🔍 Read the full analysis: From CEO Pledges To 72-Hour Drills: A16z’s AI Security Plan on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Andreessen Horowitz published a proposal on November 12, 2026, for coordinating cyber defense across power, banking, water, communications and hospitals. It calls for CEO-signed security targets, 72-hour manual-operation drills and monthly reporting, but it is not government policy and does not specify costs.
Andreessen Horowitz (a16z) published a proposal on November 12, 2026, calling for federal officials and company leaders to set measurable cyber defense targets for five critical infrastructure sectors: power, banking and payments, water, communications and hospitals. The plan, written by a16z General Partner and Head of Global Affairs Anne Neuberger, would include CEO-signed commitments, 72-hour manual-operation drills and monthly scorecards. It is a proposal, not an adopted government policy.
The plan focuses on what it describes as a few hundred operators and shared vendors whose failure could cause wider disruption. Its examples include large transmission substations, payment systems such as Fedwire and ACH, major-city water utilities, core telecommunications and 911 systems, regional trauma centers and health-record vendors. A16z argues that concentrating on these organizations is more practical than trying to protect every system equally.
Under the proposed structure, the White House’s Super Intelligence Force would set national targets, chair monthly reviews and address policy or funding barriers. A CEO council would include two or three company leaders from each sector; cloud and AI-lab executives would participate as non-voting members. Existing Information Sharing and Analysis Centers, or ISACs, would coordinate shared tools and fixes, organize mutual aid and report anonymized sector-wide metrics each month.
Each sector’s CEOs would sign targets covering zero internet-exposed control systems, successful 72-hour drills in manual operations, and containment of critical vulnerabilities through patching or compensating controls within a set period. The plan says top targets should be contained within six months. A sector falling behind would face a CEO-level review. For public companies, boards would attest to progress metrics, which regulators could accept instead of duplicate audits. The proposal also calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and consideration of a safe harbor for companies that meet outcome-based targets.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Measurable Targets for Essential Services
The plan would shift some cyber oversight from general information-sharing toward specific operational tests and recurring accountability. A 72-hour drill, for example, is intended to show whether an operator can keep services running manually if digital systems are unavailable. Monthly sector reporting could also give federal officials a clearer view of whether critical weaknesses are being addressed.
The approach matters because outages in infrastructure can affect more than the organization directly targeted. Disruption to electricity, payments, water, communications or hospitals may spread to other services and communities. A16z’s proposal seeks to prioritize operators and vendors it believes could create that kind of cascading impact, while using AI tools to help identify exposed systems and develop fixes.
Those benefits are prospective, not established results. The plan does not show that its targets have been tested across the sectors or that the proposed governance structure would reduce attacks. Its success would depend on participation, reliable metrics, funding and the ability of operators to address vulnerabilities in systems that may be difficult to replace or patch.
Products Worth Considering
DJI Osmo Mobile 8 Phone Gimbal with Mic Mini Transmitter, Infinity Black
Bose QuietComfort Ultra Headphones (2nd Gen), Wireless Noise-Cancelling Over-Ear Headphones with Spatial Audio, Driftwood Sand
Apple Watch Series 11 GPS + Cellular, 46mm Jet Black Aluminum Case with Black Sport Band (M/L)
As an affiliate, we earn on qualifying purchases.
A White House Task Force in View
Neuberger’s proposal is addressed to the White House’s Super Intelligence Force. The source material says President Donald Trump announced the task force on October 4, 2026, and named National Intelligence Director Jay Clayton to lead it. It describes the group’s remit as coordinating federal engagement with critical infrastructure providers and AI companies. The source does not say the task force has endorsed a16z’s plan.
Neuberger previously worked on infrastructure security in the U.S. government, including at the NSA and as deputy national security adviser for cyber and emerging technology, according to her account in the proposal. A16z says she also outlined the plan in a Wall Street Journal opinion piece. The plan’s governance table is labeled “for illustrative purposes only,” a qualification that underscores its proposed status.
A16z is a venture firm that invests in frontier AI labs and security companies. That makes its policy recommendations relevant to technology companies that could participate in the proposed effort, while also giving readers reason to distinguish the firm’s advocacy from government decisions or independent evaluations.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z General Partner and Head of Global Affairs
Adoption, Costs and Safeguards
No government decision to adopt the proposal is identified in the source material. It is also unclear whether the Super Intelligence Force, sector regulators, companies or ISACs will take up any of its recommendations, or when a decision might come.
The plan names no overall cost or funding mechanism. It calls for large companies to support smaller operators, including utilities, rural hospitals, community banks and rural carriers, but does not specify how much support would be required or how participation would be secured. The proposed safe harbor is also unresolved: the source gives no details on its scope, eligibility rules or relationship to existing legal responsibilities.
Further details about the proposed targets remain open, including how sectors would define and verify a “zero” count of internet-exposed control systems, what qualifies as passing a manual-operation drill, and how quickly each category of critical vulnerability must be contained. A16z argues that AI can help find exposed systems and generate fixes, including workarounds for equipment that cannot be patched; the source does not provide evidence of measured results from this proposed program.
Whether Officials Take Up the Plan
The next step would be for the White House and relevant agencies to decide whether to consider the framework and how it would fit with existing sector responsibilities. The proposal names the Department of Energy for power, Treasury for banking, the EPA for water, the FCC for communications and the Department of Health and Human Services for hospitals, but it does not announce agency commitments or a schedule.
Any move toward implementation would need to settle the targets, reporting standards, funding, legal protections and oversight arrangements. The source material provides no date for a government response, a CEO council meeting or the start of sector drills. Until those decisions are made, the 72-hour exercises and monthly scorecards remain recommendations rather than confirmed requirements.
Key Questions
What did a16z propose?
A16z proposed a federal-industry framework to set cyber defense targets for power, banking and payments, water, communications and hospitals, with CEO commitments and monthly sector reporting.
Are 72-hour manual-operation drills now required?
No. The drills are part of a16z’s proposal. The source material does not report that the government or infrastructure operators have adopted them as a requirement.
Who would oversee the proposed plan?
The proposal assigns target-setting and monthly reviews to the White House’s Super Intelligence Force, with a CEO council accountable for sector results and existing ISACs coordinating operational work and reporting.
What legal changes does the plan seek?
It calls for long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and consideration of a safe harbor for participating companies that meet outcome-based targets. The proposal does not specify the safe harbor’s legal terms.
What remains unknown?
Government adoption, implementation timing, program costs, funding and the precise way targets would be measured are not established in the source material.
Source: ThorstenMeyerAI.com
