🔍 Read the full analysis: How 72-Hour Drills Could Test A16z’s AI Infrastructure Strategy on ThorstenMeyerAI.com
TL;DR
Andreessen Horowitz published a proposal calling for cybersecurity targets across power, banking, water, communications and hospitals, including passing 72-hour manual-operation drills. The plan would put the White House’s Super Intelligence Force over a CEO council and existing industry information-sharing centers, but it is a proposal, not adopted policy.
Andreessen Horowitz published a proposed cyber defense plan on November 12 that would require leaders in five critical-infrastructure sectors to meet security targets, including passing 72-hour manual-operation drills. The venture firm’s proposal is aimed at the White House’s Super Intelligence Force and is not government policy.
The plan, titled “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan,” was written by Anne Neuberger, a16z general partner and head of global affairs. The firm said Neuberger also outlined the proposal in a Wall Street Journal opinion piece. It focuses on power, banking and payments, water, communications and hospitals, arguing that national risks are concentrated among a few hundred operators and shared vendors.
Under the proposed structure, the White House’s Super Intelligence Force would set national targets and chair monthly reviews. A council with two or three CEOs from each sector would sign off on sector targets and answer publicly for results. CEOs from cloud and AI companies would participate as non-voting members, according to the plan’s governance table, which a16z describes as illustrative.
Existing industry information-sharing and analysis centers, or ISACs, would coordinate the operational work. The plan calls for them to run shared AI tools, coordinate fixes with vendors and send monthly anonymized scorecards to the federal task force. A sector falling behind would face a CEO-level review. Public-company boards would attest to progress, with regulators accepting the attestations in place of duplicate audits, the proposal says.
The three suggested targets are zero internet-exposed control systems, passing 72-hour drills in manual operations, and containing critical vulnerabilities—by patching them or applying a compensating control—within a set time. The proposal says top targets should be contained within six months. It does not specify a cost or give a detailed implementation schedule for each sector.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Testing Readiness Across Five Sectors
The proposal shifts the focus from sharing warnings to measuring whether essential services can keep operating during a cyber incident. A 72-hour manual-operation drill would test whether a utility, hospital or other operator can function if digital systems are unavailable, rather than only whether staff have received alerts or completed routine exercises.
The plan’s emphasis on a limited set of operators and common vendors reflects the possibility that a weakness in a widely used supplier could affect multiple organizations. a16z argues that AI can help defenders find exposed systems, rank risks and generate fixes, while also accelerating attackers’ ability to discover and exploit vulnerabilities. The proposal does not establish how quickly those defensive tools would work in practice.
For readers, the distinction between proposal and policy is material: the document outlines a governance model and performance targets, but does not itself impose duties on infrastructure operators. Its call for legal protections and federal coordination would require decisions by government and industry before the measures could take effect.
Popular right now
Shark WANDVAC Power PET Cordless Handheld Vacuum, White, WV410WH
Ninja Foodi DualZone Smart XL Air Fryer, 10 Qt, 6-in-1, Black (DZ550)
De'Longhi Classic Signature Espresso Machine with Adjustable Milk Frother
As an affiliate, we earn on qualifying purchases.
From Federal Task Force to Sector Targets
The plan is addressed to the White House’s Super Intelligence Force. The source article reports that President Donald Trump announced the task force on October 4, 2026, and named National Intelligence Director Jay Clayton to lead it. Trump said it would coordinate federal engagement with critical-infrastructure providers and superintelligence companies, according to NBC News.
Neuberger’s background is part of the proposal’s framing. She says she worked on infrastructure security inside the U.S. government, first at the National Security Agency and later as deputy national security adviser for cyber and emerging technology. She now holds a role at a16z, which invests in frontier AI labs and security companies.
The proposal assigns lead agencies by sector: the Department of Energy for power, Treasury for banking, the Environmental Protection Agency for water, the Federal Communications Commission for communications and the Department of Health and Human Services for hospitals. It also asks Congress to reauthorize the Cybersecurity Information Sharing Act of 2015 for the long term and considers a safe harbor for companies that meet outcomes-based targets.
„AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.“
— Andreessen Horowitz plan by Anne Neuberger
Policy, Costs and Drill Standards
No federal adoption of the plan is established in the supplied material. It is unclear whether the Super Intelligence Force or any agency will consider its governance model, targets or proposed legal protections. The proposal also names no budget, funding source or cost-sharing arrangement for the work.
Several operational details remain unspecified. The plan calls for 72-hour manual-operation drills but the available material does not define how often they would occur, how passing would be assessed, or which systems and staff must be covered. It also refers to vulnerabilities being contained within a set time without providing a full schedule for every category.
The proposal’s suggested safe harbor, board attestations and regulator acceptance of those attestations are recommendations, not current legal protections or reporting rules. The relationship between the CEO council, sector regulators and existing emergency-response structures is also not fully set out. a16z’s investments in AI and security firms are relevant context for its role in the debate, but do not by themselves establish that the plan would benefit any particular company.
Whether Washington Takes Up the Plan
The next development would be a response from the White House’s Super Intelligence Force, relevant federal agencies or Congress. The source material does not identify a government review date, public comment period or formal decision process for the proposal.
If officials pursue the approach, they would need to determine which operators and vendors fall within scope, set sector-specific measures and clarify how ISACs would report progress. Congress would also have to act on any reauthorization of the 2015 information-sharing law or new safe-harbor provisions. Until those steps are confirmed, the 72-hour drills and six-month targets remain recommendations, not requirements for infrastructure companies.
Key Questions
What is a16z proposing?
a16z proposes federal targets and sector-level accountability for cybersecurity across power, banking and payments, water, communications and hospitals, with existing ISACs coordinating operational work.
What would the 72-hour drill test?
The proposal calls for operators to pass 72-hour manual-operation drills, intended to test their ability to keep services running without normal digital systems. The supplied material does not specify a common test standard or frequency.
Is the plan a U.S. government policy?
No. It is an a16z proposal published November 12, 2026. The source material does not say that the White House or federal agencies have adopted it.
Which organizations would oversee the proposed work?
The plan assigns national target-setting and reviews to the White House’s Super Intelligence Force, sector accountability to a CEO council, and implementation and monthly scorecards to existing ISACs.
What remains unknown about implementation?
The plan does not provide a budget, full timetable, detailed drill standards or confirmation of government support. Its proposed legal safe harbor and long-term reauthorization of the Cybersecurity Information Sharing Act of 2015 would also require further action.
Source: ThorstenMeyerAI.com
