The greatest nationwide cyber risk centers on a few hundred US infrastructure operators and shared vendors whose failures could spread across the country, Andreessen Horowitz said in a Nov. 12 publication.
The venture capital firm proposed putting company chiefs in charge of sector defense targets. It made the proposal in its newsletter, “Super Intelligence-Era Critical Infrastructure Cyber Defense Plan.” Anne Neuberger, its general partner and head of global affairs, argued that existing rules measure compliance rather than how quickly companies contain threats.
Neuberger, a former US deputy national security adviser for cybersecurity and emerging threats, said artificial intelligence is shortening the time between discovering a weakness and exploiting it. Her proposal covers five sectors: power, banking and payments, water, communications, and hospitals. It presents a defense plan rather than findings from a study over a specified period.
The plan would prioritize operators according to the harm their failure could cause and other services’ dependence on them, the publication said. Shared suppliers can pose greater risks than individual operators. Priorities include large electricity substations, payment networks, major water utilities, core telecommunications networks, regional trauma centers and electronic health-record suppliers.
The publication said AI could find exposed systems, rank their importance and generate fixes, including firewall rules or settings changes when equipment cannot accept software updates. Equipment controlling physical operations often stays in service for more than 20 years. Some cannot receive updates without risking outages, limiting how quickly operators can repair weaknesses.
Neuberger proposed requiring company chiefs to commit to removing control systems from direct internet access and demonstrating that essential operations can run manually for 72 hours. Companies would also contain critical weaknesses within an agreed deadline, using software fixes or other protections. Separating office networks from equipment controls and dividing networks by location would help contain breaches.
Under the proposal, the White House’s Super Intelligence Force would set national targets, while industry information-sharing centers would coordinate work and submit monthly progress measures. Company boards would attest to progress, with regulators accepting those attestations in place of duplicate audits. Larger operators would help smaller utilities, hospitals, banks and telecommunications carriers meet the targets.
The publication proposed a joint exercise within three to six months involving power companies, telecommunications providers, banks and hospitals. A later phase would build digital twins, software replicas of physical systems, to test fixes before applying them to operating equipment. AI laboratories would work with equipment manufacturers on those replicas.
The plan said legal protections would be needed because company chiefs would not authorize sensitive information sharing without them, and firms could face liability for weaknesses they discover. It proposed renewing the Cybersecurity Information Sharing Act of 2015 and considering time-limited liability protection. Progress would depend on how quickly operators contain flaws and whether essential services continue during attacks.
