🔍 Read the full analysis: A Guide To A16z’s AI-Speed Infrastructure Defense Push on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Andreessen Horowitz published a proposal on November 12, 2026, to speed up cyber defenses for operators and vendors in five U.S. infrastructure sectors. It calls for signed security targets, monthly scorecards and a White House-led oversight structure; it is not government policy, and its cost and implementation details are not specified.
Andreessen Horowitz (a16z) published a critical-infrastructure cyber defense proposal on November 12, calling for faster, coordinated protection of operators in power, banking and payments, water, communications and hospitals. The plan, written by a16z General Partner and Head of Global Affairs Anne Neuberger, would set measurable security targets and put a White House task force, company leaders and existing industry information-sharing centers in a shared oversight structure. It is a proposal, not an adopted government policy.
The plan argues that artificial intelligence could shorten the time between discovery of a software weakness and its exploitation, giving defenders less time to respond. It proposes using AI to identify exposed systems, rank risks and generate fixes. For older equipment that cannot be patched, the plan says AI could help produce compensating measures, such as firewall rules or settings changes. Whether those defenses can be deployed quickly enough remains an open question in the document.
Rather than seek to protect every organization equally, a16z would focus on what it describes as a few hundred operators and shared vendors whose failure could have wider effects. Examples in the proposal include large electricity substations, payment networks, major-city water utilities, core telecommunications and 911 systems, regional trauma centers and health-record vendors.
Under the proposed structure, the White House’s Super Intelligence Force would set national targets, chair monthly reviews with company leaders and address policy or funding barriers. A CEO council would include two or three CEOs from each sector, while cloud and AI-lab executives would participate as non-voting members. Sector information-sharing and analysis centers, or ISACs, would coordinate tools and fixes and report anonymized metrics each month. The plan also lists federal agencies that would remain involved, including the Energy Department for power, Treasury for banking, EPA for water, the FCC for communications and HHS for hospitals.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Targets for Five Critical Sectors
The proposal would shift some cybersecurity coordination from sharing alerts toward measurable sector-wide results. Each sector’s CEOs would sign three targets: no internet-exposed control systems, successful 72-hour manual-operation drills, and critical vulnerabilities contained within a specified period, either through patching or another control. The plan says top targets should be contained within six months.
Monthly scorecards would give the White House and sector leaders a recurring view of progress. A sector falling behind would face a CEO-level review. For public companies, the proposal says boards would attest to progress metrics and regulators would accept those attestations instead of duplicate audits. These are proposed arrangements, not rules currently in force.
The focus on shared vendors and smaller operators also matters. The plan suggests that large utilities, health systems, banks and telecommunications carriers help fund or support smaller organizations in their sectors. If adopted, that approach could extend defensive capacity beyond major companies. But the proposal does not provide a budget, identify funding sources or spell out how participation and accountability would work in practice.
Products Worth Considering
Apple MacBook Air 13-inch with M5 Chip, 16GB Memory, 512GB SSD, Silver
Amazon Kindle Paperwhite (12th Generation, 2024), 16GB, 7-Inch Display, Raspberry
LG UltraGear 34-inch Curved OLED Gaming Monitor, WQHD 1440p, 240Hz, 0.03ms, 800R
As an affiliate, we earn on qualifying purchases.
From Government Service to a16z
Neuberger’s plan is addressed to the White House’s Super Intelligence Force. The source report says President Donald Trump announced the task force on October 4, 2026, and named National Intelligence Director Jay Clayton to lead it. The administration’s stated remit includes engagement with critical-infrastructure providers and companies working on advanced AI.
Neuberger previously worked on infrastructure security in the U.S. government, including at the NSA and as deputy national security adviser for cyber and emerging technology, according to her account in the proposal. a16z says she also outlined the plan in a Wall Street Journal opinion piece. The firm is a venture investor in AI and security companies, a relevant connection because the plan gives cloud and AI-lab executives a role in its proposed governance structure, though without a vote on the CEO council.
The proposal also asks for a long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and suggests a possible safe harbor for companies that meet outcomes-based targets. Those requests would require government action; the document does not establish that either will be granted.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z general partner and plan author
The document does not state how much the plan would cost, who would pay for shared tools and assistance, or how its proposed targets would be enforced. It also does not establish that the White House task force, a CEO council or participating companies have accepted the proposed roles. The governance table is described as illustrative.
It remains unclear what measures would count as passing a manual-operation drill, how quickly vulnerabilities must be contained in each sector, and how performance data would be verified. The plan’s suggested legal safe harbor and long-term reauthorization of the 2015 information-sharing law are requests, not enacted protections. a16z’s investments in AI and security businesses are relevant when evaluating the proposal’s institutional design, but the source material does not establish that those companies would receive contracts or preferential treatment.
Policy Decisions and Sector Targets
The next steps would depend on whether the White House and infrastructure-sector leaders choose to act on the proposal. The plan calls for the Super Intelligence Force to set national targets, the CEO council to sign sector commitments and ISACs to begin monthly reporting. No adoption timetable or official response is given in the source material.
Readers should watch for government statements on the task force’s role, any proposed legislation or renewal of the 2015 information-sharing law, and details on funding, safe-harbor protections and target verification. Until those decisions are made, the plan remains a private-sector proposal for organizing infrastructure defense, not a federal mandate.
Key Questions
What did a16z propose?
a16z proposed a White House-led cyber defense effort focused on operators and shared vendors in five sectors: power, banking and payments, water, communications and hospitals. It calls for signed security targets and monthly progress reporting.
Is the plan government policy?
No. It was published by a16z on November 12, 2026, and the available source describes it as a proposal. It does not report that the government or participating companies have adopted it.
What security targets does the plan suggest?
It proposes zero internet-exposed control systems, passing 72-hour manual-operation drills, and containing critical vulnerabilities within a set time through patches or compensating controls. It says top targets should be contained within six months.
Who would oversee the proposed effort?
The White House’s Super Intelligence Force would set targets and review progress; a CEO council would answer for sector results; and existing ISACs would coordinate work and report anonymized monthly metrics.
What remains unknown?
The proposal gives no cost or funding plan and does not explain how targets would be enforced or independently verified. It also remains unclear whether the White House or industry leaders will adopt the plan.
Source: ThorstenMeyerAI.com
