TL;DR
Andreessen Horowitz published a proposal on November 12, 2026, to strengthen cyber defenses at a selected group of U.S. critical infrastructure operators and shared vendors. It calls for signed sector targets, including passing 72-hour manual-operation drills, with White House oversight and monthly scorecards; it is not an adopted government policy.
Andreessen Horowitz published a proposal on November 12, 2026, calling for U.S. power, banking and payments, water, communications and hospital operators to meet cyber-defense targets, including passing 72-hour drills that test whether critical operations can continue without IT. Written by a16z General Partner and Head of Global Affairs Anne Neuberger, the plan would put a White House task force in charge of setting targets and make sector CEOs publicly accountable for progress; it remains a proposal, not government policy.
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
The plan argues that responsibility should focus on what it describes as a few hundred operators and shared vendors whose failure could cascade across the country. It names examples such as major electricity transmission substations, payment systems, large-city water utilities, core telecommunications networks and 911 systems, trauma centers, and health-record vendors. The document does not provide a complete list of organizations in scope.
For each sector, CEOs would sign up to three targets: zero internet-exposed control systems, successful 72-hour manual-operation drills, and containment of critical vulnerabilities within a set period. The plan says the top-priority targets should be contained within six months. Replacing unsupported equipment could take two to five years, it says, without specifying a cost estimate.
Under the proposed structure, the White House’s Super Intelligence Force would set targets, while a council of two or three CEOs from each sector would answer for results. Existing industry information-sharing and analysis centers, or ISACs, would coordinate work and report anonymized monthly scorecards. A sector falling behind would face a CEO-level review, and the council would meet with the president every six months. The plan also calls for a joint cross-sector drill modeled on GridEx within three to six months.
Testing Operations Beyond IT
A 72-hour drill would test whether selected operators can keep essential services running when their IT systems are unavailable. That makes the exercise a measure of operational resilience, not only whether a company has identified or patched software flaws. Power, payment, water, communications and hospital services support other parts of the economy, so disruption at a key operator or shared supplier could affect people and organizations beyond the initial victim.
The plan’s focus on a limited set of operators reflects its argument that cyber risk is concentrated. If adopted, its deadlines and scorecards could give officials and company leaders a shared way to track readiness. But the proposal does not establish that the identified operators can all complete the targets on the proposed schedule, or that passing a drill would prevent a real disruption.
a16z also seeks a long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 and proposes considering safe-harbor protections for companies meeting outcomes-based targets. Those requests matter to implementation: they would shape the legal conditions for sharing threat information and participating in the program. The document does not spell out the scope or terms of any proposed safe harbor.
Products Worth Considering
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
Bose QuietComfort Wireless Bluetooth Headphones – Active Over‑Ear Noise Cancelling with Mic, USB‑C Charging, Deep Bass, up to 24 h Playtime,
As an affiliate, we earn on qualifying purchases.
A Proposal for the White House
Neuberger’s proposal is directed to the White House’s Super Intelligence Force. The source material says President Donald Trump announced the task force on October 4, 2026, and named National Intelligence Director Jay Clayton to lead it, citing NBC News. It describes the force as coordinating federal engagement with critical infrastructure providers and AI companies. a16z says its proposed defense effort would be accountable to that body and led by infrastructure-company CEOs.
The plan frames its case around the possibility that AI tools could speed up both the discovery and exploitation of software weaknesses. It also argues that AI could help defenders find exposed systems, prioritize risks and generate fixes or workarounds for equipment that cannot be patched. These are claims and expectations in the proposal; the source material provides no independent measurements of how quickly AI systems can perform those tasks in infrastructure environments.
a16z says Neuberger drew on experience at the National Security Agency and as deputy national security adviser for cyber and emerging technology before joining the firm. The proposal also gives company leaders a central role. a16z invests in AI labs and security companies, a relevant affiliation when assessing its recommendations, though it does not by itself establish whether the plan’s claims are accurate.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z General Partner and Head of Global Affairs, in the plan
Policy, Costs and Coverage
The proposal has not been adopted as U.S. policy. The source material does not establish whether the White House or the Super Intelligence Force will take it up, which companies would be designated as top-priority targets, or how sector boundaries would be set. It also gives no cost estimate for drills, security work or replacing unsupported equipment.
The plan leaves key implementation details open, including the exact deadlines for vulnerability containment beyond the six-month target for top-priority operators, how drill results would be judged, and what information would appear in monthly scorecards. It does not state the terms of a possible safe harbor or how that protection would interact with existing legal obligations. The source material also does not verify the proposal’s estimates about AI’s effects on the speed of cyberattacks and defense.
Whether Officials Adopt the Plan
The next step is whether the White House’s Super Intelligence Force considers the recommendations and sets any official targets. If the proposed structure moves forward, sector CEOs would need to agree on commitments, ISACs would coordinate reporting, and operators would have to plan and run the drills. The plan proposes a joint cross-sector exercise within three to six months and six-month containment deadlines for top-priority targets, but those dates are recommendations rather than a published government schedule.
Further details would be needed to assess delivery: which operators are included, how progress is measured, what resources are available and whether Congress acts on the proposed information-sharing reauthorization. No government decision or implementation timetable is established in the supplied material.
Key Questions
What are the proposed 72-hour drills?
They are exercises intended to show that selected critical infrastructure operators can run essential operations for 72 hours without IT. The proposal does not specify a single test protocol or pass standard.
Which sectors would be covered?
The proposal names power, banking and payments, water, communications and hospitals. It focuses on selected operators and shared vendors, rather than stating that every company in those sectors would be included.
Is the plan now U.S. policy?
No. It is a proposal published by a16z. The source material does not report that the White House has adopted it.
Who would oversee the proposed effort?
The plan assigns target-setting to the White House’s Super Intelligence Force, with a CEO council accountable for results and sector ISACs coordinating work and monthly scorecards.
What deadlines does the proposal set?
It says top-priority targets should have critical vulnerabilities contained within six months and proposes a joint cross-sector drill within three to six months. These are proposed milestones, not confirmed government deadlines.
Source: Thorsten Meyer AI
