🔍 Read the full analysis: A16z’s Approach To AI-Speed Defense: What’s Planned And What’s Missing on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Andreessen Horowitz published a proposal on Nov. 12 for securing high-impact U.S. infrastructure against cyber threats accelerated by AI. It calls for White House-set targets, CEO accountability and monthly reporting, but is not government policy and does not specify costs.
Venture firm Andreessen Horowitz (a16z) published a proposal on Nov. 12 for a U.S. cyber defense effort focused on a few hundred infrastructure operators and shared vendors whose failure could have broad consequences. Written by Anne Neuberger, a16z’s general partner and head of global affairs, the plan would put the White House’s Super Intelligence Force in charge of setting targets and ask company executives to answer publicly for progress. It is a proposal, not adopted policy.
The plan focuses on five sectors: power, banking and payments, water, communications and hospitals. Rather than trying to secure every organization at once, it prioritizes operators and shared vendors whose disruption could affect services across a region or the country. The examples in the proposal include transmission substations, payment systems, major-city water utilities, core telecommunications and 911 systems, trauma centers and health-record vendors.
For each sector, the proposal would have chief executives sign commitments to achieve zero internet-exposed control systems, pass drills showing they can operate manually for 72 hours, and contain critical vulnerabilities—through a patch or compensating control—within a set time. The plan says top targets should be contained within six months. Existing sector Information Sharing and Analysis Centers, or ISACs, would coordinate work and submit anonymized performance measures monthly.
Governance would combine White House direction, industry accountability and existing sector bodies. The Super Intelligence Force would set national targets, convene monthly CEO reviews and address policy or funding obstacles. A council with two or three CEOs per sector would sign targets; cloud and AI-lab CEOs would participate as non-voting members. ISACs would coordinate shared tools, vendor fixes and mutual aid. The proposal also calls for public-company boards to attest to progress, with regulators accepting those attestations in place of duplicate audits.
a16z asks for legal support alongside the targets, including long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and consideration of a safe harbor for participating companies that meet outcome-based goals. It does not set out a budget or establish that such protections have been approved.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
A Narrower Target for Cyber Defense
The proposal’s central choice is to concentrate resources on organizations whose failure could spread beyond a single company. If the identified operators and vendors are genuinely the main points of systemic exposure, shared targets and coordinated remediation could direct attention toward risks with wider consequences. The plan also seeks to make preparedness measurable through exposure limits, manual-operation exercises and vulnerability deadlines, rather than relying only on information-sharing.
That approach would require substantial coordination among federal agencies, regulators, infrastructure companies and vendors. The proposed CEO reviews and board attestations could create clearer accountability, but they would also raise questions about how targets are measured, how sensitive security information is handled and what happens when a company falls behind. The proposal’s request for a safe harbor reflects the possibility that companies may need legal incentives to share information and participate.
The design has a potential conflict to manage: a16z invests in frontier AI labs and security companies, while the proposal gives cloud and AI-lab executives a role in its governance and advocates using AI tools for defense. That does not establish improper influence, but it makes transparent rules for participation, disclosure and decision-making relevant to public evaluation of the plan.
Products Worth Considering
Dell UltraSharp U4025QW 40 5K2K WUHD Curved LED Monitor (21:9)
FLEXISPOT Electric Adjustable Workbench, 48 x 30 in, Maple
Apple MacBook Neo 13-inch Laptop with A18 Pro Chip, 8GB Memory, 256GB SSD, Liquid Retina Display, and 1080p Camera — Blush
As an affiliate, we earn on qualifying purchases.
From AI Threat to Federal Proposal
The plan’s stated premise is that AI could shorten the time between discovery of a software weakness and its exploitation. It argues that defenders can also use AI to find exposed systems, prioritize risks and generate fixes, including workarounds for equipment that cannot be patched. The proposal itself acknowledges the central uncertainty: whether defensive tools can be applied quickly enough.
Neuberger says she worked on infrastructure security in government, including at the National Security Agency and as deputy national security adviser for cyber and emerging technology. a16z says she also outlined the plan in a Wall Street Journal opinion piece. The source document describes its governance table as illustrative, not as an established arrangement.
The proposal is addressed to the White House’s Super Intelligence Force. According to NBC News, President Donald Trump announced the task force on Oct. 4, 2026, and named National Intelligence Director Jay Clayton to lead it. The source material says Trump described its remit as including engagement with critical infrastructure providers and super-intelligence companies. The task force’s existence does not mean it has adopted a16z’s recommendations.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z general partner and head of global affairs, in the proposal
Policy, Costs and Safeguards Unsettled
No federal adoption, implementation timetable or funding commitment is established in the supplied source material. The proposal does not name a cost, explain how the government would select the operators and vendors covered, or specify how companies would be held accountable if they miss a target.
It is also unclear what standards would define a passed 72-hour manual-operation drill or the deadline for containing a critical vulnerability. The proposed legal safe harbor remains a request, and its scope and conditions are unspecified. The plan does not resolve how confidential technical data would be protected, how regulators would verify reported outcomes or how its governance bodies would address conflicts of interest.
The proposal’s statements about AI’s ability to find vulnerabilities and generate fixes are not accompanied in the supplied material by performance data, independent evaluation or evidence that the tools work reliably across legacy systems. The scale of the threat and the claim that risk is concentrated are likewise presented as the plan’s assessment, not as independently established findings here.
Whether Washington Takes It Up
The next substantive development would be a response from the White House’s Super Intelligence Force or relevant agencies, including whether they adopt, revise or reject the proposed targets and governance structure. Any move toward implementation would need to identify participating companies, define sector-specific measures, assign responsibilities to agencies and ISACs, and explain how funding and legal protections would work.
Readers should look for a published timetable and concrete rules for reporting and verification. Until those appear, the six-month goal for top targets and monthly scorecards are recommendations in a16z’s plan, not deadlines imposed on infrastructure operators.
Key Questions
Has the U.S. government adopted a16z’s cyber defense plan?
No adoption is reported in the supplied material. The document is a proposal published by a16z, not an announced federal policy.
Which infrastructure sectors would the proposal cover?
It names power, banking and payments, water, communications and hospitals, with priority given to operators and shared vendors whose failure could have wider effects.
What targets would companies be asked to meet?
Sector CEOs would sign commitments covering internet-exposed control systems, 72-hour manual-operation drills and containment of critical vulnerabilities. The plan says top targets should be contained within six months, but does not establish a government deadline.
Who would oversee the proposed work?
The proposal assigns national target-setting to the White House’s Super Intelligence Force, accountability to a sector CEO council, and coordination and monthly reporting to existing Information Sharing and Analysis Centers.
What remains unknown about the proposal?
The plan does not specify its cost, confirm federal backing, define all performance measures or settle the scope of its proposed legal safe harbor. It also does not provide independent evidence in the supplied material for the effectiveness of AI-assisted defenses.
Source: ThorstenMeyerAI.com
