every organization as equally consequential.
Its accountability model could also affect how companies report progress. The plan proposes board attestation for public companies and suggests regulators accept those attestations instead of duplicate audits. It further proposes that larger organizations help fund or support smaller utilities, rural hospitals, community banks and rural carriers. These measures could distribute tools and expertise, but the proposal does not establish that regulators or companies have agreed to them.
Products Worth Considering
Samsung Odyssey G3 G30D 27-Inch FHD Gaming Monitor
Bose QuietComfort Wireless Noise-Cancelling Headphones, White Smoke
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
As an affiliate, we earn on qualifying purchases.
From Government Security to a16z
Neuberger says she spent several years working on infrastructure security in government, first at the National Security Agency and later as deputy national security adviser for cyber and emerging technology. She now works at a16z. The firm says she also outlined the plan in a Wall Street Journal opinion piece.
The plan is addressed to the White House’s Super Intelligence Force. According to NBC News, President Donald Trump announced the task force on October 4, 2026, and named National Intelligence Director Jay Clayton to lead it. The administration described the force as coordinating federal engagement with critical infrastructure providers and AI companies. The existence of the task force does not mean it has adopted a16z’s recommendations.
a16z also calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and proposes considering safe-harbor protections for participating companies that meet outcomes-based targets. The firm invests in frontier AI labs and cybersecurity companies, an interest relevant to readers evaluating its recommendations about AI tools and private-sector participation.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— a16z plan, authored by Anne Neuberger
The proposal does not state how much the plan would cost, how funding would be divided, or which specific companies would be included in the proposed priority group. It also does not provide full implementation schedules for all targets or explain how progress would be independently verified across sectors.
It remains unclear whether the Super Intelligence Force, federal agencies, industry groups or companies will adopt any part of the plan. The proposed legal safe harbor, CISA reauthorization, regulator treatment of board attestations and CEO accountability arrangements would require decisions beyond a16z. The supplied material does not establish that these recommendations have been endorsed by the White House or relevant regulators.
The plan’s emphasis on AI is also a forecast about both risk and defense: it says the same technology could help attackers and defenders, but provides no independent performance data in the material supplied. Its governance table is labeled by a16z as being for illustrative purposes only. The firm’s investments in AI and security companies are another relevant consideration when weighing its advocacy for a larger role for those industries.
Decisions for the White House
The next step is whether the White House’s Super Intelligence Force or relevant agencies take up the recommendations. The proposal points toward national targets, monthly scorecards and CEO reviews, but does not set a confirmed government timetable or say that such meetings have been scheduled.
Any move to put the plan into practice would require further decisions on which operators and vendors qualify, how targets are measured, who pays for upgrades and how the proposed legal protections would work. Until agencies and companies announce concrete actions, the plan remains a private-sector proposal rather than an active national program.
Key Questions
What did a16z propose?
a16z proposed a White House-led cybersecurity effort focused on key operators and shared vendors in five infrastructure sectors, with targets, CEO accountability and monthly reporting through existing ISACs.
Is the plan already U.S. government policy?
No. It is an a16z proposal. The source material does not say that the White House or federal agencies have adopted it.
What cybersecurity targets does the proposal suggest?
It proposes zero internet-exposed control systems, passing 72-hour manual-operation drills and containing critical vulnerabilities within a set time. The plan says its top targets should be contained within six months.
Which sectors would be covered?
The proposal names power, banking and payments, water, communications and hospitals. It also points to selected operators and vendors whose failure could have wider effects; it does not provide a finalized list.
What remains unknown about implementation?
The proposal gives no cost estimate and does not confirm company participation, a government timetable, funding arrangements or whether regulators would accept the suggested reporting and safe-harbor measures.
Source: ThorstenMeyerAI.com
