By Thorsten Meyer | November 13, 2026 | ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Key takeaways
- What it is: On November 12, 2026, the venture firm Andreessen Horowitz (a16z) published a “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan” by Anne Neuberger, its General Partner and Head of Global Affairs. She outlined the same plan in a Wall Street Journal opinion piece, according to a16z.
- The core idea: Do not try to protect everything. Protect “the few hundred operators and shared vendors whose failure would cascade nationally” in five sectors: power, banking and payments, water, communications and hospitals.
- The hard targets: CEOs would sign three targets for their sector: “zero internet-exposed control systems, 72-hour manual-operation drills passed, critical vulnerabilities contained” within a set time. The top targets “should be contained within 6 months”.
- Who acts: The White House’s Super Intelligence Force sets targets, a CEO council answers for results, and the existing industry information-sharing centers (ISACs) do the work and report monthly scorecards.
- What it asks in return: Legal cover. The plan wants a long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and “a potential safe harbor for participating companies who meet outcomes-based targets”.
- What to keep in mind: It is a proposal, not policy. It names no cost. And a16z invests in frontier AI labs and security companies, the kind of firms the plan gives a seat at the table.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Products Worth Considering
Apple Watch SE 3 GPS 44mm Smartwatch
Kindle Paperwhite Signature Edition 32GB E-Reader, 7-Inch Display, Seaglass Green
LG UltraGear 32-Inch QHD 180Hz Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The race the plan is about
Picture a water plant in a mid-sized city. Somewhere in the software of a pump controller there is a flaw that nobody has found yet. In the past, finding it took a skilled human weeks. Now an AI model can find flaws like it in hours, and so can the attacker’s.
That is the starting point of the a16z plan. Its first sentence of substance: “AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
The plan does not stop at the threat. It argues that the same AI can work for defenders, “finding exposed systems, ranking which matter most and generating fixes”. For old equipment that cannot be patched, AI could produce a workaround, “such as a firewall rule or a settings change”. The open question, in a16z’s own words: “whether it can be applied fast enough.”
And it makes one claim that sounds almost optimistic: “The most significant national risk is concentrated, fortunately.” Failures that would cascade across the country, the plan says, run through a few hundred operators and their shared vendors: “large transmission substations, the Fedwire and ACH payment systems, water utilities serving big cities, core telecom networks and 911 systems, regional trauma centers and the health-record vendors.”
Who wrote it, and who it is for
Anne Neuberger is not a typical venture blogger. In her own words, she spent “the last several years” working on infrastructure security “from inside the U.S. government, first at the NSA and then as Deputy National Security Advisor for Cyber and Emerging Technology in the White House.” She now works at a16z.
The plan is addressed to the White House, more precisely to the “Super Intelligence Force”. President Donald Trump announced that task force on October 4, 2026, and named National Intelligence Director Jay Clayton to lead it, according to NBC News. In Trump’s words, it will coordinate the federal government’s engagement with, among others, “Critical Infrastructure Providers, and Super Intelligence Companies”. a16z writes that the plan would be “accountable to the White House’s Super Intelligence Force, and led by CEOs of key American companies responsible for critical infrastructure”.
What the plan proposes, piece by piece
1. A chain of command from the White House to the plant floor
The plan says the U.S. “lacks a governance model to drive a purposeful, rapid effort to secure the most critical infrastructure.” Its answer has three layers.
- The White House’s SI Force “sets national targets”, chairs a monthly CEO review and clears policy and funding blockers.
- A CEO council, with “2–3 CEOs per sector, cloud and AI-lab CEOs as non-voting members”, signs the sector targets, is “publicly accountable for results” and “meets the President every six months”, according to a governance table in the essay that a16z labels “For illustrative purposes only”.
- The ISACs, the Information Sharing and Analysis Centers that each sector already runs, become the engine. Today they “mostly share threat alerts at the CISO level”. Under the plan, they would run shared AI tools, coordinate fixes with vendors, organize mutual aid and produce the scorecards.
