TL;DR
Andreessen Horowitz published a proposal on November 12 for defending critical US infrastructure against cyber risks it says AI could accelerate. It calls for measurable security targets across five sectors, CEO accountability and federal coordination, but does not specify costs and has not been adopted as policy.
Andreessen Horowitz (a16z) published a proposal on November 12 for protecting critical US infrastructure from cyber threats that it says artificial intelligence could accelerate. Written by Anne Neuberger, a general partner and the firm’s head of global affairs, the plan calls for national security targets across power, banking and payments, water, communications and hospitals, with CEOs held publicly accountable for progress. It is a proposal, not adopted policy.
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
The plan argues that the government and industry should focus on a few hundred operators and shared vendors whose failure could cause wider disruption, rather than trying to protect every organization equally. Its examples include large transmission substations, payment systems, major-city water utilities, core telecommunications and 911 systems, regional trauma centers and health-record vendors. These are examples identified by a16z; the proposal does not provide a published list of all priority organizations.
For each sector, CEOs would sign up to three targets: zero internet-exposed control systems, passing 72-hour manual-operation drills, and containing critical vulnerabilities within a set time. The plan says the highest-priority targets should be contained within six months. It also proposes a joint cross-sector exercise within three to six months, modeled on GridEx, and says replacing unsupported equipment could take two to five years.
Under the proposed governance structure, the White House’s Super Intelligence Force would set targets. A council of two or three CEOs per sector would answer for results, while sector information-sharing and analysis centers, or ISACs, would carry out work and send anonymized monthly metrics to the federal body. A sector falling behind would face a CEO-level review. The council would meet with the president every six months, according to a16z’s plan.
Targets for Five Essential Sectors
The proposal would make operational resilience a central measure of cyber readiness. A 72-hour manual-operation test, for example, asks whether essential services can continue when IT systems are unavailable. That focus matters because disruption to power, payments, water, communications or hospitals can affect people and businesses beyond the organization directly hit.
a16z argues that AI could help defenders identify exposed systems, rank risks and generate fixes more quickly, while also allowing attackers to find and exploit weaknesses faster. Those are the firm’s assessments, not findings established by the proposal itself. Its central practical question is whether defensive tools can be used quickly enough, particularly across older equipment and organizations with limited resources.
The plan also links participation to legal protections. It calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and raises the possibility of a safe harbor for companies that meet outcomes-based targets. Such provisions could affect how firms share threat information and manage legal exposure, but the document does not set out final legislative language or guarantee that Congress would adopt them.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
Bose SoundLink Max Portable Bluetooth Speaker, IP67 Waterproof, Black
EcoFlow DELTA 3 Max Portable Power Station, 2048Wh LFP Battery
As an affiliate, we earn on qualifying purchases.
From Federal Service to a16z
Neuberger’s proposal is directed to the White House’s Super Intelligence Force. According to the source material, President Donald Trump announced the task force on October 4, 2026, and named National Intelligence Director Jay Clayton to lead it. The proposal cites the force’s planned coordination with critical infrastructure providers and AI companies as a possible federal point of accountability.
Neuberger previously worked on infrastructure security in government, including at the NSA and as deputy national security adviser for cyber and emerging technology, according to her account in the plan. She now works at a16z, a venture firm that invests in frontier AI labs and security companies. That connection is relevant to readers evaluating the proposal’s perspective: it gives the firm’s portfolio area a role in the response, while the document does not detail how potential conflicts of interest would be managed.
The plan appeared as a16z published its own document on November 12. The firm says Neuberger also outlined it in an opinion piece for The Wall Street Journal. Its governance diagram is labeled illustrative, and the described chain of command is a proposed design rather than an operating program.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z general partner and head of global affairs, in the proposal
The proposal does not state how much the plan would cost, how participating companies would pay for upgrades, or how targets would be tailored to organizations with different systems and resources. It also does not establish whether the White House task force has accepted the framework, whether the proposed CEO council would be created, or whether infrastructure operators would agree to participate.
Other unresolved points include how the government would verify reported metrics, what consequences would follow if a sector missed its targets, and what legal protections a safe harbor would provide. The proposal gives deadlines for some work but does not identify a funding source or explain how regulators and existing federal agencies would fit into the proposed chain of command.
a16z says AI can help defenders find exposed systems and generate fixes, including workarounds for equipment that cannot be patched. The document does not provide independent evaluations, cost estimates or performance results demonstrating that these approaches will work across the named sectors. Its claims about AI-driven threats and defenses should be read as the firm’s case for its proposal.
Whether Washington Takes It Up
The next concrete step would be a decision by the White House on whether to review or adopt any part of the framework. If officials proceed, they would need to define the priority organizations, set sector targets and determine how the proposed force, CEOs and ISACs would share responsibility. The document’s suggested cross-sector exercise within three to six months is a proposed milestone, not a scheduled event.
Congress would also have to consider the requested reauthorization of the 2015 information-sharing law and any safe-harbor legislation. Until federal officials or lawmakers take action, the six-month containment target and other deadlines remain recommendations from a16z rather than requirements for infrastructure operators.
Key Questions
What did a16z propose?
a16z proposed a federal and industry cyber defense framework focused on critical operators and shared vendors in five sectors: power, banking and payments, water, communications and hospitals.
Is the plan US government policy?
No. The document describes a proposal published by a16z on November 12, 2026. The source material does not say that the White House or Congress adopted it.
What targets would companies have to meet?
CEOs would sign targets for eliminating internet-exposed control systems, passing 72-hour manual-operation drills and containing critical vulnerabilities within a set time. The proposal says top-priority targets should be contained within six months.
Who would oversee the proposed work?
The White House’s Super Intelligence Force would set targets, a CEO council would answer for sector results, and ISACs would coordinate work and report anonymized monthly metrics, according to the proposal.
What remains unknown about the plan?
The proposal gives no cost estimate and does not establish company participation, government adoption, reporting enforcement or the terms of a potential legal safe harbor.
Source: Thorsten Meyer AI
