🔍 Read the full analysis: A16z’s US Infrastructure Defense Plan Blends Pledges With Practice on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Andreessen Horowitz published a proposal on Nov. 12 for defending U.S. critical infrastructure against cyberattacks accelerated by AI. It calls for targets across five sectors, monthly scorecards and White House coordination, but it is not government policy and does not specify costs.
The plan argues that **AI is compressing the time between finding a software weakness and exploiting it**, putting infrastructure operators that respond at human speed at risk. It also proposes using AI defensively to find exposed systems, rank vulnerabilities and help generate fixes. For equipment that cannot be patched, the document says, mitigations could include firewall rules or configuration changes. The plan does not establish how quickly those measures could be deployed.
Its central premise is to concentrate effort on **a few hundred operators and shared vendors** whose failure could have wider national effects, rather than attempt to protect every system equally. Examples listed include major electric transmission substations, payment networks, large-city water utilities, core telecommunications and 911 systems, trauma centers, and health-record vendors. These are examples in the proposal, not a published official list of designated entities.
The proposed governance structure has three levels. The White House’s **Super Intelligence Force** would set national targets, hold monthly CEO reviews and address policy or funding obstacles. A council of two or three CEOs per sector would sign targets and be publicly accountable for results; cloud and AI-lab executives could participate as non-voting members. Existing sector information-sharing and analysis centers, or ISACs, would coordinate work, share tools and submit anonymized monthly metrics. The plan’s governance table is labeled illustrative.
Each sector would sign up to three targets: **no internet-exposed control systems**, successful 72-hour manual-operation drills, and critical vulnerabilities patched or mitigated within a set period. The proposal says priority targets should be contained within six months. A sector falling behind would face a CEO-level review. For public companies, boards would attest to progress, with regulators accepting those attestations in place of duplicate audits, according to the plan.
The document also calls for larger companies to support smaller operators, including rural utilities, hospitals, carriers and community banks. It seeks long-term reauthorization of the **Cybersecurity Information Sharing Act of 2015** and proposes considering a safe harbor for participating companies that meet outcomes-based targets. It does not give a budget or spell out the legal terms of such a protection.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Targets Could Shift Cybersecurity Accountability
The proposal would move infrastructure cybersecurity from voluntary coordination toward **sector-wide targets and visible executive responsibility**. Monthly metrics and CEO reviews could give federal officials a clearer way to identify gaps, while shared tools and mutual aid could help smaller operators with fewer resources. Those are intended effects of the plan; no implementation or results have been reported.
The approach also reflects the plan’s view that AI changes both sides of the cyber contest. If attackers can identify and exploit weaknesses faster, the document argues, defenders need tools and response processes that operate at comparable speed. The focus on a limited group of operators is meant to prioritize systems whose disruption could affect services beyond one company or locality.
There are practical and governance questions alongside that potential benefit. Setting targets across sectors with different equipment and regulatory regimes could be difficult, and the proposal does not price the work. Its request for legal protection also raises questions about which companies would qualify and how accountability would work if targets were missed. a16z invests in AI labs and cybersecurity companies, while the plan would give cloud and AI-lab executives a role in its proposed council, though without votes.
Products Worth Considering
Logitech MX Master 3S Bluetooth Wireless Mouse, Graphite
LG UltraGear 24-Inch Full HD IPS Gaming Monitor, 120Hz (144Hz Overclocked), 1ms MBR, G-SYNC Compatible, FreeSync, HDR10
Apple MacBook Air 15-inch (2026) with M5 Chip, 16GB Memory, 1TB SSD, and Liquid Retina Display – Sky Blue
As an affiliate, we earn on qualifying purchases.
Neuberger’s Proposal and Federal Task Force
Neuberger says she worked on infrastructure security in government, first at the National Security Agency and later as deputy national security adviser for cyber and emerging technology. She is now a general partner at a16z. The firm says she also outlined the plan in a Wall Street Journal opinion piece.
The proposal is addressed to the White House’s **Super Intelligence Force**. President Donald Trump announced the task force on Oct. 4, 2026, and named National Intelligence Director Jay Clayton to lead it, according to NBC News. Trump said the force would coordinate federal engagement with critical infrastructure providers and super-intelligence companies. a16z’s document does not establish that the task force has accepted or acted on its recommendations.
Sector agencies would remain involved under the proposed structure: the Department of Energy for power, Treasury for banking, the Environmental Protection Agency for water, the Federal Communications Commission for communications, and the Department of Health and Human Services for hospitals. The plan would add a cross-sector White House and CEO layer rather than replace those agencies.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z general partner, in the plan
Policy Status, Costs and Safeguards
No federal adoption of the plan is confirmed in the source material. It is not clear whether the Super Intelligence Force, sector agencies or infrastructure companies have agreed to take part, or whether the proposed CEO council would be created.
The proposal gives no total cost, funding source or detailed implementation schedule beyond saying priority targets should be contained within six months. It also does not specify how operators would be selected, how compliance would be independently checked, or what would count as an acceptable compensating control. The scope and legal design of a proposed safe harbor remain open questions. The source material does not provide a government response or independent assessment of the plan’s feasibility.
Federal and Industry Response Needed
The next step would be a decision by the White House and relevant agencies on whether to develop or adopt any part of the proposal. If officials proceed, they would need to define participating operators, sector-specific targets, reporting rules, oversight and funding. Congress would be involved if long-term reauthorization of the 2015 information-sharing law or new legal protections were pursued.
For now, readers should distinguish the plan’s recommendations from current requirements: the publication does not itself impose targets or change companies’ legal duties. Further statements from the White House, agencies, industry groups or a16z would clarify whether the document moves beyond a proposal.
Key Questions
Has the U.S. government adopted a16z’s plan?
No adoption is confirmed. a16z published it as a proposal, and the source material does not report a government decision to implement it.
Which sectors would the proposal cover?
It identifies power, banking and payments, water, communications and hospitals, with attention to operators and shared vendors whose disruption could have broader effects.
What targets would companies face under the plan?
Proposed targets include eliminating internet-exposed control systems, passing 72-hour manual-operation drills, and patching or otherwise containing critical vulnerabilities within a set time. Priority targets are described as due within six months.
Would companies receive legal protection?
The plan calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and suggests considering a safe harbor for companies meeting outcomes-based targets. The scope and terms are not specified.
Does the plan include a budget or implementation schedule?
The source material says the proposal names no cost. It gives a six-month target for priority vulnerabilities but does not provide a full budget, funding plan or detailed rollout schedule.
Source: ThorstenMeyerAI.com
