🔍 Read the full analysis: How A16z Is Linking AI, CEO Pledges, And Infrastructure Readiness on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Andreessen Horowitz published a proposal on November 12 for protecting critical infrastructure as AI accelerates cyber risks. It calls for measurable security targets signed by CEOs across five sectors, with White House oversight and monthly reporting through industry information-sharing centers. The proposal is not government policy, and it does not specify costs.
Venture firm Andreessen Horowitz (a16z) published a proposal on November 12 calling for CEOs in five critical-infrastructure sectors to sign measurable cybersecurity targets, with the White House setting priorities and industry groups reporting progress monthly. Written by a16z General Partner and Head of Global Affairs Anne Neuberger, the plan is framed as a response to artificial intelligence speeding up both the discovery and exploitation of cyber weaknesses. It is a proposal, not adopted policy.
The plan focuses on power, banking and payments, water, communications, and hospitals. Rather than trying to secure every organization equally, it says the highest national risks are concentrated among a few hundred operators and shared vendors whose disruption could cascade across the country. Examples named in the proposal include major transmission substations, payment systems, large-city water utilities, core telecommunications and 911 systems, trauma centers, and health-record vendors.
For each sector, participating CEOs would sign three kinds of targets: no internet-exposed control systems, successful drills showing systems can be operated manually for 72 hours, and critical vulnerabilities patched or contained with a compensating control within a set time. The proposal says top targets should be contained within six months. It does not provide a complete timetable for every target.
Under the proposed governance structure, the White House’s Super Intelligence Force would set national targets, chair monthly CEO reviews, and address policy or funding obstacles. A CEO council would oversee sector commitments, while existing Information Sharing and Analysis Centers, or ISACs, would coordinate shared tools, vendor fixes, mutual aid, and monthly anonymized scorecards. The essay’s governance table describes this structure as illustrative. It assigns lead roles to existing agencies, including the Energy Department for power and the Treasury Department for banks.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
A Shift to Measurable Sector Targets
The proposal would move infrastructure cybersecurity from a focus on sharing threat alerts toward defined outcomes and executive accountability. Monthly scorecards and reviews could give government and companies a recurring way to identify sectors falling behind, rather than relying solely on organizations to report incidents or adopt voluntary guidance.
That approach matters because infrastructure is interdependent: a cyber failure at a shared provider or major operator could affect many organizations and customers. The proposal also recognizes that smaller entities may lack the capacity to act alone. It suggests that larger companies support smaller ones, including utilities assisting municipal providers and major health systems helping rural hospitals.
Those measures remain recommendations, not evidence that risks have been reduced. The plan does not identify its cost or establish that the targets are technically or financially feasible across every operator. Its potential effect depends on whether government agencies and companies adopt the framework, how compliance is measured, and what resources are made available.
Products Worth Considering
FLEXISPOT 36-Inch Height-Adjustable Standing Desk Converter with Keyboard Tray, Black
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
Apple Mac mini Desktop Computer with M6 Chip (2026)
As an affiliate, we earn on qualifying purchases.
From AI Risk to Infrastructure Defense
The plan’s starting point is that AI may shorten the time between discovering a software weakness and exploiting it. It argues that defenders could use the same technology to find exposed systems, rank vulnerabilities by risk, and generate fixes. For older equipment that cannot be patched, it points to possible workarounds such as firewall rules or configuration changes. The document leaves open whether defensive measures can be applied quickly enough.
Neuberger writes that she worked on infrastructure security in the U.S. government, including at the National Security Agency and as deputy national security adviser for cyber and emerging technology. The proposal is directed toward the White House’s Super Intelligence Force. According to the source material, President Donald Trump announced the task force on October 4, 2026, and named National Intelligence Director Jay Clayton to lead it.
The plan also asks Congress to reauthorize the Cybersecurity Information Sharing Act of 2015 for the long term and proposes considering a safe harbor for companies that meet outcome-based targets. That would connect the proposed security commitments to legal protections, but the document does not set out the details of such a safe harbor.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z General Partner and Head of Global Affairs
The document does not say how much the plan would cost, which companies would be required or invited to participate, or how the proposed targets would be independently verified. It also does not establish whether the White House task force, sector councils, or ISACs have accepted the proposed roles. The governance table is labeled illustrative, and the proposal itself does not make those arrangements official.
It is also unclear what legal protections a safe harbor would provide, what conditions companies would have to meet to qualify, or how Congress might handle the requested reauthorization of the 2015 information-sharing law. a16z invests in frontier AI labs and cybersecurity companies, and its plan includes a role for AI-lab and cloud-company CEOs as non-voting council members. That connection is relevant when evaluating the proposal, but does not establish that any particular company would participate or benefit.
Whether Washington Takes Up the Plan
The next step would be action by the White House, Congress, or participating infrastructure sectors. The proposal calls for the Super Intelligence Force to set targets and convene monthly reviews, but the source material reports no government decision to adopt those recommendations. Any movement toward implementation would need to clarify participation, costs, reporting rules, target deadlines, legal protections, and how the proposed six-month priority window would work.
Until those details are provided, the plan is best understood as a framework advanced by a16z, not a federal cybersecurity program. The key developments to watch are whether the task force responds, whether Congress considers the requested law reauthorization, and whether sector organizations begin formalizing targets or scorecards.
Key Questions
What did a16z propose?
a16z proposed a White House-coordinated plan that would set cybersecurity targets for operators in five critical sectors and hold sector CEOs publicly accountable for progress.
Which sectors would the plan cover?
The proposal covers power, banking and payments, water, communications, and hospitals, with priority given to operators and shared vendors whose disruption could have wider effects.
Is the plan U.S. government policy?
No. It is an a16z proposal. The source material does not report that the White House or Congress has adopted it.
What cybersecurity targets does it suggest?
It proposes no internet-exposed control systems, successful 72-hour manual-operation drills, and critical vulnerabilities patched or otherwise contained within a set period. It says top targets should be contained within six months.
What remains uncertain?
The proposal does not specify its cost, participation requirements, verification process, or safe-harbor terms. It is also unclear whether the proposed White House and industry bodies will take on the roles described.
Source: ThorstenMeyerAI.com
