Anne Neuberger, a partner and head of global affairs at Andreessen Horowitz (a16z), has outlined a national plan for using artificial intelligence to defend the systems that keep American power grids, payment networks, water plants, telecom lines and hospitals running.
Neuberger, who previously served as US Deputy National Security Advisor for Cyber and Emerging Technologies, presented the framework in The Wall Street Journal. A translated summary of the proposal was published by KuCoin, based on a compilation by TechFlow.
Her central argument is that AI is compressing the gap between when a software flaw is found and when attackers exploit it, while much of the nation's industrial equipment cannot be updated anywhere near that quickly.
Why Legacy Infrastructure Is Falling Behind
Operational technology, the systems that directly control physical machinery, often stays in service for more than 20 years. Patching some of these systems can force downtime, which makes rapid updates risky or impractical.
Neuberger argues that existing regulation was not built for this threat. Current rules lean on fixed patch windows and compliance checklists, measuring whether controls exist on paper rather than how exposed a system really is or how fast risks are reduced.
Her view is that defenders working at human speed will lose a race against attackers equipped with AI. The same technology, she contends, can help defenders locate exposed systems, rank targets by importance and generate fixes.
Focusing on a Few Hundred Critical Operators
Rather than attempting to replace aging equipment across the country, the plan targets the several hundred operators and shared suppliers whose failure could set off nationwide cascading outages. The goal is to contain that risk within six months.
Examples cited include large transmission substations, the Fedwire, ACH and CHIPS payment systems, water systems serving 50,000 or more residents, core telecom networks and 911 services, regional trauma centers and electronic health records providers.
Neuberger notes that full replacement of unsupported legacy equipment could take two to five years and carry substantial cost, which is why immediate containment is prioritized. Smaller operators still matter, she acknowledges, but protecting the most critical few buys time to address the rest.
A CEO-Led Governance Model
Under the proposal, the White House's superintelligence unit would set national objectives and convene a committee of chief executives from key industries. Each CEO would sign commitments to sector-specific goals.
Those goals include eliminating internet exposure of control systems, passing a drill showing the organization can operate manually for 72 hours without IT systems, and containing critical vulnerabilities within set timeframes through patches or compensating controls.
Existing Information Sharing and Analysis Centers (ISACs), set up about two decades ago, would be turned into AI-driven execution engines that submit monthly, anonymized industry scorecards. Neuberger points out that electricity and financial services ISACs already have CEO-level involvement, while water, telecom and hospital sectors do not.
How AI Would Be Put to Work
AI labs and technology firms would scan operator code and firmware for flaws and produce fixes. For systems that cannot be patched, AI would generate alternatives such as firewall rules, monitoring alerts or configuration changes.
These mitigations would be tested on digital twins, virtual replicas of real equipment, before deployment. Building such replicas of shared systems is described as a second phase of the work.
Other measures include network segmentation, one-way data connections out of the most sensitive control networks, offline backups, and subsidized AI security monitoring for small water systems, rural hospitals and electric cooperatives. AI tools would have read-only network access by default, with any changes requiring human approval.
Legal Protections and Supplier Accountability
Neuberger warns that without legal cover, executives will not authorize sharing sensitive data. She calls for reauthorizing the Cybersecurity Information Sharing Act of 2015 and creating time-limited liability protection for companies that disclose vulnerabilities they discover.
The plan also proposes safe harbor protections for firms that meet outcome-based goals with board certification. Equipment makers, many of them foreign, would need to address identified flaws within set periods as a condition of selling to critical operators.
Large organizations would be expected to support smaller ones, with major utilities, health systems, banks and national carriers backing cooperatives, rural hospitals, community banks and rural operators.
What the Proposal Signals for Industry
The framework places major cloud providers such as Microsoft, AWS and Google, along with leading AI labs, at the center of national cyber defense. For security startups and AI vendors, that points to growing demand for tools that detect vulnerabilities and generate compensating controls at machine speed.
For operators, the shift from paperwork-based compliance toward measurable outcomes could change how cybersecurity performance is judged. Whether the plan advances will depend on government action and industry willingness to commit at the executive level.
Source: KuCoin
