🔍 Read the full analysis: Can 72-Hour Drills Help Put A16z’s AI Defense Plan Into Practice? on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Andreessen Horowitz published a proposal on Nov. 12 for protecting critical infrastructure as AI accelerates cyber threats. It calls for measurable targets, including passing 72-hour manual-operation drills, but it is not government policy and does not specify costs.
Venture firm Andreessen Horowitz (a16z) published a proposed U.S. cyber defense plan on Nov. 12 that would require critical-infrastructure companies in five sectors to meet security targets, including passing 72-hour drills to operate without digital systems. The proposal assigns oversight to a White House task force and a council of company CEOs, but it has not been adopted as federal policy.
Written by a16z General Partner and Head of Global Affairs Anne Neuberger, the plan focuses on power, banking and payments, water, communications, and hospitals. Rather than attempt to protect every organization equally, it prioritizes what the proposal describes as a few hundred operators and shared vendors whose disruption could spread across the country. Examples named in the plan include major transmission substations, payment networks, urban water utilities, core telecommunications and 911 systems, trauma centers, and health-record vendors.
For each sector, the plan proposes three signed targets: zero internet-exposed control systems, passing a 72-hour manual-operation drill, and containing critical vulnerabilities—through a patch or compensating control—within a set period. It says the highest-priority targets should be contained within six months. The document does not specify a complete timeline for all targets.
The proposed structure links the White House’s Super Intelligence Force to a CEO council and existing industry Information Sharing and Analysis Centers, or ISACs. The task force would set targets and convene monthly reviews; CEOs would be publicly accountable for sector results; and ISACs would coordinate shared tools, fixes, mutual aid and monthly anonymized scorecards. The plan also calls for public-company boards to attest to progress, with regulators accepting those attestations in place of duplicate audits. These are proposals, not current requirements.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Testing Whether Services Can Keep Running
The 72-hour drill proposal shifts the measure of cyber readiness from whether an organization has written procedures to whether it can keep operating during a prolonged loss of digital systems. For services such as electricity, banking, water and emergency communications, an inability to run manually could affect people and organizations far beyond the initially compromised company. The drills would test operational continuity, not just technical defenses.
The plan’s focus on shared vendors also reflects how a failure at one supplier can affect multiple operators. Coordinated targets and sector-wide reporting could make those common dependencies more visible. But the proposal does not establish that the targets are achievable across different systems, or explain how costs and operational burdens would be distributed—particularly for smaller utilities, hospitals and financial institutions.
Its accountability model could also alter how companies and regulators handle cyber risks. If adopted, board attestations and monthly scorecards could create clearer comparisons across sectors. At the same time, a public system of targets would need to distinguish genuine readiness from checkbox compliance. The document calls for outcomes-based goals, but gives limited detail on independent verification and consequences for missed targets.
Popular right now
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds with Immersive Audio and Wireless Charging Case, Black
De'Longhi Classic Signature Espresso Machine with Adjustable Milk Frother
eufy C28 Robot Vacuum and Mop for Pet Hair, 15,000 Pa
As an affiliate, we earn on qualifying purchases.
A Proposal Built Around AI-Accelerated Threats
a16z frames its plan around the possibility that AI can shorten the time between discovering a software weakness and exploiting it. The firm argues that defenders could use AI to identify exposed systems, prioritize high-impact risks and produce fixes, including alternative safeguards for older equipment that cannot be patched. Those are the plan’s rationale and proposed uses; the source material does not provide independent evidence that these tools would work at the speed or scale required across the sectors.
Neuberger’s background includes cyber and infrastructure security work in the U.S. government, including at the National Security Agency and as deputy national security adviser for cyber and emerging technology, according to her account in the proposal. The plan is addressed to the White House’s Super Intelligence Force. President Donald Trump announced that task force on Oct. 4, 2026, and named National Intelligence Director Jay Clayton to lead it, according to NBC News.
The proposal asks Congress to reauthorize the Cybersecurity Information Sharing Act of 2015 for the long term and considers a possible safe harbor for companies that meet outcomes-based targets. It does not identify a cost estimate. a16z also invests in frontier AI companies and security firms, including businesses whose participation could be covered by the plan’s proposed structure. That interest is relevant context, but does not by itself establish how the proposal would be implemented or who would benefit.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z General Partner and Head of Global Affairs, in the plan
The proposal does not say whether the White House or Congress will take it up, whether the Super Intelligence Force would receive authority to set binding requirements, or how any safe harbor would work. It also provides no cost estimate, detailed funding plan, or full timetable beyond saying top targets should be contained within six months.
Other implementation questions remain unresolved: how drill performance would be verified, what would count as a successful manual operation, how companies would report sensitive weaknesses, and what would happen when a sector misses its targets. The plan describes a governance table as illustrative. Its proposed CEO council, monthly reporting and regulatory treatment should not be mistaken for arrangements already in place.
The source material also does not establish that AI can reliably find and fix vulnerabilities across older and diverse infrastructure systems. The plan presents AI as a potential tool for both attackers and defenders, while acknowledging uncertainty over whether defensive use can be deployed quickly enough.
Federal Response Will Determine Its Path
The immediate next step would be a decision by the White House and relevant agencies on whether to consider the proposal. If they do, the plan points toward sector targets, monthly ISAC reporting and CEO reviews, while congressional action would be needed for the requested long-term reauthorization of the 2015 information-sharing law.
No implementation schedule, public response from the task force, or decision by Congress is included in the source material. Until one is announced, the 72-hour drills and other targets remain recommendations from a16z rather than obligations for infrastructure operators.
Key Questions
What is the 72-hour drill?
The proposal would require participating operators to pass a manual-operation drill lasting 72 hours, testing whether essential services can continue without relying on normal digital systems. The document does not give a single detailed test standard.Which sectors would the plan cover?
It names power, banking and payments, water, communications, and hospitals, with priority given to operators and shared vendors whose failure could have wider effects.Is the plan a U.S. government requirement?
No. It is an a16z proposal published Nov. 12, 2026. The source material does not say that the White House or Congress has adopted its targets.Who would oversee the proposed targets?
The plan proposes that the White House’s Super Intelligence Force set targets, a CEO council answer for sector results, and existing ISACs coordinate implementation and monthly scorecards.How much would the plan cost?
The proposal provides no cost estimate. It calls for support for smaller operators and considers legal protections for participating companies, but does not set out a full funding mechanism.Source: ThorstenMeyerAI.com
