The RSA Conference brings together security leaders, vendors, and practitioners from across the industry each year.
Public discussions focus on innovation, tooling, and emerging threats.
Private conversations focus on a different set of problems. Security leaders use the event to exchange practical insight on governance, risk, and how security programs operate under real constraints.
Those conversations shape how security programs evolve long after the event ends.
Five GRC themes are driving those conversations at RSAC 2026.
AI Governance is Becoming a Core Risk Discipline
Organizations have moved past the question of how to use AI. They now need to decide how to govern it.
Security teams deploy internal language models, copilots, and AI-driven applications across business units. These systems connect to sensitive data and influence operational decisions. Governance models have not kept pace.
CISOs are asking direct questions:
- Who owns AI risk across the organization
- Who approves AI use cases
- Who takes accountability for AI-driven decisions
AI introduces risks that extend beyond traditional application security. These systems generate unpredictable outputs, evolve over time, and operate across multiple business processes.
Data exposure remains a primary concern. Many AI systems connect to internal data sources, which increases the risk of leakage when teams misconfigure controls.
AI risk does not fit into a single category. It combines elements of application security, third-party risk, and data governance. Security leaders must coordinate across these domains to manage them effectively.
Third-Party Risk is Moving Beyond Compliance Artifacts
Organizations rely on large and complex vendor ecosystems. SaaS platforms, cloud providers, and software integrations support critical operations. Each vendor expands the attack surface.
Many security programs still rely on SOC 2 reports, ISO 27001 certifications, and security questionnaires. These tools provide insight into a vendor’s control environment, but they do not guarantee security.
Security leaders recognize this gap and are shifting their approach.
They are asking:
- How critical is this vendor to our operations
- What data does this vendor access
- What is the impact if this vendor is compromised
This shift drives changes in vendor risk management:
- Teams tier vendors based on business impact
- They increase review frequency for critical vendors
- They monitor vendor security posture continuously
Leading organizations also treat vendors as security partners. They share threat intelligence, coordinate incident response, and validate remediation efforts.
Compliance artifacts still play a role, but they no longer define the process. Organizations need continuous visibility into vendor risk, not point-in-time assurance.
Regulatory Pressure is Increasing, but Compliance Remains a Baseline
Cybersecurity regulation continues to expand across regions and industries. Organizations must address requirements from multiple frameworks simultaneously.
Examples include:
- AI-focused regulatory initiatives
- cyber disclosure requirements
- regional cybersecurity mandates
This growth increases operational complexity. Security teams must track overlapping requirements and demonstrate compliance across multiple domains.
The larger issue is how organizations interpret compliance.
Many teams treat frameworks as checklists. They implement controls to satisfy requirements rather than to reduce risk. This approach creates a gap between compliance status and actual security posture.
Compliance defines what controls should exist. It does not confirm that those controls operate effectively in a specific environment.
Security leaders are reframing this approach. They treat compliance as a baseline and focus on risk-based implementation.
They design controls around actual threats, business processes, and system dependencies. They use frameworks as guidance, not as the final objective.
Boards reinforce this shift. They expect cybersecurity reporting in business terms, not technical metrics. Security leaders must translate control effectiveness into operational and financial risk.
Identity is Becoming the Primary Security Control Layer
Traditional security models focused on networks and perimeter defenses. Modern environments no longer follow those boundaries.
Cloud infrastructure, distributed systems, and automated processes require a different control model. Identity now serves as the primary enforcement layer.
This shift includes a major increase in non-human identities:
- API keys
- service accounts
- machine identities
- automated workflows
In many environments, these identities outnumber human users. They often operate outside standard governance processes.
This creates several risks:
- lack of visibility into active identities
- accumulation of privileged access
- limited control over credential usage
Security teams must apply stronger governance to these identities.
That includes:
- enforcing least privilege access
- rotating credentials regularly
- monitoring identity activity
- maintaining clear ownership and accountability
Auditors are under increasing scrutiny in this area. They expect organizations to demonstrate control over privileged and machine identities, including access reviews and logging.
Identity governance now plays a central role in both security operations and assurance.
Cybersecurity is Evolving Into Enterprise Risk Governance
Cybersecurity no longer operates as a purely technical function. It now connects directly to enterprise risk management.
Organizations recognize that cyber incidents can impact:
- operations
- financial performance
- regulatory standing
- brand reputation
Boards want clear visibility into this exposure. They expect security leaders to communicate risk in business terms and support decision-making at the executive level.
This expectation is changing the role of the CISO.
Security leaders still need technical expertise, but they must also:
- understand enterprise risk frameworks
- align security priorities with business objectives
- provide clear, decision-focused reporting
Cybersecurity programs now support broader governance structures. They help organizations evaluate risk, allocate resources, and plan for long-term resilience.
The focus has shifted from protecting systems to managing digital risk across the enterprise.
What RSAC 2026 Signals for Security Leaders
RSAC 2026 reflects a broader shift in cybersecurity.
Security leaders are moving away from tool-focused discussions and focusing on governance, accountability, and risk management. These priorities now shape how organizations manage complex environments and respond to increasing expectations from regulators, customers, and boards.
Organizations must manage risk across AI systems, vendor ecosystems, identity, and regulatory requirements at the same time. That requires clear visibility into risk, structured governance, and effective assurance practices.
TrustNet works with organizations to assess security maturity, align controls with business risk, and support scalable compliance and assurance programs.
Learn more about TrustNet’s cybersecurity, risk, and compliance services or connect with our team to assess your current security posture.
Frequently Asked Questions
Security leaders at RSAC 2026 are focusing on AI governance, third-party risk management, regulatory pressure, identity security, and enterprise risk governance. These trends reflect how organizations are managing risk across more complex and distributed environments.
CISOs are managing risk across AI systems, vendor ecosystems, and regulatory requirements. They are looking to translate cybersecurity into business risk and align security programs with board-level expectations.
AI introduces new risks related to data exposure, accountability, and autonomous decision-making. Organizations must establish governance structures that address these risks across application security, vendor risk, and data governance.
Organizations rely on an expanding number of vendors that support critical operations. This increases the attack surface and requires continuous monitoring, vendor tiering, and deeper validation instead of periodic compliance reviews.
Compliance defines baseline expectations, but it does not guarantee control effectiveness. Organizations must implement controls based on actual risk to ensure that security measures work in practice.
Modern environments rely on identity to control access across cloud systems, applications, and services. The growth of non-human identities such as API keys and service accounts increases the need for governance, monitoring, and access control.
Organizations now treat cybersecurity as a business risk that affects operations, financial performance, and regulatory exposure. Security leaders must communicate risk in business terms and support enterprise decision-making.
Organizations should evaluate how they manage AI risk, vendor ecosystems, identity governance, and regulatory requirements. These areas are driving many of the practical discussions among security leaders at RSAC 2026.
