Anne Neuberger Proposes AI-Driven Cybersecurity Plan for U.S. Critical Infrastructure - KuCoin
Anne Neuberger, a16z partner and former US Deputy National Security Advisor, has proposed an AI-driven cybersecurity defense framework to protect US critical infrastructure from increasingly rapid cyber threats.
AI is drastically shortening the time window between the discovery and exploitation of software vulnerabilities, while many operational technology systems running physical devices in US critical infrastructure—such as power, banking payments, water supply, telecommunications, and hospitals—have been in service for over 20 years and cannot be patched at this speed. Neuberger's proposal aims to address this critical gap through a comprehensive defense framework.
AI is continuously shrinking the time between vulnerability discovery and exploitation. Defenders still responding at human speed will inevitably lose this race.
Concentrated Risks
The core logic of Neuberger's plan is not to fully replace outdated equipment, but to first identify hundreds of critical operators and shared suppliers whose failure would trigger nationwide cascading effects. These include large transmission substations, payment systems, water infrastructure serving major cities, core telecommunications networks and 911 systems, regional trauma centers, and health records providers.
The plan aims to contain risk within six months through network isolation, 72-hour manual operation drills, and AI-driven compensatory protective measures. Small operators are also recognized as important weak points in the defense system.
Governance Structure
Drawing on her experience as former US Deputy National Security Advisor for Cyber and Emerging Technologies, Neuberger outlines a new model for advancing national cyber resilience. The framework would report to the White House Super Intelligence Force and be led by CEOs of US core enterprises responsible for critical infrastructure operations.
The White House Superintelligence Unit would establish a CEO committee responsible for overall effectiveness. Each industry's Information Sharing and Analysis Center (ISAC) would be transformed into an AI-driven execution engine, delivering outcomes to designated regulatory bodies. This public-private initiative would engage leading companies across industries to clarify their responsibilities.
Implementation Strategy
The plan focuses on five major industries: power, banking and payments, water supply, communications, and healthcare hospitals. Its technical core involves using AI to detect vulnerabilities at machine speed and generate tested alternative protection solutions, eliminating internet exposure of control systems, implementing network segmentation, and verifying 72-hour manual operation capability.
The second phase involves building digital replicas ("digital twins") of critical shared systems across various industries to enable regular testing. The plan also calls for clarifying nationwide scalable defense capabilities that telecommunications operators, infrastructure-as-a-service providers, and cloud network services can offer, along with necessary legal protections.
Potential legal amendments include providing liability protection for information sharing and establishing "safe harbor" mechanisms for participating companies pursuing outcome-based objectives. Success metrics would be based on how quickly vulnerabilities are contained and whether core services can continue operating during an attack.
Related
