🔍 Read the full analysis: What Are The Gaps In A16z’s AI-Speed Plan For US Infrastructure? on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Andreessen Horowitz published a proposal on November 12, 2026, to focus AI-assisted cyber defense on a few hundred operators and shared vendors across five infrastructure sectors. It calls for measurable targets, monthly reporting and a White House-led governance structure, but it is not government policy and does not specify costs or resolve questions about authority and liability.
Venture firm Andreessen Horowitz (a16z) published a proposal on November 12 for a White House-led effort to speed up cyber defenses at key US infrastructure operators, setting targets that it says should be met within six months. The plan, written by a16z general partner Anne Neuberger, focuses on power, banking and payments, water, communications and hospitals, but it is a proposal, not adopted government policy.
The plan argues that artificial intelligence is shortening the time between discovery of a software weakness and its exploitation. It proposes using AI for defensive tasks such as finding internet-exposed systems, ranking risks and helping generate fixes. For equipment that cannot be patched, the document says AI could help develop compensating measures, including firewall rules or settings changes. It does not establish that these tools have been tested at national scale or will work quickly enough; the proposal itself identifies speed of deployment as an open question.
a16z would concentrate protection on what it describes as a few hundred operators and shared vendors whose failure could have national effects. Examples in the plan include major power substations, payment systems, large-city water utilities, core telecom networks and emergency services, trauma centers and health-record vendors. The document does not provide a complete, named list of the organizations that would be covered.
For each sector, the proposal calls for CEOs to sign three outcome targets: zero internet-exposed control systems, successful 72-hour manual-operation drills, and critical vulnerabilities patched or contained with another control within a defined time. The most important targets, it says, should be met within six months. Existing sector information-sharing and analysis centers, or ISACs, would coordinate shared AI tools and fixes and submit anonymized metrics monthly. A sector falling behind would face a CEO-level review.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
How the Targets Could Change Oversight
The proposal would shift some infrastructure cybersecurity work from information sharing toward measurable outcomes and executive accountability. Monthly sector scorecards and CEO reviews could give the White House a clearer view of whether operators are reducing exposure, while 72-hour manual-operation drills would test whether services can continue during a cyber incident.
That approach could matter beyond the largest companies. The plan says larger organizations should help smaller ones, including utilities supporting municipal systems, health systems assisting rural hospitals, banks funding tools for community banks and national carriers backing rural providers. If implemented and funded, that arrangement could extend defensive capacity to organizations that may lack in-house resources. The document does not set out the funding mechanism or show how much support would be required.
The proposed legal protections could also affect how companies share threat information and meet security targets. a16z calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and suggests a possible safe harbor for companies that meet outcome-based goals. That could reduce legal uncertainty for participants, but the proposal does not define the safe harbor’s scope, eligibility rules or relationship to existing regulatory duties.
Popular right now
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds with Immersive Audio and Wireless Charging Case, Black
Roborock RockNeo Q110H Wire-Free Robot Lawn Mower
Samsung 43-Inch M70H Series 4K Mini LED Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
A White House Force Is the Proposed Lead
The plan is aimed at the White House’s Super Intelligence Force, a federal task force announced by President Donald Trump on October 4, 2026. NBC News reported that Trump named National Intelligence Director Jay Clayton to lead it. a16z proposes that the force set national targets, chair monthly reviews with company leaders and help clear policy or funding barriers. The proposal’s governance table is described as illustrative, rather than as an approved government structure.
Under the proposed arrangement, a council would include two or three CEOs from each sector. Cloud and AI-lab executives would participate as non-voting members, according to the document. Sector ISACs would do much of the coordinating work, while agencies including the Departments of Energy and Treasury, the Environmental Protection Agency, the Federal Communications Commission and the Department of Health and Human Services would retain sector roles.
Neuberger previously worked on infrastructure security at the National Security Agency and as deputy national security adviser for cyber and emerging technology, according to her account in the plan. She now works at a16z, which invests in frontier AI labs and security companies. That background and the firm’s investments are relevant to assessing the proposal’s perspective; they do not, by themselves, establish whether its recommendations are sound or have been adopted.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z general partner, in the plan
Costs, Powers and Safe Harbor Remain Open
The proposal does not name a budget, cost estimate or funding source for AI tools, upgrades, drills or assistance to smaller operators. Nor does it explain how the six-month target would be applied to systems that cannot be readily replaced, or how targets would account for differences among sectors and organizations.
It is also unclear what legal or regulatory authority the proposed White House force and CEO council would have, how missed targets would be handled, and whether companies would face penalties. The document calls for a possible safe harbor but does not specify its protections. Details of the council, scorecards, verification process and any eventual list of covered operators remain unsettled. No government adoption of the plan is confirmed in the source material.
The plan’s claims about AI’s defensive capabilities also require practical evaluation. It gives examples of potential uses but provides no reported results, performance measures or independent evidence that AI can find and help contain these vulnerabilities within the proposed timelines. The pace and reliability of deployment remain uncertain.
Whether the White House Takes It Up
The next milestone is whether the White House’s Super Intelligence Force or relevant agencies respond to the proposal, adopt parts of it, or develop a separate framework. Until then, the targets, CEO council, monthly scorecards and legal protections remain a16z recommendations, not obligations for infrastructure operators.
Any move toward implementation would require decisions on covered organizations, agency authority, funding, measurement and verification, and how the proposed safe harbor would interact with existing law and regulation. The source material does not give a timetable for those decisions or report a formal government response.
Key Questions
What did a16z propose?
a16z proposed a White House-led cyber defense effort focused on key operators in five sectors: power, banking and payments, water, communications and hospitals. It calls for AI-assisted defensive tools, measurable sector targets and monthly reporting.
Is the plan US government policy?
No. It was published by a16z on November 12, 2026, as a proposal. The source material does not confirm that the White House or federal agencies have adopted it.
What targets does the proposal set?
It calls for zero internet-exposed control systems, successful 72-hour manual-operation drills, and critical vulnerabilities patched or contained within a defined period. The plan says top targets should be contained within six months.
What are the main gaps in the plan?
The document does not specify costs or funding, define the government’s authority to enforce the targets, or detail how its suggested safe harbor would work. It also leaves the covered organization list and verification process open.
Who would coordinate the work under the proposal?
The White House’s Super Intelligence Force would set targets and lead reviews; a CEO council would answer for sector results; and existing ISACs would coordinate tools, fixes and monthly metrics, alongside relevant federal agencies.
Source: ThorstenMeyerAI.com
