What to Expect at RSAC 2026: AI Everywhere, Zero Trust in Action

When I first started going to RSAC more than 20 years ago, I would walk the show floor aisle by aisle, trying to see everything.  

As an analyst at Forrester, my job was to research vendors, evaluate products, and understand where the market was going. RSAC was the best place to do that.

Today, things have changed. You can now research vendors and compare products online. You don’t need a conference for that anymore.

But what you can’t replicate is the connections and conversations that happen at RSAC. It’s where the cybersecurity industry comes together to reconnect, challenge ideas, and figure out what actually matters.

Here’s what I expect those conversations to focus on this year.

AI will be everywhere — again

AI will dominate RSAC again this year. But remind yourself that AI doesn’t automatically equal value.

The industry has a long history of hype, and AI is the latest example. If someone tells you they have an AI-powered solution, the right response is to ask what problem it solves and how it improves outcomes.

The fact is that there will still be vendors this year using AI to attract attention rather than deliver results.

That doesn’t mean AI isn’t important. Many companies are driving real change with their AI solutions. AI is being used to analyze data, identify patterns, and make connections at speeds humans can’t.  

Used correctly, it becomes a powerful advantage against adversaries. But we’re still early. I recently wrote the foreword for Agentic AI + Zero Trust: A Guide for Business Leaders by Josh Woodruff and Michelle Savage, and one of the key themes is exactly this tension.  

We’re building and deploying AI at speed, but we’re still learning how to secure it in real environments. That gap is going to show up in a lot of conversations at RSAC this year. You’ll hear confident opinions, but many of them are still educated guesses.

So, your goal shouldn’t be to avoid AI but to challenge it, pressure-test it, and focus only on what delivers real outcomes. Walk into RSAC with an equal sense of skepticism and curiosity about the AI tools you’ll inevitably encounter.

Zero Trust conversations are moving from “why” to “when”

There’s a tendency to think every new technology requires a new strategy. It doesn’t, especially in terms of Zero Trust.  

Zero Trust isn’t evolving. It doesn’t need to. It’s a strategy based on removing trust from digital systems and controlling how those systems interact and communicate. That foundation holds, no matter what comes next — including AI.  

But what AI is changing is the urgency around implementing Zero Trust. I expect that will be a major topic of conversation at RSAC this year.

The skepticism is gone. Organizations aren’t asking why anymore. They’re asking how fast they can get started with Zero Trust and what it takes to make it real.

As organizations deploy AI systems, especially internal models and proprietary LLMs, the questions become practical. What data is flowing in? What’s allowed to communicate? What happens if something is exposed?

Those are traffic flow problems solved with core Zero Trust principles, including visibility and segmentation.

So listen closely to how people talk about Zero Trust at this year’s event. Are they focused on real implementation, or are they still speaking in abstractions?

Find the people who can tell you what they’ve actually implemented and what changed because of it.

How to get real value from RSAC

In my opinion, the real value of RSAC is in the in-between moments. I’m looking forward to catching up with old friends and having unexpected conversations that lead to new ideas.

The cyber industry is highly technical, and many people work in isolation. RSAC is one of the few times where the industry gets together in person to have real discussions.

Those discussions are where the value is. It’s where you hear what’s actually working, what isn’t, and what people are dealing with right now.

So don’t try to see everything. You won’t.

Pick a few speaking sessions that are relevant to you, spend time at the booths where you can have genuine conversations, go to a few parties, and introduce yourself to new people. Use these experiences as starting points.

This is a welcoming community that feeds on collaboration.  

Want to see me at RSAC this year? Attend my speaking sessions and join me at booth N-5670.