TL;DR
Andreessen Horowitz published a proposal on November 12 for defending five critical infrastructure sectors against cyber threats it says AI could accelerate. It calls for CEO-backed security targets, 72-hour manual-operation drills and monthly scorecards, but it is not government policy and provides no cost estimate.
Venture firm Andreessen Horowitz (a16z) published a proposal on November 12 for a White House-led effort to strengthen cyber defenses across power, banking and payments, water, communications and hospitals. Written by a16z General Partner Anne Neuberger, the plan calls for companies to meet security targets and prove they can operate manually for 72 hours; it remains a proposal, not adopted government policy.
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The plan argues that a national defense effort should concentrate on a few hundred operators and shared vendors whose failure could affect services across the country. Its examples include large transmission substations, major payment systems, water utilities serving large cities, core telecommunications and 911 networks, trauma centers and health-record vendors. Those examples are the proposal’s assessment; the document does not provide a public list of the operators it would prioritize.
For each sector, the proposal would have company chief executives sign commitments to three targets: zero internet-exposed control systems, passing drills that demonstrate 72 hours of manual operation, and containing critical vulnerabilities within a set period. It says vulnerabilities at top-priority targets should be contained within six months. Replacing unsupported equipment could take two to five years, according to the plan.
The proposed chain of responsibility starts with a White House Super Intelligence Force setting targets. A council with two or three CEOs from each sector would answer for results, while existing industry information-sharing and analysis centers, or ISACs, would coordinate work and report anonymized monthly metrics. Falling behind would prompt a CEO-level review. The council would meet with the president every six months, according to the proposal.
Testing Essential Services Offline
The proposal focuses on whether essential services could keep operating during a severe cyber disruption, rather than treating every system as equally urgent. A successful 72-hour manual-operation drill would test whether selected organizations can keep running without their information technology systems. That could expose practical weaknesses in staffing, procedures or backup processes, although the plan does not specify a single testing standard for all five sectors.
a16z links the approach to the possibility that AI tools could speed up the discovery and exploitation of software flaws. It also argues that AI could help defenders find exposed systems, rank risks and develop fixes. Those are the plan’s claims about the technology’s potential; it does not provide measured results showing how quickly or effectively AI could secure infrastructure. Its central question is whether defensive tools can be applied fast enough.
If adopted, the proposal could give CEOs a direct role in setting and reporting on cyber resilience, backed by federal targets. It also asks the government to provide legal protections: a long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and possible safe harbor for companies that meet outcome-based targets. The scope and terms of any such protection are not laid out in the available proposal details.
Products Worth Considering
Apple iPad 11-inch (A16), 128GB, Wi-Fi, Silver
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds with Immersive Audio and Wireless Charging Case, Black
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
As an affiliate, we earn on qualifying purchases.
From Government Cyber Work to a16z
Neuberger wrote the plan after moving from public service to a16z, where she is a general partner and head of global affairs. The source says she previously worked at the National Security Agency and served as deputy national security adviser for cyber and emerging technology at the White House. Her experience informs the proposal, but her current role also places her at a venture firm with investments in AI and security companies.
The plan is addressed to the White House’s Super Intelligence Force. According to the source material, President Donald Trump announced the task force on October 4, 2026, and named National Intelligence Director Jay Clayton to lead it. Trump said it would coordinate federal engagement with critical infrastructure providers and superintelligence companies, according to NBC News as cited in the source.
a16z says Neuberger also outlined the plan in an opinion piece for The Wall Street Journal. The plan’s governance diagram is labeled illustrative, and its sequence—from CEO pledges through drills, scorecards and presidential meetings—describes a proposed program. The supplied source does not establish that agencies or companies have begun carrying out those steps.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z general partner and head of global affairs, in the plan
Costs, Targets and Legal Protections
The proposal gives no cost estimate and does not name the companies or facilities that would count as top-priority targets. It also does not spell out how the White House would set sector targets, verify drill results or resolve disagreements over performance. Those details would shape the work required of companies and the reliability of the scorecards.
It remains unclear whether the Super Intelligence Force, sector CEOs or ISACs will take up the plan, and whether Congress would reauthorize the 2015 information-sharing law. The suggested safe harbor is described as a possibility, with no terms supplied. The source material does not report commitments from companies or a government decision to launch the program.
A White House Decision Ahead
The next step would be a decision by the White House and participating companies on whether to adopt or adapt the proposal. If they do, the plan envisions a joint cross-sector exercise modeled on GridEx within three to six months, alongside sector drills and monthly reporting. Those dates are proposed milestones, not a confirmed schedule.
Readers can watch for an official response from the Super Intelligence Force, named sector participants, published standards for the drills and any legislative action on information sharing. Until then, the six-month containment goal and the CEO council remain elements of a16z’s plan rather than active federal requirements.
Key Questions
Has the U.S. government adopted the a16z plan?
No. The November 12 document is a proposal. The supplied source does not report government adoption or company participation.
Which sectors would the proposal cover?
It names power, banking and payments, water, communications and hospitals, with attention to operators and vendors whose disruption could affect services nationally.
What would the 72-hour drill test?
The proposed drill would test whether selected critical infrastructure operators can keep functioning for 72 hours without IT. The plan details provided do not set out one common testing standard.
What legal changes does a16z seek?
The plan calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and raises the possibility of safe harbor for companies that meet outcome-based targets. It does not specify the safe harbor’s terms.
When would the proposed targets take effect?
No effective date is confirmed. The plan says top-priority vulnerabilities should be contained within six months and proposes a joint exercise within three to six months if the program proceeds.
Source: Thorsten Meyer AI
