You open your refrigerator for some breakfast, but it's over 120 degrees in there and all your food is spoiled. It happened in hundreds of supermarkets across France last month. Commercial refrigerators began to warm up, some gradually, others quickly, thanks to the defrost cycle. Food spoiled and at least 15 fires started. As of early November, grocery stores in nine other European countries had also been attacked.
This was a cyberattack, attributed to Iran by French intelligence. Internet-connected controllers keep grocery-store freezers as well as blood supplies, military stores and medications cold across America. Similar controllers run pumps, valves and substations in our nation's water systems and energy grids. Vulnerable critical services are hiding in plain sight.
Many attacks are basic, exploiting devices connected to the internet with default passwords and weak controls. What is changing is speed. In October, artificial-intelligence tools uncovered a critical flaw hidden for years in the programming language that runs roughly 70% of the world's websites. Patches followed, but word leaked and attackers moved in. Sites went dark while their owners scrambled.
That is the countdown clock. AI is shrinking the time between when a weakness is found and when attackers can exploit it. Defenders who still work at human speed will lose that race.
The same AI can work in defenders' favor: finding exposed systems, ranking which matter most, and writing a fix. For old equipment that can't be patched, AI can create workarounds, such as a firewall rule or a settings change. The question is whether defenders can apply AI fast enough.
The most significant national risk is concentrated, fortunately. Failures that would cascade across the country run through a few hundred operators and their shared vendors: large transmission substations, the Fedwire and ACH payment systems, water utilities serving big cities, core telecom networks and 911 systems, regional trauma centers and the health-record vendors. Smaller operators matter too, often as soft entry points, but protecting the critical few first buys time to fix the rest.
But America's defenses aren't organized for this threat. Most regulation checks whether a control exists, not how exposed a system is or how fast an operator can contain a flaw. Hospitals are required only to patch systems known to be vulnerable in a "timely" manner. Oversight is split among regulators from the Federal Energy Regulatory Commission and the Environmental Protection Agency to the Federal Communications Commission and the Department of Health and Human Services, with varying standards. Nobody is accountable for whether an entire sector is safe. Some sectors are further along. Financial services and electricity have CEOs engaged with AI-enabled cyber threats; others lag. Efforts such as the Alliance for Critical Infrastructure, chaired by JPMorgan Chase CEO Jamie Dimon, show that corporate leaders are ready to organize to secure their sectors.
Much more can be done. The White House's Super Intelligence Force should set national targets for five sectors: power, banking and payments, water, telecom, and hospitals. The targets should measure outcomes, not paperwork. No control systems should be exposed to the internet. Critical vulnerabilities must be patched or walled off within days. Drills must be run that prove each critical operator -- utility, payment clearinghouse, hospital network -- can run for 72 hours without its IT systems. Each sector's regulator should adopt the same targets. One or two CEOs from each sector should report progress to the White House. Operators that hit their targets should earn legal protections from challenges alleging that they were negligent in protecting their systems; those that miss them should face closer scrutiny from regulators.
Put public-private partnerships to work. Information Sharing and Analysis Centers, which date to the late 1990s, and Sector Coordinating Councils, created after 9/11, connect operators with the government, mainly passing along threat alerts. They should become engines for preparedness: running shared AI tools to scan members for exposure, pressing vendors on flaws that may affect a whole sector, organizing mutual aid, and producing monthly scorecards that show CEOs how their companies compare with peers.
Next, use AI to fix flaws fast. Operators and technology suppliers whose failure would cause the greatest disruption should be required to work in partnership with AI labs to scan their code and firmware and produce fixes and workarounds. AI labs should work with makers of industrial control systems to build digital twins of standard equipment, so fixes can be tested before they touch a live grid or water plant. Findings should flow through Gold Eagle, the administration's new AI-enabled vulnerability clearinghouse, which should expand from software into industrial equipment. Equipment makers, many of them foreign, should have to act on findings by a deadline as a condition for selling to critical operators. Success should be measured by how quickly flaws are contained and whether essential services can keep running under attack.
Finally, cloud providers, telecom companies and AI labs should identify defenses that can work nationwide. Appropriate legal frameworks will be needed to protect participating companies. They can also establish a reserve corps of vetted responders for major incidents.
Smaller operators can't be left behind. Rural hospitals, electric co-ops and small water systems are often the easiest way into larger networks, and most can't afford their own security. This is a place where nonprofits can help. Andreessen Horowitz, where I work, recently launched the Securing America's Infrastructure Foundation, which is starting with a focus on rural hospitals.
None of this happens unless Washington clears the way. CEOs won't share sensitive data or hunt for vulnerabilities without legal cover. The Cybersecurity Information Sharing Act of 2015 provides cover, but it expires Dec. 11. Congress should keep the 10-year reauthorization now in the House defense bill. Regulators should offer a safe harbor to companies that meet the outcome targets with board sign-off. Money is needed for utility rate recovery for replacing old equipment that can't be secured and revolving loans funds for water systems.
From my experience managing responses to attacks on dated infrastructure, replacing outdated equipment will take two to five years. Containing risk at the few hundred most critical operators can be done within 12 months. That's why containment comes first.
We already know what an AI-speed attack on American infrastructure would look like: an automated agent scanning for exposed infrastructure, writing an exploit for each controller and hitting thousands of sites overnight. Next time it won't be freezers. It will be pumps, breakers and hospital systems. We have the tools to prevent it. Let's get to work.
---
Ms. Neuberger is a general partner and head of global affairs at Andreessen Horowitz and a distinguished fellow at Stanford. She served as the White House's deputy national security adviser for cyber and emerging technology, 2021-25.
(END)