Lead agencies stay in the picture: in the essay’s table, the Department of Energy for power, Treasury for banks, EPA for water, the FCC for communications and HHS for hospitals.
2. Signed targets and monthly scorecards
This is the part with teeth. Each council CEO signs three sector targets: “zero internet-exposed control systems, 72-hour manual-operation drills passed, critical vulnerabilities contained (patched or with a compensating control) within a set time.”
Every ISAC would report “anonymized sector-wide metrics” to the SI Force each month. “A sector behind target triggers a CEO-level review with the SI Force leader.” For public companies, the board would attest to the progress metrics, and regulators would accept that attestation “in place of duplicate audits”.
Large companies would carry small ones: “Utilities sponsor co-ops and city utilities in their footprint. Large health systems sponsor rural hospitals. Big banks fund community-bank tools through FS-ISAC. National carriers backstop rural carriers.”
Within “3-6 months”, the CEO council would run a joint drill “modeled on GridEx”, with power, telecom, banks and hospitals responding together “to an AI-speed attack”.
3. Contain first, patch later
The technical strategy is blunt: “protect the targets that matter most first, contain what cannot be patched, and use AI so a small number of defenders can cover thousands of operators.”
In practice, that means:
- Find and close exposure: AI-assisted scanning finds “every internet-facing control system, VPN and remote-access path”. Each is cut off, put behind a monitored access point or protected with phishing-resistant multi-factor login.
- One-way connections out of the most critical control networks, and separation of office IT from control networks.
- Prove manual operation: “every top target shows it can keep operating without its IT systems for 72 hours, tested in drills. Hospitals use paper charts, utilities manual control, banks fallback settlement.”
- Backups out of reach: offline copies of control-system configurations.
4. AI as the force multiplier
Delivered through the ISACs, AI would look for flaws in “open source, vendor code and firmware before release”. Findings go to manufacturers through a national clearinghouse, and vendors “must provide a fix or workaround on a set timeline”. For systems that cannot be patched, AI turns each flaw into a specific compensating step, “tested on a digital twin before it goes live”.
Small operators get help: “a subsidized AI security operations service for small water systems, rural hospitals and electric co-ops.” And there is a guardrail that matters for anyone who runs physical equipment: “AI defense tools are read-only for control networks by default, and a human approves any change.”
5. The legal and money asks
The plan is honest that companies will not move without legal protection: “CEOs will not authorize sensitive data sharing without legal cover and firms may have legal liability for vulnerabilities they identify.” Its priority fixes:
- “Measure results, not paperwork”: regulators track exposed systems, time to contain a critical flaw and hours of proven manual operation, “not checklists”.
- “Regulatory relief for performance”: companies that hit the targets and have board sign-off “get safe harbor protections”.
- Vendor responsibility: vendors disclose how long they will support a product and must fix AI-discovered flaws on a set timeline.
- “Compute for defense”: “the federal government secures frontier-model access and compute for the participating companies and the national vulnerability clearinghouse.”
- “Workforce surge”: a reserve of vetted responders from large operators and vendors.
What holds up when you check the facts
The plan makes several factual claims about laws and programs that already exist. I checked the main ones against their original sources.
Gold Eagle exists. The plan calls it “the administration’s new AI-enabled vulnerability clearinghouse”. The White House announced it on July 14, 2026, as a clearinghouse for “unprecedented cybersecurity vulnerability coordination”, established in an executive order of June 2, 2026 (EO 14409). The White House release speaks of software and networks. Expanding it into industrial equipment, as the plan proposes, would be a new step.
The information-sharing law is on short extensions. The plan asks for a “long-term CISA 2015 reauthorization”. The Congressional Research Service wrote in its update of September 3, 2026, that the law’s provisions “were extended to December 11, 2026”. In other words, a key legal cover for sharing threat data has a deadline four weeks away. As of November 13, I could not find a public record that a long-term renewal has passed.
