Another RSAC, this time with a view from a different seat.
After many years as a sitting CISO, including some of the most closely watched moments of my career, I am now focused on supporting the broader CISO community and helping founders build what security leaders actually need. RSAC 2026 was a good place to test where the industry really is.
On the surface, the story was familiar: AI everywhere, big announcements, crowded expo halls. But if you spent time in the hallways, small rooms, and side events, a deeper picture emerged.
Here are six things I am taking away from this year’s conference.
Takeaway 1: Community is Still the Anchor
Underneath all the noise, the most important thing at RSAC was still the CISO community itself. You could see it in hallway conversations, small breakfasts, and late-night catchups between people who have been in the trenches together for years.
The best conversations were not about products. They were about what it means to lead in this moment, how to support teams that are stretched thin, and how to keep going personally when the stakes keep rising.
For all the talk about AI and automation, security still runs on trust, shared experience, and relationships that last longer than any single role.
Takeaway 2: AI is Making Human Risk Easier to See
AI themes were everywhere, but the most interesting work was not just about speeding up analysts or generating reports. It was about making human risk more visible and more contextual.
Instead of vague notions of “insider threats” or “human error,” we are starting to see tools that can surface patterns of behavior, decision-making, and friction points that actually drive risk. That is a step toward security that understands how people really work, not how policies say they should work.
We are still early, and there is a real risk of over-promising. But the direction is encouraging: using AI to illuminate the human side of security, not just to add more dashboards.
Takeaway 3: In an AI World, Security Still Has to Work
Even as AI reshapes how we build and operate systems, fundamentals still matter. Controls have to deploy cleanly. Integrations have to work in messy real environments. Teams have to be able to run these systems on a Tuesday afternoon when something breaks.
Many CISOs I spoke with were less interested in “AI-powered” and more interested in “will this actually reduce risk without blowing up my operations.” Reliability, clarity of value, and operational fit matter more than ever.
Innovation is welcome. Unnecessary complexity is not.
Takeaway 4: Geopolitical Uncertainty is Now Part of Everyday Risk Management
Geopolitics used to be a special topic that showed up in specific briefings or crisis moments. Now it is part of the daily background of risk for global organizations.
Conversations at RSAC reflected that shift. CISOs are thinking more about:
- Exposure to different jurisdictions and legal regimes
- Supply chain dependencies that cross borders
- How fast a regional conflict can turn into a business-wide disruption
This is not about fear. It is about accepting that geopolitical change is now a standing input into security strategy, not an occasional exception.
Takeaway 5: The CISO Role Keeps Expanding, and Support Has to Keep Up
The CISO job description continues to stretch. Security leaders are now expected to cover technical risk, business resilience, brand impact, regulatory exposure, and more.
What stood out at RSAC was how many CISOs talked about the emotional and organizational load of that expansion. It is not just more work. It is more weight.
If the role is going to keep expanding, support has to expand with it: better alignment with boards and executives, more realistic expectations, stronger peer networks, and tools that actually remove work instead of adding it.
Takeaway 6: From Conference Week to What We Build Next
Conferences are snapshots. What matters is what we do with the energy and insight once everyone goes home.
For me, RSAC 2026 reinforced three priorities:
- Stay anchored in the lived reality of CISOs and their teams
- Treat AI as a tool to clarify and reduce risk, not as an end in itself
- Build and back solutions that make security leaders feel more supported, not more alone
If we can carry those principles forward, then the conversations in the hallways this year will show up as real progress in the tools we build and the practices we adopt before the next RSAC comes around.
CISO in Residence
