🔍 Read the full analysis: The 72-Hour Drill Idea At The Center Of A16z’s Infrastructure Plan on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Andreessen Horowitz published a proposal on November 12 for a White House-led effort to protect key operators in five infrastructure sectors. It calls for CEOs to sign measurable targets, including passing 72-hour manual-operation drills, but the plan is a proposal, not adopted policy.
Venture firm Andreessen Horowitz (a16z) published a proposal on November 12 for a White House-led cybersecurity effort focused on operators whose disruption could affect essential services. Written by a16z General Partner and Head of Global Affairs Anne Neuberger, the plan calls for companies in five sectors to meet measurable security targets, including passing 72-hour manual-operation drills; it has not been adopted as U.S. policy.
The proposal, titled the “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan,” would concentrate resources on a few hundred operators and shared vendors in power, banking and payments, water, communications and hospitals. Rather than attempt to secure every organization equally, it argues that failures at a limited number of interconnected companies could cascade nationally. The plan names examples such as large transmission substations, major payment systems, urban water utilities, core telecom networks and health-record vendors.
Its proposed targets are zero internet-exposed control systems, successful 72-hour drills in which operators maintain services manually, and containment of critical vulnerabilities—through patches or other controls—within a set period. The plan says the top targets should be contained within six months, but the source material does not specify a single deadline applying to every vulnerability or sector. Industry Information Sharing and Analysis Centers, or ISACs, would coordinate shared tools and fixes and report anonymized sector metrics monthly.
The proposed governance structure assigns the White House’s Super Intelligence Force responsibility for setting national targets and clearing policy or funding barriers. A council of sector CEOs would sign targets and answer publicly for results, while ISACs would carry out much of the operational coordination. The plan also proposes a monthly review when a sector falls behind, board attestations for public companies, and acceptance of those attestations by regulators in place of duplicate audits. Its governance table is described by a16z as illustrative.
To encourage participation, the proposal asks Congress to reauthorize the Cybersecurity Information Sharing Act of 2015 for the long term and considers a safe harbor for companies that meet outcomes-based targets. It does not name a cost for the program. The source also notes that a16z invests in frontier AI labs and cybersecurity companies, which could have a role in the proposed effort; that relationship is relevant context, not evidence that the plan has been accepted by government.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Why Manual Drills Matter
The proposal would shift attention from broad, potentially difficult-to-measure cybersecurity efforts toward a small number of operational outcomes. A 72-hour manual-operation drill tests whether an essential service can continue if digital systems become unavailable. The target is intended to address not only prevention, but also the ability to keep services running during an incident.
That focus matters because power, payments, water, communications and hospital services rely on interconnected organizations and vendors. A serious outage at one operator can affect customers and institutions beyond its own systems. By making CEOs sign targets and putting sector performance on monthly scorecards, the plan seeks to give senior leaders responsibility for preparedness rather than leaving the work solely to cybersecurity teams.
The proposal also highlights a tension in applying AI to infrastructure defense. It says AI could help identify exposed systems, rank risks and generate fixes, while warning that attackers may also use AI to find weaknesses faster. Those are the plan’s arguments, not findings established in the source material. The practical test would be whether organizations can safely apply remedies to varied systems, including older equipment, quickly enough to reduce risk.
Popular right now
KitchenAid Artisan Series 5-Quart Tilt-Head Stand Mixer, Dried Rose
Dyson V8 Cyclone Cordless Vacuum
Roborock Q7 M5+ Robot Vacuum and Mop
As an affiliate, we earn on qualifying purchases.
From Federal Task Force to Sector Targets
Neuberger’s plan is directed toward the White House’s Super Intelligence Force. According to the source material, President Donald Trump announced the task force on October 4, 2026, and named National Intelligence Director Jay Clayton to lead it. The proposal says that body should set targets and convene monthly CEO reviews; the task force’s existence does not mean it has endorsed a16z’s recommendations.
Neuberger describes having worked on infrastructure security inside the U.S. government, including at the NSA and as deputy national security adviser for cyber and emerging technology, before joining a16z. The proposal would build on sector ISACs that already share threat information, giving them a broader role in coordinating remediation and reporting progress. It also assigns federal lead agencies to the sectors: Energy for power, Treasury for banking, EPA for water, the FCC for communications and HHS for hospitals.
a16z said Neuberger outlined the plan in a Wall Street Journal opinion piece as well as in the firm’s November 12 publication. The document presents itself as a proposal and includes an illustrative governance model, not a finalized government program.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z general partner and head of global affairs, in the plan
What the Proposal Leaves Open
No adoption or implementation decision is reported in the source material. It remains unclear whether the White House or Congress will consider the proposal, whether the task force will use its suggested governance model, or how sector companies would be selected and required to participate.
The plan does not provide a program budget, detailed sector-specific deadlines, or a full account of how the proposed safe harbor would work. It also does not say how regulators would verify company attestations or resolve disagreements over whether a vulnerability has been adequately contained. The proposal’s broad targets would need definitions and implementation rules before readers could assess compliance consistently.
The source gives no independent evidence about how quickly AI can identify or remediate infrastructure vulnerabilities, or whether the proposed drills and targets would reduce outages. The plan itself frames the key uncertainty as whether AI-assisted defenses can be applied fast enough. Its claims about concentrated national risk and potential AI benefits should be understood as the authors’ case for the proposal, not as independently confirmed conclusions.
Decisions Needed for Implementation
The next step would be a decision by federal officials on whether to develop the proposal into policy. That would require defining the Super Intelligence Force’s role, determining which operators and vendors qualify, and setting sector-specific measures and deadlines. The source material does not report a government timetable for those decisions.
Any move toward implementation would also require congressional action on the requested reauthorization of the 2015 information-sharing law, as well as further detail on possible legal protections for participating companies. If the proposal advances, public scorecards, CEO reviews and the planned 72-hour drills would provide ways to track progress, but their precise standards and reporting rules remain unsettled.
Key Questions
What is the 72-hour drill in a16z’s plan?
It is a proposed exercise to test whether an infrastructure operator can keep running manually for 72 hours if its digital systems are unavailable. The plan does not provide detailed drill procedures or a uniform testing standard.
Which industries would be covered?
The proposal names power, banking and payments, water, communications and hospitals. It says the effort should focus on a few hundred operators and shared vendors whose failure could have wider effects.
Has the U.S. government adopted the plan?
No adoption is reported in the source material. The document is an a16z proposal, and its suggested governance structure is described as illustrative.
What targets would companies have to meet?
The proposed targets are zero internet-exposed control systems, passing a 72-hour manual-operation drill, and containing critical vulnerabilities within a set time. The plan says top targets should be contained within six months, but does not give a universal timetable for every sector or vulnerability.
How would the plan be funded and enforced?
The source material does not provide a program cost or finalized enforcement rules. It proposes monthly reporting through ISACs, CEO-level reviews for sectors that fall behind, and possible legal protections for companies meeting agreed targets.
Source: ThorstenMeyerAI.com
