RSAC 2026 Deep Dive: AI Security and Community Collaboration Reshape Enterprise Security Strategy

Introduction

At RSAC 2026, held from March 23 to 26, 2026, in San Francisco, the theme "The Power of Community" not only echoed the cybersecurity industry's long-standing pursuit of collaboration, but also, against the backdrop of rapid AI proliferation, provided new strategic coordinates for enterprise security decision-makers. The conference attracted more than 44,000 attendees, over 700 vendors, and more than 600 exhibitors, with in-depth discussions on topics such as AI security, agentic AI, and identity security. For enterprises, the signal from RSAC 2026 is clear and urgent: AI is reshaping every facet of attack and defense, and community collaboration will become a key moat in navigating uncertainty.

Event Overview: Industry Trends at RSAC 2026

RSAC 2026 marks the 35th anniversary of the conference, with the theme centered on "The Power of Community." In a technology environment where AI is everywhere, the conference emphasized the role of people—relationship building, strategic collaboration, and a unified defense line. During the event, media under Informa TechTarget, including SearchSecurity, Dark Reading, and Cybersecurity Dive, provided comprehensive coverage spanning areas from security operations to threat intelligence, and from policy discussions to the Innovation Sandbox.

Notably, agentic AI became the absolute focus at this year's conference. Numerous discussions centered on the proliferation of end-user AI agents, the spread of shadow AI, and the resulting security risks. Meanwhile, traditional topics such as identity security, cloud security, and ransomware defense were re-examined within the AI context. In addition, the absence of the U.S. government became a controversial topic both on and off the conference floor, while the active participation of EU representatives highlighted shifts in the global cybersecurity governance landscape.

Technology and Risk Analysis: AI-Driven New Attack Surfaces

Agentic AI: The Invisible New Frontier

At RSAC 2026, security experts widely noted that end-user AI agents have entered enterprise environments but often remain "invisible." Employees use personal AI tools for work-related tasks, creating shadow AI that leaves corporate assets and data exposed in unregulated environments. Agentic AI excels at executing complex tasks, but its autonomy also introduces unpredictable behavior. For example, AI agents may be induced to carry out operations beyond what was intended, or move laterally across internal corporate networks, becoming a springboard for attackers.

A case shared by Exabeam at the conference showed that a North Korean threat actor disguised as an American technician used generative AI to infiltrate a corporate network, but was ultimately detected by an agentic AI system based on UEBA (User and Entity Behavior Analytics). This illustrates both the cunning of AI-driven attacks and the potential of AI-powered defense. However, as more enterprises deploy AI agents, how to monitor and govern these "digital employees" has become an entirely new technical challenge.### SANS Top Five Attack Techniques: AI Everywhere

The SANS Institute's list of the "most dangerous new attack techniques" is for the first time entirely AI-related, including using AI to generate lures, automated vulnerability exploitation, intelligent social engineering attacks, and more. This means that AI is not only used for defense but has also become a weapon for attackers. Low-skilled hackers can achieve higher attack efficiency with AI tools, significantly lowering the barrier to entry. At the same time, although AI coding tools have accelerated development, they have also introduced new security vulnerabilities and weakened the effectiveness of traditional endpoint defenses.

Identity Security and the CVE Crisis: Foundational Issues Surface

In identity security, Omdia analysts point out that enterprises are evolving from traditional identity management to identity security posture management (ISPM). With the proliferation of workloads and AI agents, identity has become the new perimeter. However, the CVE project, as the cornerstone of global vulnerability coordination, is facing a funding crisis and uncertainty brought by AI, which could shake the entire vulnerability management ecosystem.

Enterprise Impact Analysis: Risks and Opportunities Coexist

Operational Risk: Dual Pressure on Endpoints and Identity

AI coding tools allow developers to produce code quickly, but they also introduce a large number of potential defects, breaking through endpoint security boundaries. Meanwhile, the proliferation of AI agents means traditional endpoint detection and response (EDR) may lose effectiveness. Enterprises need to re-examine their security architecture and incorporate identity security, endpoint security, and data security into a unified strategy.

