Every year, San Francisco’s RSA Conference acts as a useful time stamp for the state of the cybersecurity industry. It’s a time stamp to reflect on the past year and to predict and prepare what’s to come. Here’s my take this year.
For a trend comparison, here’s my report from last year.
Got feedback? Join the conversation on LinkedIn.
COOL: The show fulfills its function. It brings the cybersecurity community together.
This show still has the gravity to bring the entire cybersecurity community to a single location at a single time to share knowledge and advice. Any event that can do that will always be valuable.
COOL: Running into fans, old friends, and former co-workers
You saw everyone else’s photo dump. I won’t bore you with everyone I met. But here were a few choice impromptu meetings.
Leo Laporte, founder of TWiT.tv and co-host of Security Now podcast. We worked together at TechTV.
CISO Series superfan, Chris Fontaine, who went to Disneyworld wearing a t-shirt with my face on it
Chris Fontaine wearing a “David Spark” shirt at Epcot.
Andrew Aken, who has won more prizes on CISO Series than anyone else.
NOT-SO-COOL: Those “cooler than you” to not go
Every year, I hear a few people give an “I’m too cool for that” excuse for not attending. They offer up an “I’m thankfully not going” condescension that’s supposed to be met with an equal “Oh yes, I know”-level of agreement. Well, I don’t.
MUST WE? The discussion of the crowds
It is impossible to leave this conference without discussing the crowds. As if I’m spending any time counting. The show’s real test of success is not so much the initial crowds, but whether people are sticking around to the end. On the show’s second day, I saw plenty of activity on the show floor. This show has weight.
The line at registration on the first full day. It moved quickly.
COOL: Appearing on the Daily Tech News Show for the RSA wrap-up show
For as long as I’ve been attending the RSA Conference (I believe 15 years now), I’ve made it a point to also appear on Tom Merritt’s Daily Tech News Show to provide a wrap-up of the conference. It’s always a lot of fun, and this year we had Scam School host Brian Brushwood join us as well. Give the show a watch or listen as we delve into many of these topics.
NOT-SO-COOL: The Delve scandal and what it says about GRC
The week before RSA, news broke that Delve, a compliance vendor, was accused of fabricating data in its compliance reports, putting its existing customers at regulatory risk and exposing the businesses it’s trying to work with to risk. It became a conversation, though maybe not as loud as you’d expect given the timing.
This accusation teased out a larger story about the GRC (governance, risk, and compliance) vendor marketplace. GRC is, by far, the largest vendor category, according to Richard Stiennon of IT-Harvest. If you want to be in business and work with certain companies (ideally, enterprises), GRC is a requirement. And for years, the same complaints have persisted — third-party risk management is hard, point-in-time checks are insufficient, continuous monitoring is the right answer, but rarely the reality.
The GRC vendors who sell a “we’ll fill out your questionnaires faster” AI tool are simply solving a short-term problem. The whole process is still very broken.
Some were nonplussed by the Delve accusation. Ty Sbano, CISO at Webflow, said that letting audit requirements slide has been a trend for quite some time. And Mea Clift said this is the result of an industry that has built a reliance on checkboxing activities.
Ty Sbano, CISO, Webflow
“Businesses want it fast, and they want it easy, and there is no easy button for security. We’ve actually opened ourselves up to greater liability and greater risk by saying, ‘Hey, we’re going to check these boxes and do the minimum that we need to do’ when in reality we should be doing more governance like we’re supposed to,” said Clift.
NOT-SO-COOL: Making the “I guess we have to talk about AI” joke again and again and again
EVERY SESSION SAID THIS.
It’s annoying. It’s not funny. It’s not clever. Lose it. Move on.
COOL: AI usage is evolving as it should
We’re seeing the discussion of AI evolve. Two years ago at RSA, everyone was talking about generative AI: ask questions, get answers, create content. Last year, we were introduced to agentic AI, but there was apprehension. We weren’t sure if it was good enough. This year, we’re seeing how good it is. Attitudes are changing.
COOL for practitioners/NOT-SO-COOL for vendors: Homegrown AI-built solutions
If a security vendor used AI to build its tool, why couldn’t I use AI to build my own tool and avoid endless and exorbitant subscription fees?
During our recording of the CISO Series Podcast at BSidesSF, I asked my co-host, Mike Johnson, CISO of Rivian, and guest Sara Madden, CISO of Convera, if they’ve been offloading security tools with homegrown AI-built solutions, and the answer was a big fat “yes.”
(from L to R) David Spark, host of CISO Series, Mike Johnson, CISO, Rivian, and Sara Madden, CISO, Convera
As if all the direct competition and competition for mindshare weren’t enough, security vendors now have to compete with easy-to-create homegrown DIY solutions.
COOL: Aggressive AI usage is the competitive advantage
Companies that question or dabble in AI will be left in the dust. How can you use agentic AI to improve business processes and security? Don’t wait. Some already clearly see the value, and they’re not waiting. They’re spending a lot of money and time deploying AI agents, all in an effort to pull ahead of the competition.
