🔍 Read the full analysis: A16z Sets Out A Plan For AI-Speed Defense—and Identifies Gaps on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Andreessen Horowitz published a proposal for accelerating cyber defenses across power, banking, water, communications and hospitals. It calls for White House-set targets, CEO accountability and monthly reporting, but no government adoption, cost estimate or implementation details are confirmed.
Venture firm Andreessen Horowitz (a16z) published a proposal on Nov. 12 for speeding up cybersecurity across five U.S. critical infrastructure sectors, urging the White House to set measurable targets and hold company leaders accountable. The plan, written by a16z General Partner Anne Neuberger, is a proposal—not adopted government policy—and calls for protections spanning power, banking and payments, water, communications and hospitals.
The proposal focuses on what it describes as a few hundred operators and shared vendors whose disruption could have consequences beyond an individual company. Instead of trying to secure every organization at once, it names examples such as large power substations, payment networks, major-city water utilities, core telecommunications and emergency-call systems, regional trauma centers and health-record vendors. This concentration is the plan’s central organizing assumption, not an independently established count of the most vulnerable entities.
For each sector, the plan proposes three CEO-signed goals: zero internet-exposed control systems, passing drills for 72-hour manual operation, and containing critical vulnerabilities—by patching them or applying another control—within a specified time. The document says the highest-priority targets should be contained within six months. It would have industry Information Sharing and Analysis Centers, or ISACs, coordinate shared tools and fixes and send anonymized monthly scorecards to a White House task force. A sector falling behind would face a CEO-level review, according to the proposal.
The proposed governance structure assigns the White House’s Super Intelligence Force responsibility for setting targets, convening monthly CEO reviews and addressing policy or funding barriers. A CEO council would include two or three executives per sector; cloud and AI-lab executives would participate as non-voting members. Existing federal lead agencies would remain involved, with the plan listing the Energy Department for power, Treasury for banks, EPA for water, the FCC for communications and HHS for hospitals. The governance table is marked “For illustrative purposes only.”
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
A Sector-Wide Test for Cyber Readiness
The proposal would shift part of infrastructure cybersecurity from voluntary coordination toward shared, measurable outcomes. A common requirement to remove internet exposure from control systems, for example, could make progress easier to track across companies and sectors. Monthly reporting and CEO reviews would also elevate responsibility beyond security teams and make delays visible to senior leaders.
The plan’s emphasis on AI reflects a concern that attackers may use the technology to identify weaknesses faster, while defenders could use it to find exposed systems, rank risks and generate fixes. That is the proposal’s rationale, not evidence that AI tools can reliably secure complex infrastructure at the required speed. The plan also points to manual-operation drills as a way to keep essential services functioning when digital systems fail.
Its approach could matter to smaller providers as well as large firms. The document proposes that large utilities, health systems, banks and carriers help fund or support smaller organizations in their sectors. If carried out, that could address gaps in resources; the proposal does not specify the cost or how such support would be financed.
Products Worth Considering
Bose QuietComfort Ultra Headphones (2nd Gen), Wireless Noise-Cancelling Over-Ear Headphones with Spatial Audio, Driftwood Sand
Apple Watch SE 3 GPS 44mm Smartwatch
Samsung Odyssey G3 G30D 27-Inch FHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Government Cyber Work to a16z
Neuberger says she worked on infrastructure security in the U.S. government, first at the NSA and later as deputy national security adviser for cyber and emerging technology. She is now a general partner and head of global affairs at a16z. The firm says she also outlined the proposal in an opinion piece in The Wall Street Journal. Her government experience provides relevant background, but the plan is published by a venture firm rather than a federal agency.
The proposal is addressed to the White House’s Super Intelligence Force. President Donald Trump announced the task force on Oct. 4, 2026, and named National Intelligence Director Jay Clayton to lead it, according to NBC News. The proposal would make that body the central coordinator for the plan, but its publication does not establish that the task force has accepted or is considering the recommendations.
a16z also says the government lacks a governance model for a rapid effort to secure critical infrastructure. The document seeks long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and proposes considering a legal safe harbor for companies that meet outcomes-based targets. Those are policy requests; the source does not report that either change has been approved.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z general partner and head of global affairs, in the proposal
Adoption, Costs and Safe Harbor
There is no confirmation in the cited material that the White House or the Super Intelligence Force has endorsed the plan, selected participating companies or set a start date. The document does not give a budget, identify who would pay for shared tools and support, or explain how the proposed six-month deadline would apply across different systems and sectors.
It also leaves open how targets would be measured and verified, what qualifies as a compensating control, and how public-company board attestations would interact with existing regulatory requirements. The proposed safe harbor is described as a possibility, not a settled legal mechanism. a16z invests in frontier AI labs and security companies, while the plan gives cloud and AI-lab executives a non-voting role; the source does not detail how potential conflicts of interest would be managed.
Finally, the proposal argues that AI could help defenders find systems and produce fixes, but it does not provide evidence here that those tools are ready for broad deployment or that they can keep pace with attackers. Its own framing leaves how quickly AI can be applied unresolved.
Whether Washington Takes It Up
The immediate next step is not a scheduled implementation milestone but a decision about whether the White House task force or federal agencies will respond to the proposal. The source material gives no official government reaction, timetable for a CEO council, or date for sector targets. Any movement toward the plan would require decisions about authority, funding, reporting and legal protections.
Readers can watch for statements from the Super Intelligence Force and the five agencies named in the proposal, as well as whether infrastructure companies or ISACs begin discussing shared targets. Reauthorization of the information-sharing law and any safe-harbor legislation would require separate policy action. Until those steps are confirmed, the plan remains a private-sector recommendation, not an operational federal program.
Key Questions
What did a16z propose?
a16z proposed a White House-coordinated cybersecurity effort for power, banking and payments, water, communications and hospitals, with sector targets signed by CEOs and monthly progress reporting through existing ISACs.
Is the plan U.S. government policy?
No. It was published by a16z on Nov. 12, 2026. The available source material does not show that the White House or the Super Intelligence Force has adopted or endorsed it.
What cybersecurity targets does it set out?
The proposal calls for no internet-exposed control systems, successful 72-hour manual-operation drills, and critical vulnerabilities contained within a set time. It says the highest-priority targets should be contained within six months.
How would companies be held accountable?
A CEO council would sign sector goals, while ISACs would report anonymized monthly metrics. A sector missing its targets would face a CEO-level review under the proposed structure.
What remains unknown?
Government adoption, implementation dates, costs, verification rules and the details of any legal safe harbor remain unconfirmed or unspecified. The proposal also does not establish how effective AI-assisted defenses would be in practice.
Source: ThorstenMeyerAI.com