The power sector’s CEO layer is real. The plan says power and finance already have CEO-level involvement. The Electricity Subsector Coordinating Council describes itself as “CEO-led”. GridEx, the model for the proposed joint drill, is hosted by the E-ISAC every two years, according to NERC, which calls it “the electricity industry’s largest cyber and physical security exercise in North America”.
The “35-day patch window” is more flexible than the plan suggests. The sector table calls for replacing “the fixed 35-day patch window with a risk-based containment window”. The underlying NERC standard, CIP-007-6, requires utilities to “evaluate security patches for applicability” at least “once every 35 calendar days”, and then, “within 35 calendar days of the evaluation completion”, to apply them or create a dated mitigation plan. So a form of containment is already allowed. The real debate is about how fast and how risk-based it should be.
The ISAC system is older than the plan says. The essay writes that the governance system was “established twenty years ago by executive order”. According to the National Council of ISACs, the ISAC concept goes back to Presidential Decision Directive 63, “signed May 22, 1998”. That is a presidential directive, not an executive order, and 28 years ago. A small slip, but in a plan about governance it is worth getting right.
The telecom threat is documented. The plan names “Salt Typhoon-style” intrusions as the top telecom risk. A joint advisory published by CISA and partner agencies (AA25-239A) describes Chinese state-sponsored actors who “focus on large backbone routers of major telecommunications providers” and have been active “since at least 2021”.
One detail differs within a16z’s own texts. The introduction to the plan calls Neuberger’s former White House role “Deputy National Security Advisor for Cyber and Emerging Threats”. In her own October post, she writes “Cyber and Emerging Technology”.
The parts that deserve criticism
A plan this ambitious should be read with a few questions in mind.
Who pays? The plan admits the problem: “The cost of addressing the scale of national tech debt is likely to be significant.” It gives no figure. Replacing unsupported equipment, it says, “is costly and can take 2–5 years”. The target of containing the top targets “within 6 months” is ambitious for sectors where control systems often stay in service, according to the plan itself, “for more than 20 years”.
Who benefits? a16z is a venture investor, and the plan gives AI labs and cloud and security providers a formal role. Its own investment list names frontier AI labs such as OpenAI, xAI, Mistral, Safe Superintelligence and Thinking Machines Lab, and security companies such as Wiz and Socket. The plan proposes that “the federal government secures frontier-model access and compute” for participants. That does not make the plan wrong, but readers should know the interest. a16z’s own disclaimer under the essay says the content “is not investment advice” and that portfolio companies mentioned “are not representative of all investments”.
The nonprofit next door. The plan notes that for small operators, “Nonprofit funding is available today.” It does not name a source. Earlier, on October 15, Neuberger announced the Securing America’s Infrastructure Foundation, “a new 501(c)(3) nonprofit, incubated by a16z”, with “$25 million in committed funding from a16z’s founding partners”, focused on small cities and rural hospitals. Whether the plan means this foundation is not stated.
Pledges instead of rules. The plan swaps compliance checklists for CEO commitments, scorecards and safe harbors. That can speed things up. But a safe harbor also means less liability for companies that hit the targets, and the scorecards are “anonymized”. The public would see sector averages, not which utility is behind.
Small operators stay second. In the plan’s own sector table, the top water risk is “Remotely changed chemical levels at small utilities”. The priority list for water, however, covers “utilities serving large populations (those with 50,000 or more Americans)”. The plan says protecting the critical few “buys time to fix the rest”. For a town on a small water system, that means waiting.
No reaction yet. As of this writing, less than a day after publication, I found no public response from the White House, the ISACs or the named sectors.
What it means for businesses
- Operators of critical infrastructure: If anything like this is adopted, the questions change. Not whether a control exists on paper, but how many of your control systems can be reached from the internet, how fast you contain a critical flaw, and whether you can run for 72 hours without IT. Those are worth answering now, plan or no plan.