COOL for some/NOT-SO-COOL for others: Monitoring AI token usage as the new micromanagement
For those companies that aggressively use agentic AI, token consumption has become the new metric for individual performance. The assumption is that if employees aren’t using enough tokens, they’re not being productive. I heard this from a venture capitalist who was using it to measure his own staff’s productivity. If they don’t use enough, then there will be a conversation.
On a recent episode of the All-In Podcast, Jensen Huang, CEO of NVIDIA, said if he’s paying an engineer $500K a year, they should be burning a quarter million in AI tokens annually. When I asked for his take on this, Rivian’s Johnson called that out for what it is, a clear financial incentive for NVIDIA to promote the ludicrously heavy use of AI.
Jensen Huangm, CEO, NIVIDIA on All-In Podcast
COOL/NOT-SO-COOL? The new definition of entry-level vs. “fragile experts”
We’re all well aware that the cybersecurity talent market is soft. That’s exacerbated by the many young people with degrees, certifications, and homegrown talent all eager to break in.
With AI proving it can do rudimentary and tier 1 cyber tasks, or tasks normally given to an intern or first-year employee, the question I repeatedly heard was, “What’s an entry-level job?”
I’d argue that the problem is going to flip. Those of us already in the industry should be worried about the young people who are becoming natively adept at agentic AI.
“AI isn’t going to take your job. Someone who knows AI very well is going to take your job,” said Jason Elrod, CISO at MultiCare Health System.
Jason Elrod, CISO, MultiCare Health System and David Spark, Host, CISO Series
This will give rise to “fragile experts,” said Elrod, or those people who are highly capable with AI tools but lack foundational knowledge. Will that foundational knowledge still be necessary? Will we need to learn coding like some of us learned Latin?
Once again, Jensen Huang, CEO of Nvidia, just says double down on AI education.
Another quote (and response) from Jensen Huang, CEO, NVIDIA
COOL: The rise of the AI artist
I’m a “meat and potatoes” video editor. I can do the basics. I have a limited artistic vision for video editing. But whenever I sit down with really talented video editors, I watch them implement edits and effects that never would have crossed my mind.
I’m seeing the same trend happening with AI. There will be those of us who learn to use the tool. And then there will be the artists who envision opportunities that never cross our minds. We’ll be dazzled by what they make the AI tool do.
COOL: More moments of AI epiphany
For those of us who have experienced a successful AI implementation, the result is an epiphany. We’re amazed with what we just did, and we’re eager to tell others.
Luckily, we’re receptive to hearing those stories about using AI to handle complex tasks. The reason we struggle to understand its far-reaching use is that AI tools can often complete tasks we would never consider because they would be too taxing for a human to do.
For AI usage to flourish, we will need more personal moments of AI epiphany, and we’ll need to share those moments with others. I liken it to the moment when accountants saw the first-ever spreadsheet, VisiCalc, in 1979. The moment of epiphany was watching how a single number change could recalculate an entire spreadsheet. This is something accountants had been doing by hand, and now they watched it being done in an instant. That moment of epiphany was tailored just for accountants.
Today, AI is proving that we can have these moments of epiphany everywhere. We just don’t all know what those are. To find out, we simply need more experimentation and more AI artists.
YIKES! 54 vendors in the AI SOC space
The Security Operations Center (SOC) is one area ripe for AI productivity. Too many alerts, too many actions, and too few people to manage it all.
As you might imagine, given the recent rise of agentic AI, we’ve also seen a rapid rise of agentic AI companies. A whopping 54 to date, according to one of the competitors.
When these tools first came to market, the pitch was simply: We’ll eliminate the tier-one grunt work so your analysts can focus on the hard stuff.
Now all 54 are saying the same thing.
It’s kind of like when the asset management category appeared. They all said (and are still saying) the same thing: You can’t secure what you don’t know.
The shakeout is coming. It has to. You can’t have 54 vendors chasing the same Fortune 1000 companies. Some are finding their differentiators and marketing those to set themselves apart.
But if you’re looking to buy now, make only a 1-year vendor commitment, as Rivian’s Johnson does. Three-year upfront deals are exactly what the vendor wants. But in this highly volatile market, buyers need to protect themselves. Look for an easy implementation and an easy exit should you need to rip and replace in 18 months.
NOT-SO-COOL: Color-coded BS
I’ve had it with vendors’ color-coded charts that show they’re all green and their competitors are a variety of yellow, red, and purple.
Wow, would you look at that? In the study they paid for, they came out on top against all their competitors. I’m convinced. Take all my money.
Quite the opposite. The pitch began by showing me this chart of the data categories their product could find and index, compared to their competitors (I couldn’t read the name of a single one). Their competitors were failing miserably across the board. According to these color-coded results, one way many competitors failed was that they couldn’t identify an email address. What? Can’t find an email address? I stopped his pitch and asked how this could be. He kind of just pushed it off, trying to convince me it was true, and continued on with his pitch.
