🔍 Read the full analysis: How CEO Pledges Fit Into A16z’s US Infrastructure Defense Plan on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Andreessen Horowitz published a proposal on November 12 for a White House-led cyber defense effort focused on operators and vendors whose failure could disrupt essential services. It calls for signed sector targets, monthly scorecards and possible legal protections, but it is not government policy and gives no cost estimate.
Venture firm Andreessen Horowitz (a16z) published a proposal on November 12 for a White House-coordinated cyber defense effort that would hold CEOs in five critical infrastructure sectors to signed security targets. The plan, written by a16z General Partner and Head of Global Affairs Anne Neuberger, is a proposal rather than adopted U.S. policy; it calls for protecting a limited set of operators and shared vendors whose disruption could affect services nationwide.
The proposal focuses on power, banking and payments, water, communications and hospitals. Rather than trying to secure every organization equally, it says national efforts should concentrate on a few hundred operators and vendors whose failure could cascade across the country. Examples listed include major transmission substations, payment networks, large-city water utilities, core telecommunications systems and health-record vendors.
For each sector, participating CEOs would sign three targets: zero internet-exposed control systems, passing manual-operation drills that last 72 hours, and containing critical vulnerabilities—by patching them or using a compensating control—within a defined time. The plan says top targets should be contained within six months. Industry Information Sharing and Analysis Centers, or ISACs, would coordinate work and report anonymized sector-wide metrics to the White House monthly. A sector falling behind would trigger a CEO-level review.
The proposed governance structure gives the White House’s Super Intelligence Force responsibility for setting national targets, chairing monthly CEO reviews and clearing policy or funding obstacles. A council of two or three CEOs per sector would answer for results; cloud and AI-lab CEOs would participate as non-voting members. Existing lead agencies would remain involved, with the Department of Energy, Treasury, EPA, FCC and HHS assigned roles for the five sectors, respectively, according to a governance table in the proposal that a16z labels illustrative.
The proposal also asks for policy and legal support. It calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and suggests a possible safe harbor for companies that meet outcomes-based targets. It proposes that public-company boards attest to progress metrics, with regulators accepting those attestations instead of duplicate audits. The document gives no cost estimate or detailed funding mechanism.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Accountability Across Critical Sectors
The plan’s central change would be to make infrastructure cybersecurity a CEO-level responsibility, rather than leaving coordination largely to security teams and voluntary information-sharing. Shared targets and recurring scorecards could give federal officials a common way to track whether operators are reducing exposure and preparing to keep services running during a cyber incident.
That focus matters because power, payments, communications, water and hospital services depend on interconnected organizations, including vendors. A disruption at one operator or supplier can have consequences beyond that company. The proposal’s approach would pair national coordination with sector-specific execution through ISACs and would ask larger organizations to support smaller ones, such as rural hospitals, community banks and municipal utilities.
These are proposed mechanisms, not demonstrated outcomes. Their effect would depend on the targets’ definitions, the reliability of reporting, available resources and whether companies participate. The suggested safe harbor could also shape incentives, but the document does not set out its legal terms or establish that Congress or regulators would adopt it.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds with Immersive Audio and Wireless Charging Case, Black
Samsung 32-Inch Odyssey G5 QHD 180Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From AI Risk to Infrastructure Targets
The proposal argues that AI could speed up both vulnerability discovery and exploitation, leaving defenders less time to respond. It also says AI tools could help defenders find exposed systems, prioritize risks and produce fixes. For older equipment that cannot be patched, the document suggests workarounds such as firewall rules or configuration changes. These are a16z’s assessments; the source does not provide independent measurements of how quickly AI is changing attack timelines or how well the proposed tools work in these settings.
Neuberger writes that she worked on infrastructure security inside the U.S. government, including at the NSA and as deputy national security adviser for cyber and emerging technology, before joining a16z. The firm says she also outlined the plan in a Wall Street Journal opinion piece. The proposal is directed to the White House’s Super Intelligence Force. President Donald Trump announced that task force on October 4, 2026, and named National Intelligence Director Jay Clayton to lead it, according to NBC News.
a16z has investments in frontier AI labs and cybersecurity companies, some of the kinds of firms the proposal would include in the process. That does not establish a conflict or determine the plan’s merits, but it is relevant context when evaluating its recommendations and proposed role for AI and technology companies.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z General Partner and Head of Global Affairs, in the proposal
Policy, Costs and Participation Unsettled
The plan does not show that the White House or the named agencies have approved its structure, targets or reporting system. It also does not specify the cost of compliance, how proposed federal or company funding would be divided, or how the six-month target would apply across different technologies and risks. The source describes some proposed governance details as illustrative, not final.
Other open questions include which companies would qualify as essential operators, how progress would be independently verified, what happens when a company misses a target, and what legal protections a safe harbor would provide. The proposal’s claim that risk is concentrated is not accompanied in the supplied material by a complete list of the operators and vendors or a method for selecting them. It is also unclear whether lawmakers would reauthorize the 2015 information-sharing law or whether regulators would accept board attestations in place of audits.
White House Response and Target Design
The next step would be a decision by the White House and the Super Intelligence Force on whether to take up the proposal, revise it or pursue a different framework. If officials proceed, they would need to define participating companies, establish sector targets and reporting rules, assign responsibilities to agencies and ISACs, and decide how the work would be financed.
Congressional action would be needed for the proposed long-term reauthorization of the Cybersecurity Information Sharing Act, while any safe harbor or change to audit requirements would require legal and regulatory decisions. The source material does not give a government response, a schedule for those decisions or a launch date for the proposed CEO council. Until those details emerge, the plan remains an industry proposal rather than an operating federal program.
Key Questions
Has the U.S. government adopted a16z’s cyber defense plan?
No. The November 12 document is an a16z proposal. The supplied source material does not report that the White House or Congress adopted it.
Which infrastructure sectors would the proposal cover?
It names power, banking and payments, water, communications and hospitals, with attention to operators and vendors whose disruption could have wider effects.
What would CEOs be asked to commit to?
They would sign targets covering internet-exposed control systems, 72-hour manual-operation drills and timely containment of critical vulnerabilities. The proposal says top targets should be contained within six months.
Would companies receive legal protection?
The proposal requests long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and suggests a possible safe harbor for companies meeting outcomes-based targets. It does not define the safe harbor or say that it has been approved.
How much would the plan cost?
The source material provides no cost estimate and does not set out a detailed funding plan.
Source: ThorstenMeyerAI.com
