🔍 Read the full analysis: A16z’s AI-Speed Infrastructure Plan: What It Promises And What It Flags on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Andreessen Horowitz published a proposal on Nov. 12 for a White House-led cyber defense effort covering power, banking, water, communications and hospitals. It calls for signed security targets, monthly scorecards and legal protections for participating companies; it is a proposal, not government policy, and does not specify costs.
Venture firm Andreessen Horowitz (a16z) published a proposal on Nov. 12 for a White House-led cyber defense program focused on five infrastructure sectors, arguing that AI is speeding up both vulnerability discovery and attacks. The plan would set measurable security targets for power, banking and payments, water, communications and hospitals, but it is a proposal, not adopted policy.
Written by Anne Neuberger, a16z general partner and head of global affairs, the plan says the government should concentrate on “the few hundred operators and shared vendors whose failure would cascade nationally,” rather than attempt to protect every organization equally. The sectors named are power, banking and payments, water, communications and hospitals. The essay says Neuberger previously worked at the NSA and as deputy national security adviser for cyber and emerging technology.
The proposed governance structure would place the White House’s Super Intelligence Force at the top, setting national targets, chairing monthly reviews and addressing policy or funding obstacles. A council of two or three CEOs from each sector would sign targets and answer publicly for results. Cloud and AI-lab CEOs could participate as non-voting members. Existing sector Information Sharing and Analysis Centers, or ISACs, would coordinate shared tools and fixes and report anonymized metrics each month.
Targets would include zero internet-exposed control systems, passing drills to operate manually for 72 hours, and containing critical vulnerabilities—through a patch or compensating control—within a specified period. The plan says the highest-priority targets should be contained within six months. A sector falling behind would face a CEO-level review. For public companies, boards would attest to progress, with regulators accepting those attestations in place of duplicate audits. The proposal also calls for a long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and a possible safe harbor for companies meeting outcome-based targets.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
A Narrower Target for Cyber Defense
The proposal’s central bet is that concentrating effort on nationally consequential operators and shared vendors could produce faster gains than spreading limited resources across every organization. A failure in a widely used payment system, communications network, hospital vendor or power provider could affect many customers and institutions beyond the operator itself.
Its targets would also shift attention from broad commitments to measurable operational tests: whether control systems are exposed online, whether staff can maintain operations manually, and whether serious vulnerabilities are contained on time. Monthly reporting and executive reviews could make missed targets more visible. Those mechanisms could matter to utilities, banks, hospitals and their suppliers, particularly smaller organizations that lack large security teams.
But the plan relies on participation and authority that have not been established. It does not set out a budget, say how targets would be enforced, or explain how companies would qualify for legal protection. Those unresolved questions affect whether the proposed system could move from a framework into coordinated work across sectors.
Products Worth Considering
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Apple iPad 11-inch (A16), 128GB, Wi-Fi, Silver
DJI Osmo Mobile 8 3-Axis Phone Gimbal Stabilizer
As an affiliate, we earn on qualifying purchases.
From Threat Assessment to Governance Proposal
The essay frames its case around a shrinking window between finding a software weakness and exploiting it. It argues that AI could help defenders identify exposed systems, rank risks and generate fixes, while also helping attackers find weaknesses faster. The plan presents that as a race, but its description is an argument by a16z—not evidence in the source material that AI has already shortened response times across these sectors.
a16z says the proposal was also outlined in a Wall Street Journal opinion piece. It is directed toward the White House’s Super Intelligence Force, a task force that President Donald Trump announced on Oct. 4, 2026, according to NBC News. The source says Trump named National Intelligence Director Jay Clayton to lead it and described the group as coordinating engagement with critical infrastructure providers and AI companies.
The proposed sector agencies are the Department of Energy for power, Treasury for banking, the Environmental Protection Agency for water, the Federal Communications Commission for communications and the Department of Health and Human Services for hospitals. The essay labels its governance table illustrative, underscoring that the roles described are proposed rather than confirmed arrangements.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z general partner and head of global affairs, in the plan
The source describes no estimated cost, funding source, implementation schedule beyond the six-month priority target, or process for selecting the operators and vendors covered. It also does not explain what happens if a company refuses to participate or repeatedly misses a target.
The proposed safe harbor is not defined: the plan does not specify which legal claims it would cover, who would grant it, or how it would interact with existing obligations. Nor is it clear whether regulators would have the authority to accept board attestations instead of audits under current law. The proposal’s calls for new governance and legal protections remain recommendations, not confirmed government decisions.
a16z also invests in frontier AI labs and security companies. The source does not establish that those investments shaped the proposal, but the suggested non-voting role for AI-lab CEOs makes the firm’s commercial position relevant to readers evaluating who could participate and how conflicts would be handled. The source does not describe conflict-of-interest rules.
Whether the White House Adopts the Plan
The next milestone would be a decision by the White House and the Super Intelligence Force on whether to adopt, revise or reject the framework. The source does not report an official response, a launch date, or a government commitment to establish the proposed CEO council.
If officials pursue the idea, key details to watch include which companies qualify as priority operators, how sector targets are set, who pays for shared tools and smaller-provider support, and whether Congress takes up the requested reauthorization of the Cybersecurity Information Sharing Act of 2015. Until those decisions are made, the six-month target and monthly scorecards describe a proposed approach rather than an active program.
Key Questions
What did a16z propose?
a16z proposed a White House-led cyber defense effort focused on five sectors: power, banking and payments, water, communications and hospitals. It would use CEO-approved targets and monthly reporting through sector ISACs.
Is the plan government policy?
No. The source presents it as a proposal. It does not report that the White House or Congress adopted the recommendations.
What security targets does the plan name?
It calls for zero internet-exposed control systems, passing 72-hour manual-operation drills, and containing critical vulnerabilities within a set time. The plan says the top-priority targets should be contained within six months.
What legal changes does a16z want?
The proposal calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and suggests a possible safe harbor for companies that meet outcome-based targets. The safe harbor’s terms are not specified.
How much would the plan cost?
The source gives no cost estimate or funding plan. It also leaves open how support for smaller utilities, hospitals, banks and communications providers would be paid for.
Source: ThorstenMeyerAI.com
