🔍 Read the full analysis: The Role Of 72-Hour Drills In A16z’s Infrastructure Security Plan on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Andreessen Horowitz published a proposal on November 12 for strengthening U.S. infrastructure security, including 72-hour manual-operation drills for five sectors. It would assign targets to company leaders and use monthly industry scorecards, but it is not government policy and leaves costs and implementation details unresolved.
Andreessen Horowitz (a16z) published a critical infrastructure cyber defense proposal on November 12, calling for companies in five sectors to meet shared security targets, including passing 72-hour manual-operation drills. The plan would put the White House’s Super Intelligence Force in charge of setting targets and call on industry groups to track progress, but it remains a proposal, not government policy.
The plan, written by a16z General Partner and Head of Global Affairs Anne Neuberger, focuses on power, banking and payments, water, communications and hospitals. Rather than attempt to protect every organization equally, it prioritizes what it describes as a few hundred operators and shared vendors whose disruption could cause wider national effects. a16z cited examples including transmission substations, payment networks, large-city water utilities, core telecommunications systems, regional trauma centers and health-record vendors.
For each sector, the proposal calls for CEOs to sign up to three measurable targets: zero internet-exposed control systems, successful 72-hour drills in manual operation, and critical vulnerabilities patched or addressed with a compensating control within a specified time. The top targets, according to the source material, should be contained within six months. The plan does not specify a cost for meeting the targets.
Under the proposed structure, the White House’s Super Intelligence Force would set national targets, convene monthly reviews with company leaders and help clear policy or funding obstacles. A CEO council would be accountable for sector results, while existing Information Sharing and Analysis Centers (ISACs) would coordinate work and submit anonymized monthly scorecards. Companies falling behind would face a CEO-level review, according to the proposal.
The a16z plan in motion · schematic
From a CEO pledge to the President’s table
How the proposed cyber defense plan for power, banks, water, telecom and hospitals is meant to work, step by step. It is a proposal, not policy.
The chain, step by step
Each circle is one step of the plan; the ring marks the step being explained.
What happens at each step
- 1CEO pledgeA CEO council, with 2–3 CEOs per sector, commits each sector to national targets set by the White House’s SI Force.
- 2Three targets, signedZero internet-exposed control systems72-hour manual-operation drills passedCritical flaws contained within a set time
- 3DrillsTop targets prove they can run without IT for 72 hours. A joint cross-sector drill, modeled on GridEx, within 3-6 months.
- 4Monthly scorecardsSector ISACs report anonymized metrics to the SI Force. A sector behind target triggers a CEO-level review.
- 5President councilThe CEO council is publicly accountable for results and meets the President every six months.
Source: a16z, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan”, November 12, 2026, incl. its governance table (“For illustrative purposes only”). The chain is a schematic of the proposal, not an existing program.
Graphic: Powered by Thorsten Meyer AI
Why Manual Drills Are Central
A 72-hour manual-operation drill tests whether essential services can continue when connected systems or automated tools are unavailable. The proposal treats that capability as a measurable readiness target, rather than relying only on plans, audits or the ability to restore systems after an incident. For services such as electricity, water, payments and hospital care, the capacity to operate during a cyber disruption could affect how far an incident spreads.
The plan’s wider significance is its proposed accountability chain: federal officials set targets, senior executives sign them, and sector organizations report progress. That approach could make security performance more visible across industries that depend on shared vendors and infrastructure. It also raises questions about who pays, how results are verified and whether a common target can fit organizations with very different systems and resources.
a16z argues that artificial intelligence is compressing the time between finding a weakness and exploiting it, while also offering defenders tools to identify exposed systems and develop fixes. That is the proposal’s rationale, not a demonstrated result of the plan. The document’s central test is whether organizations can apply defensive measures quickly enough; its suggested drills would test operational resilience, not by themselves prove that systems are secure.
