Key Takeaways
- • Anne Neuberger, General Partner and Head of Global Affairs at Andreessen Horowitz (a16z), proposes a national cyber defense plan for critical infrastructure in an article published in the Wall Street Journal, framed around AI compressing the time between vulnerability discovery and exploitation.
- • The plan targets the few hundred operators and shared vendors across five sectors (power, banking and payments, water, communications, and hospitals) whose failure would cascade nationally.
- • Governance would sit under the White House's Super Intelligence Force, with CEOs of key companies signing sector targets and Information Sharing and Analysis Centers (ISACs) delivering monthly metrics via scorecards to regulators.
- • Core technical goals include eliminating internet exposure of control systems, segmenting networks, proving 72-hour manual operation, and using AI to find flaws and produce tested workarounds at machine speed.
- • The plan identifies legal gaps, including liability protection for information sharing and a potential safe harbor for firms meeting outcomes-based targets, with reauthorization of the Cybersecurity Information Sharing Act of 2015 cited as a needed step.
Summary
Anne Neuberger, General Partner and Head of Global Affairs at Andreessen Horowitz, and a former Deputy National Security Advisor for Cybersecurity and Emerging Threats, has outlined a public-private plan to strengthen national cyber resilience in an article published in the Wall Street Journal. Her central argument is that AI is shrinking the time between discovering a weakness and exploiting it, and that defenders operating at human speed will fall behind. The same AI capabilities, she argues, can help defenders locate exposed systems, rank which matter most, and generate fixes, including workarounds such as firewall rules or configuration changes for legacy equipment that cannot be patched.
The plan concentrates on a narrow set of operators and shared vendors whose failure could cascade nationally, including large transmission substations, the Fedwire and ACH payment systems, water utilities serving large cities, core telecom networks and 911 systems, regional trauma centers, and health-record vendors. Protecting this critical group first is presented as the way to buy time to address smaller operators, which often serve as entry points for attackers. The plan covers five sectors: power, banking and payments, water, communications, and hospitals.
Governance would be built on the existing structure of Sector Coordinating Councils and ISACs, which were established roughly twenty years ago by executive order. According to the plan, the power and financial services ISACs already have CEO-level involvement, while water, telecom, and hospital ISACs do not. The White House's Super Intelligence Force would work with influential CEOs to add that layer. Each council CEO would sign sector targets, including zero internet-exposed control systems, passed 72-hour manual-operation drills, and containment of critical vulnerabilities within set timeframes. ISACs would report anonymized metrics monthly, and sectors falling behind would trigger CEO-level reviews. For public companies, boards would attest to outcomes-based progress consistent with existing SEC cyber disclosure rules, and regulators would accept that attestation in place of duplicate audits.
The technical strategy emphasizes containment before scale: closing internet-facing control system access, deploying one-way data connections for critical networks, separating IT from operational technology networks, maintaining offline configuration backups, and testing the ability to rebuild systems from bare metal. AI would be used for vulnerability discovery in open source, vendor code, and firmware, with the plan proposing that equipment makers, many of them foreign, act on findings by a set deadline as a condition of selling to critical operators. Findings would flow through Gold Eagle, described in the article as the administration's new AI-enabled vulnerability clearinghouse, which the plan proposes expanding from software into industrial equipment.
The plan also flags legal barriers. CEOs will not authorize sensitive data sharing without legal cover, and firms may face liability for vulnerabilities they identify. The article proposes reauthorization of the Cybersecurity Information Sharing Act of 2015 to address the first issue and time-based liability protection for the second. A cross-sector drill modeled on GridEx is proposed within three to six months. Success, according to the plan, would be measured by how quickly flaws are contained and whether essential services continue operating under attack.
The plan concentrates on a narrow set of operators and shared vendors whose failure could cascade nationally, including large transmission substations, the Fedwire and ACH payment systems, water utilities serving large cities, core telecom networks and 911 systems, regional trauma centers, and health-record vendors. Protecting this critical group first is presented as the way to buy time to address smaller operators, which often serve as entry points for attackers. The plan covers five sectors: power, banking and payments, water, communications, and hospitals.
Governance would be built on the existing structure of Sector Coordinating Councils and ISACs, which were established roughly twenty years ago by executive order. According to the plan, the power and financial services ISACs already have CEO-level involvement, while water, telecom, and hospital ISACs do not. The White House's Super Intelligence Force would work with influential CEOs to add that layer. Each council CEO would sign sector targets, including zero internet-exposed control systems, passed 72-hour manual-operation drills, and containment of critical vulnerabilities within set timeframes. ISACs would report anonymized metrics monthly, and sectors falling behind would trigger CEO-level reviews. For public companies, boards would attest to outcomes-based progress consistent with existing SEC cyber disclosure rules, and regulators would accept that attestation in place of duplicate audits.
The technical strategy emphasizes containment before scale: closing internet-facing control system access, deploying one-way data connections for critical networks, separating IT from operational technology networks, maintaining offline configuration backups, and testing the ability to rebuild systems from bare metal. AI would be used for vulnerability discovery in open source, vendor code, and firmware, with the plan proposing that equipment makers, many of them foreign, act on findings by a set deadline as a condition of selling to critical operators. Findings would flow through Gold Eagle, described in the article as the administration's new AI-enabled vulnerability clearinghouse, which the plan proposes expanding from software into industrial equipment.
The plan also flags legal barriers. CEOs will not authorize sensitive data sharing without legal cover, and firms may face liability for vulnerabilities they identify. The article proposes reauthorization of the Cybersecurity Information Sharing Act of 2015 to address the first issue and time-based liability protection for the second. A cross-sector drill modeled on GridEx is proposed within three to six months. Success, according to the plan, would be measured by how quickly flaws are contained and whether essential services continue operating under attack.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.