🔍 Read the full analysis: A16z’s Plan Connects CEO Pledges With Infrastructure Drills on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Andreessen Horowitz published a proposal on Nov. 12 for a White House-led effort to secure critical infrastructure in five sectors. It calls for signed CEO targets, monthly performance reporting and a possible legal safe harbor, but it is not government policy and gives no cost estimate.
Venture firm Andreessen Horowitz (a16z) published a proposal on Nov. 12 for a White House-coordinated cybersecurity program that would ask CEOs in five critical infrastructure sectors to sign measurable security targets. The plan, written by a16z General Partner and Head of Global Affairs Anne Neuberger, is intended to focus government and industry attention on operators whose failure could disrupt services nationwide; it remains a proposal, not adopted policy.
The plan covers power, banking and payments, water, communications and hospitals. Rather than require every organization to meet the same requirements, it would prioritize what a16z describes as a few hundred operators and shared vendors whose failures could have cascading effects. Examples named in the proposal include large transmission substations, payment networks, major-city water utilities, core telecom and 911 systems, regional trauma centers and health-record vendors.
For each sector, participating CEOs would sign targets addressing internet-exposed control systems, the ability to operate manually for 72 hours during drills, and the containment of critical vulnerabilities through a patch or compensating control within a set period. The proposal says the highest-priority targets should be contained within six months. Sector Information Sharing and Analysis Centers, or ISACs, would coordinate work and submit anonymized metrics monthly; a sector falling behind would face a CEO-level review with the White House task force.
The suggested governance structure gives the White House’s Super Intelligence Force responsibility for setting national targets, chairing monthly CEO reviews and addressing policy or funding barriers. A CEO council would oversee sector results, while existing lead agencies would remain involved. The plan also asks Congress to reauthorize the Cybersecurity Information Sharing Act of 2015 for the long term and considers a possible safe harbor for companies that meet outcome-based targets. Those are recommendations, not commitments by the government or lawmakers.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Accountability for Critical Operators
The proposal would shift some cybersecurity oversight from information-sharing and voluntary coordination toward named executive accountability. Signed targets, recurring scorecards and reviews could make it easier for government officials and company boards to identify whether high-impact risks are being addressed. The focus on a limited set of operators also reflects a practical constraint: a failure at a major shared vendor or network can affect organizations well beyond the company where the incident begins.
That approach could matter to people who depend on electricity, payments, clean water, communications and hospital care, even though the plan does not promise that outages or attacks would be prevented. Its call for larger companies to support smaller utilities, rural hospitals and community banks also recognizes that many smaller organizations may lack the staff and funding to meet demanding targets alone. The proposal does not specify how that assistance would be financed or distributed.
The legal protections it seeks are another consequential element. A safe harbor tied to meeting defined outcomes could give participating companies more confidence to share information or report security shortcomings. It could also raise questions about what qualifies for protection, who verifies compliance and how regulators would respond when a company meets a target on paper but remains exposed to other risks.
Products Worth Considering
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Bose QuietComfort Wireless Noise-Cancelling Headphones, White Smoke
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
As an affiliate, we earn on qualifying purchases.
From AI Threat to Sector Targets
a16z frames the proposal around the possibility that artificial intelligence is shortening the time between discovery of a vulnerability and its exploitation. The plan argues that defenders could also use AI to find exposed systems, rank risks and generate fixes or temporary workarounds for equipment that cannot be patched. Those are the proposal’s claims about potential uses; the source material does not provide performance data demonstrating how quickly or reliably such tools work in critical infrastructure.
Neuberger brings government cybersecurity experience to the proposal. She says she worked on infrastructure security at the National Security Agency and later as deputy national security adviser for cyber and emerging technology. The plan is addressed to the White House’s Super Intelligence Force, which President Donald Trump announced on Oct. 4, 2026, according to NBC News. The source account says the president named National Intelligence Director Jay Clayton to lead it and described the force as engaging with critical infrastructure providers and AI companies.
a16z’s governance table labels its structure “for illustrative purposes only.” It proposes two or three CEOs per sector, with cloud and AI-lab executives participating as non-voting members. a16z also invests in frontier AI labs and security companies, making the proposed role for those industries relevant to readers assessing the plan’s authorship and interests. That connection does not establish that the proposal is improper, but the source material does not describe a process for managing potential conflicts.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z General Partner and Head of Global Affairs, in the proposal
Costs, Safeguards and Adoption
The proposal does not give a cost estimate, funding source or implementation schedule for most of its recommendations. It also does not identify the specific operators that would fall within the proposed priority group, explain how targets would be tailored across different technologies, or state who would independently verify the monthly metrics and board attestations.
It is not clear whether the White House, Congress, regulators or industry groups will take up the plan. The proposed safe harbor is described as a possibility, and the source material does not define its legal scope or the conditions companies would have to meet. The available account also does not establish whether the AI tools discussed have been tested across the sectors named or how the proposal would address mistakes made by automated systems.
a16z’s suggestion that companies meet targets within six months applies to the top-priority targets; the material does not supply a complete timeline for the wider program. Participation, enforcement, consequences for missed goals and the relationship between the proposed scorecards and existing regulations remain unresolved.
Federal and Industry Response
The next step would be for the White House’s Super Intelligence Force and the relevant agencies to decide whether to develop, modify or reject the recommendations. If officials pursue the proposal, they would need to define covered operators, establish sector-specific targets and set out who checks reported results. Those decisions would determine whether the plan becomes a formal program or remains an industry proposal.
Congress would need to act on the requested reauthorization of the Cybersecurity Information Sharing Act of 2015, while any new safe harbor would require a defined legal framework. Industry participation would also depend on how responsibilities, costs and protections are assigned among large operators, smaller organizations and shared vendors. No timetable for those actions is given in the source material.
For now, the confirmed development is publication of a16z’s plan, not an announcement of federal adoption. Further reporting should establish whether the task force or sector groups respond, whether a funding mechanism is proposed and how any targets would be measured and enforced.
Key Questions
What did a16z propose?
a16z proposed a White House-coordinated program to set cybersecurity targets for major operators in five critical sectors: power, banking and payments, water, communications and hospitals.
What targets would CEOs sign?
The plan calls for targets covering internet-exposed control systems, successful 72-hour manual-operation drills and timely containment of critical vulnerabilities through patches or other controls.
Has the U.S. government adopted the plan?
No adoption is established in the source material. The plan is an a16z proposal; the White House and Congress have not been reported as accepting its recommendations.
Who would oversee progress?
The proposed structure gives the White House’s Super Intelligence Force a coordinating role, with a CEO council responsible for sector results and ISACs reporting anonymized metrics monthly.
What remains undecided?
The proposal does not set out a full cost or funding plan, identify all covered organizations, or explain verification and enforcement. Its proposed legal safe harbor and the program’s adoption are also unresolved.
Source: ThorstenMeyerAI.com