Financial Risk: Budget Allocation Requires Caution

Multiple experts warned that enterprises should not over-allocate budgets to new AI toys while neglecting existing foundational defenses. Ransomware attacks remain rampant, and the rise of cyber insurance has even been questioned for stimulating ransomware behavior. Enterprises need to rationally evaluate the ROI of AI investments and ensure existing security controls do not fall behind.

Compliance Risk: Privacy Labels and Data Governance

Research at the conference indicated that privacy labels on mobile applications are inconsistent and cannot effectively inform users about data usage. As global privacy regulations become increasingly stringent, data compliance in AI applications will become a regulatory focus. In addition, the absence of the U.S. government at RSAC has allowed the EU to dominate security policy discussions, so enterprises need to pay attention to regulatory differences between the U.S. and Europe.

Brand and Trust Risk: Collateral Damage of Public Attribution

Multiple discussions noted that publicly blaming attackers can have negative brand, legal, and insurance repercussions. Enterprises should weigh the pros and cons when conducting cyber attribution and avoid hasty statements.

Industry Trend Watch: Community Collaboration as Security "Immunity" RSAC 2026's theme, "The Power of Community," is no empty slogan. As AI accelerates the transformation of the threat landscape, information sharing and collaboration have become the most valuable defense mechanisms. Organizations such as ISACs (Information Sharing and Analysis Centers) are exploring the use of AI in threat intelligence sharing while maintaining member trust. Experts recommend establishing a "near-miss" database to encourage companies to share attacks that almost occurred, thereby raising the overall level of defense.

Another trend is the consolidation of cybersecurity platforms. More and more vendors claim to offer unified platforms, but actual capabilities vary widely. CISOs need to be discerning and avoid being misled by marketing hype.

Defense and Response Recommendations

Enterprise Level: Building an AI Security Governance Framework

• Create an AI application inventory: take stock of all AI tools used by employees and identify shadow AI.
• Implement AI identity management: assign least-privilege identities to AI agents and incorporate them into identity governance processes.
• Develop AI usage policies: define the boundaries of employee use of AI in work scenarios and strengthen training.

Technical Level: Upgrading Security Monitoring and Response

• Deploy next-generation SIEM/XDR: use AI to enhance threat detection and ensure monitoring of AI agent behavior.
• Strengthen endpoint security: in the era of AI-assisted coding, adopt runtime protection and vulnerability management to address security gaps in the development phase.
• Apply zero trust principles: enforce continuous verification for all access requests, whether from humans or AI.

Management Level: Strengthening Collaboration and Drills

• Establish threat intelligence sharing mechanisms: participate in industry ISACs and exchange indicators of compromise.
• Conduct regular red team exercises: pay attention to legal boundaries and ensure exercises are lawful and compliant.
• Develop AI incident response plans: simulate scenarios involving internal risks or data breaches caused by AI.

For Critical Infrastructure: Prioritizing Ransomware Drills

Critical infrastructure enterprises such as healthcare and manufacturing should prioritize ransomware simulation drills and develop contingency plans for both short-term and long-term downtime. Vehicle owners and connected vehicle manufacturers should also stay informed about the latest trends in automotive cybersecurity.

SecurityPost Insight

The core message of RSAC 2026 is that AI has permeated every corner of the security field, but the key to addressing AI risks still lies with people. Community collaboration is not only the conference theme but also a necessary condition for enterprises to survive in the AI era. We see agentic AI and shadow AI blurring the boundaries of trust, while the dilemmas in identity security and endpoint security remind us that foundational security cannot be neglected in the pursuit of new technologies. At the same time, the CVE project crisis and the absence of the U.S. government have exposed the fragility of global cyber governance. Enterprises need to participate more proactively in industry collaboration and prepare for the impact of policy changes.In the future, we expect AI security to move toward platform-based and ecosystem-oriented development. Enterprise security leaders should prioritize how to integrate AI capabilities into existing architectures while strengthening human-AI collaboration mechanisms. Security is no longer an island, but a defense line jointly built by community, technology, and institutions.