At that point, I knew nothing that came out of his mouth could be believed.
NOT-SO-COOL: Read the room… and ask some questions
You meet someone at an event. They launch into a pitch about whatever it is they’re selling or working on, and it makes no sense, and you’re just waiting for them to just stop talking so you can walk away.
This phenomenon is known as the curse of knowledge. It’s the affliction of people who are so in their own head that they just assume everyone’s thinking about whatever genius project they’re working on, and we’re all dying to hear more. They provide no context, and they don’t gauge their audience’s interest.
Break away from the curse of knowledge by asking questions first so you can determine interest and comprehension of the issue.
REALITY: Platform players have gross advantages over startups
There’s a huge discrepancy between the big cybersecurity platform vendors and everyone else. The top 12 cybersecurity vendors account for 53 percent of all cybersecurity spending (Source: 2024 Canalys Cybersecurity Marketing Pulse). That means, the other 4,500 security vendors out there (according to IT Harvest) are fighting over the remaining 47 percent.
CrowdStrike booth at RSA 2026
The top 12 include well-known vendors (e.g., Palo Alto Networks, Fortinet, Microsoft, Cisco, CrowdStrike) that have a suite of products. Those big players have advantages that startups simply can’t match. They can afford a longer sales cycle. They have larger budgets. And given they have a suite of products, they can use loss leaders or a single product differentiator to rope in a customer. Once they’re in as a customer, even if at a low level, it becomes far easier to upsell other solutions within their platform.
Startups usually have only one product and face intense pressure from investors and the board to show results every quarter. That pressure gets pushed down to the salesperson, who inevitably grows worried about job security. They may resort to aggressive tactics that are not in the company’s best interest. This is what makes the startup sales process fundamentally different and much harder. As platform players continue to acquire startups that win category battles, this gap will widen.
REALITY: Don’t get your hopes up
If 5 percent of the people who told me they were going to do something actually followed through, I’d be 10 times more successful.
RSA is exciting. It’s a spectacle. People get caught up in it; they feel optimistic and say yes to everything. It’s not because they’re dishonest, but because it’s genuinely hard to say no at a cocktail party when you’re laughing and having a good time.
I ran into a first-timer who asked me for advice. I told him, “Don’t get your hopes up.” Don’t assume that everyone who said they’d do something will actually do it. In a show dominated by AI talk, the most persistent human element is that enthusiasm is easy to sell in person, and easy to quietly walk back in an email.
Capture their information. Send the follow-up. But calibrate your expectations accordingly.
COOL: Real guerrilla marketing
Advertising at RSA is really expensive. I saw a couple of examples of real grassroots advertising that cost close to nothing.
One vendor plastered posters on utility boxes and other locations across the city.
Guerrilla marketing from dlptest.io
Another vendor left Onion-like newspapers with funny headlines.
As big a spectacle as RSA is, sometimes the quieter, simpler tactics can deliver targeted and memorable impact.
NOT-SO-COOL: No one is dancing. Turn the music down.
Except for a few headlining bands (e.g., Kings of Leon at Thoma Bravo party), the purpose of every single RSA party is conversation.
Read the room. If people are trying to talk, let them talk. Tell your DJ to turn the music down so people can talk. We don’t give a rat’s ass what your next song is. All we really need is ambient music, nothing else.
NOT-SO-COOL: Negative attitude
If you had a bad time at the conference, then that’s on you. There is so much going on at this event, with so many opportunities for learning and conversation with friendly people, plus lots of free food and drink, that it’s impossible not to have a good time. Don’t blame the event for your bad time. People worked very hard to entertain complete strangers.
COOL: Welcome to the club
Every time I meet a cybersecurity startup founder who says, “We’re just trying to meet CISOs and get our name out there,” I simply respond, “Welcome to the club.”
That is literally what everyone is trying to do at RSA and in security in general. The show floor is awash with companies screaming, “Look at me!” in every conceivable way.
I get it, it’s tough to be a cybersecurity entrepreneur. But this is what you’ve walked into. Your competition is not those in your category. It’s every other cyber vendor trying to grab mindshare from your potential customers.
Embrace the reality and figure out ways to “hack” the process of marketing and selling. There is no one way. There is no one perfect email. There is no one perfect event. There is no one perfect pitch.
It’s all about relationships. This industry is built on trust, and RSA is another touchpoint where you can build that trust. In fact, at CISO Series, we’re promoting an entire month of Super Cyber Friday shows all about trust. Just us each and every Friday in April 2026 for another discussion on trust. Register for the entire series right here.
I’ve been attending this event for 15 years. This event is an opportunity to watch the industry’s evolution. Those 54 AI SOC vendors? Three years ago, they didn’t exist. And this is true for many other categories as well. There’s a reason to be here.
And yes, it is cool to attend, and to be completely exhausted when you leave.