Products Worth Considering
Samsung 65-Inch M70H Series 4K Mini LED Smart TV (2026)
eufy C28 Robot Vacuum and Mop for Pet Hair, 15,000 Pa
Dyson V8 Cyclone Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
From AI Threats to Sector Targets
Neuberger’s proposal connects infrastructure defense to the prospect that AI tools may accelerate vulnerability discovery and exploitation. It also argues AI could help defenders find exposed systems, rank risks and generate fixes. For equipment that cannot be patched, the plan suggests possible workarounds such as firewall rules or configuration changes. Those are the plan’s stated possibilities; it does not establish that the tools are already being used across the sectors or that they will work in every setting.
The proposal is addressed to the White House’s Super Intelligence Force. The supplied source says President Donald Trump announced the task force on October 4, 2026, and named National Intelligence Director Jay Clayton to lead it, citing NBC News. a16z proposes that the force set targets and chair reviews, but the available material does not say the task force has adopted the plan.
The proposal also asks Congress to reauthorize the Cybersecurity Information Sharing Act of 2015 for the long term and considers a safe harbor for companies that meet outcomes-based targets. Its governance table is labeled “for illustrative purposes only.” a16z invests in frontier AI labs and security companies, an interest relevant to readers evaluating a plan that gives cloud and AI-lab executives non-voting roles on the proposed CEO council.
“AI is shrinking the time between when a weakness is found and when it is exploited. Defenders who still work at human speed will lose that race.”
— Anne Neuberger, a16z general partner and head of global affairs, as quoted in the plan
Costs, Oversight and Adoption
The proposal does not provide a cost estimate, implementation schedule for all targets, or a detailed method for independently verifying drill results and vulnerability containment. It also does not establish what consequences would follow if a company missed a target, beyond a proposed CEO-level review. The source material does not show that the White House, Congress, sector regulators or participating companies have accepted the recommendations.
The suggested safe harbor is described as potential, and the plan does not spell out its legal scope or conditions. Details also remain unclear about how anonymized scorecards would be checked, how smaller operators would receive support, and how the proposed targets would account for equipment that cannot be patched. The plan says large companies could sponsor smaller organizations, but provides no funding figures or commitments.
Finally, the exact membership and authority of the proposed CEO council are not settled. The source describes two or three CEOs per sector and non-voting cloud and AI-lab CEOs, while marking the governance table illustrative. a16z’s investments in relevant technology firms are also a disclosed consideration when weighing the proposal; the supplied material does not show how those interests would be managed in any government-led process.
Federal and Industry Response
The next step is whether the White House’s Super Intelligence Force considers the proposal and whether federal agencies or industry groups develop concrete targets from it. The available source material reports no formal government response, adoption date or implementation timetable. Any move to reauthorize the 2015 information-sharing law or create a safe harbor would require further policy and legal action.
Readers should watch for specific sector targets, proposed drill standards, funding arrangements and plans for measuring compliance. The proposal also calls for monthly ISAC scorecards and reviews when sectors fall behind, but those reporting processes would only follow if the plan or a related framework is adopted. For now, the 72-hour drill is a recommendation within a private-sector policy proposal, not a confirmed national requirement.
Key Questions
What is a 72-hour manual-operation drill?
It is a proposed test of whether an infrastructure operator can keep essential functions running manually for 72 hours if automated or connected systems are unavailable. The source material does not set out a detailed drill protocol.
Which sectors would the plan cover?
The proposal names power, banking and payments, water, communications and hospitals. It prioritizes operators and shared vendors whose failure could affect services across a wider area.
Has the U.S. government adopted the plan?
No adoption is reported in the supplied material. The document is an a16z proposal, and its governance table is described as illustrative.
What other security targets does a16z propose?
The plan calls for zero internet-exposed control systems and critical vulnerabilities to be patched or addressed with a compensating control within a set period. It says top targets should be contained within six months.
How would the proposal be funded?
The source material gives no overall cost estimate. It suggests that large companies could support smaller utilities, hospitals, banks and carriers, but reports no funding commitments or detailed payment structure.
Source: ThorstenMeyerAI.com