- Vendors and suppliers, including SMEs in the supply chain: The plan wants vendors to publish how long they support a product and to fix AI-found flaws on a deadline. Equipment makers, “many of them foreign”, would have to act “as a condition for selling to critical operators”. If you sell controllers, software or services to utilities, hospitals or banks, expect support periods and response times to show up in contracts.
- Small utilities, co-ops and rural hospitals: The plan offers sponsorship by larger players and subsidized monitoring. Until that exists, the free basics still apply: no remote access without strong login, offline backups, and a tested paper fallback.
What it means for citizens
The plan’s promise is simple: the lights stay on, the water stays safe and the hospital keeps treating patients even during a serious attack, if only by switching to manual control and paper charts for three days.
For citizens, two things are worth watching. First, the “Measure results, not paperwork” approach would make security measurable, but the plan reports anonymized scores to the White House, not to the public. Second, the plan leans on AI tools scanning critical systems and on new legal protections for the companies involved. How much oversight comes with that is open.
What is not known
- Whether the White House will take it up. The plan is a proposal by a private firm. As of November 13, the SI Force had not responded publicly.
- What it would cost, and who pays. The plan names no budget, only that the cost “is likely to be significant”.
- What happens to CISA 2015 after December 11. The plan’s information-sharing pillar depends on it.
- Which companies would sit on the CEO council. The plan describes “a short list of CEOs chosen by the size and influence of the firms they lead”; it names none.
- How well AI-generated workarounds hold up in real plants. The plan relies on digital twins for testing; it calls them a “second phase” for critical shared systems.
The bottom line
The a16z plan is worth reading because it is concrete. It names the targets, the deadlines and the three numbers CEOs would sign. Its central bet, that a few hundred operators carry most of the national risk and that AI can buy them time, is plausible. Its weak spots are the ones you would expect from a venture firm writing policy: no price tag, a big role for the industries it invests in, and a lot of trust in voluntary pledges. The most urgent piece may be the least glamorous: a data-sharing law that, according to the Congressional Research Service, was extended only to December 11.
I’m Thorsten Meyer. The full sources are below, and more reality checks are at thorstenmeyerai.com.
Sources
- a16z (Andreessen Horowitz), Anne Neuberger: “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, a16z.news, November 12, 2026, including the two tables “SI Force Governance Roles” and “AI-Era Risks And Priority Moves By Sector”
- a16z, Anne Neuberger: “Introducing Securing America’s Infrastructure Foundation”, a16z.news, October 15, 2026
- a16z: Investment List, a16z.com, checked November 13, 2026
- The White House: “White House Launches Gold Eagle Initiative for Unprecedented Cybersecurity Vulnerability Coordination”, July 14, 2026
- Congressional Research Service: “The Cybersecurity Information Sharing Act of 2015: Expiring Provisions” (IF12959), updated September 3, 2026
- NERC: Reliability Standard CIP-007-6, “Cyber Security – Systems Security Management”, Requirement R2
- NERC: E-ISAC GridEx page, nerc.com
- Electricity Subsector Coordinating Council: electricitysubsector.org
- National Council of ISACs: “About ISACs”, nationalisacs.org
- CISA and partner agencies: Cybersecurity Advisory AA25-239A, “Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System”, last revised September 03, 2025
- NBC News: “Trump announces members of ‘Super Intelligence Force’ to coordinate AI policy”, October 2026
Researched and drafted with AI assistance, including Anthropic’s Claude. No company or agency named here reviewed or sponsored this article. This article is for information only. It is not legal, security-consulting or investment advice. Plan details as published by a16z on November 12, 2026; status of laws and programs as of the sources listed above. Images: AI-generated illustration (Runware) and graphics by Thorsten Meyer AI; no real people or logos are shown.
