Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalliTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
RSA Conference 2026 took place March 23–26 at San Francisco’s Moscone Center. The five priorities below come from David Gee’s CSO Online framework, not an official RSAC ranking; they are best read as a practical agenda for CISOs planning future conferences and security programs.
RSAC’s own preview highlighted MCP, agentic AI, vibe coding, identity, governance, burnout and partnerships (RSAC, January 6, 2026). Its January topic update ranked governance, risk and compliance (GRC) first, with AI and machine-learning security topics also prominent (RSAC, January 21, 2026). That context reinforces Gee’s choices without proving that every organization should fund them in the same order.
1. Secure the AI stack
Gee’s first priority is the security of the systems that build, retrieve and serve AI outputs. A production AI stack can include retrieval-augmented-generation (RAG) workflows, document stores, vector databases, model APIs, orchestration code and data pipelines. Each layer can expose sensitive data or alter model behavior.
Gee identifies prompt injection, training-data poisoning and model-inversion attacks as concerns. Those are risk categories in his assessment, not reports of a demonstrated attack against one named system (Gee, CSO Online, 2026).
#1 Best Overall
Questions for a CISO
- Can security teams inventory every model, API, agent, vector store and retrieval source in use?
- Are data flows mapped from ingestion through embedding, retrieval, prompt construction, inference and logging?
- Are untrusted instructions separated from system prompts and privileged tools?
- Can the organization detect poisoned training or retrieval data and investigate anomalous model behavior?
- Are model-provider permissions, secrets, logging and retention reviewed like other production dependencies?
The useful deliverable is an AI asset and data-flow register tied to owners, trust boundaries and incident playbooks—not a generic promise that a model is “secure.”
2. Set AI governance and policy
Security controls cannot answer who may deploy an AI system, what data it may process, or who accepts the resulting risk. Gee’s second priority is a defensible governance process covering accountability, approval, monitoring and policy. He discusses the EU AI Act, but the available material does not establish a complete legal analysis or a universal compliance deadline; organizations should obtain jurisdiction-specific legal advice.
Minimum governance decisions
- Ownership: Name a business owner, technical owner and accountable risk approver for each material use case.
- Data boundaries: Define prohibited data, retention limits, tenant settings and approved model providers.
- Risk tiering: Require stronger testing, documentation and human review as impact and autonomy increase.
- Change control: Reassess models, prompts, tools and retrieval sources when they change, not only at initial launch.
- Evidence: Keep approvals, evaluations, incidents, exceptions and retirement decisions auditable.
This turns AI policy from a static acceptable-use document into an operating system for decisions.
3. Govern non-human identities
AI agents, autonomous bots and service accounts can authenticate, call tools and change systems without a person present. Gee argues that these identities routinely outnumber human identities; treat that as his assertion rather than a universally measured ratio. RSAC independently emphasized both human and machine identity in cloud-native and AI-enabled environments (RSAC preview).
The operational problem is ownership and lifecycle: an unattended credential may survive the application, employee or project that created it, while excessive privileges let an agent turn a local error into a broad incident.
Controls to put in place
- Maintain an inventory of service accounts, workloads, agents, API keys, certificates and delegated tokens.
- Assign a human owner, business purpose, environment and expiration or review date to every identity.
- Use short-lived, scoped credentials and workload identity federation where supported.
- Separate read, write and administrative permissions; require step-up approval for high-impact actions.
- Log identity-to-tool activity and alert on unusual paths, privilege changes and dormant credentials.
- Automate joiner, mover and leaver processes for machines as well as employees.
The 2026 RSA ID IQ Report surveyed 2,120 professionals across cybersecurity, IAM and IT. It reported that 69% of organizations had experienced an identity-related breach in the prior three years, 90% still used passwords as their primary authentication method, and 75% reported difficulty moving to passwordless authentication. These are vendor-published survey findings, not independently audited industry rates (RSA, 2026 RSA ID IQ Report).
Rank #3
4. Address shadow AI and vibe coding
Unsanctioned generative-AI use creates visibility and data-handling gaps: staff may paste confidential material into an unapproved service, create unmanaged agents or rely on outputs that nobody has reviewed. “Vibe coding”—using AI to generate software outside normal engineering controls—adds code-review, dependency and software-supply-chain risk. RSAC’s preview also named vibe coding and software-supply-chain security as themes.
Recommended Free Tools
A practical response
- Discover: Use procurement, browser, identity, DNS and repository telemetry to identify AI services, plugins and generated code paths.
- Classify: Mark which data and workloads may be processed by approved tools, and prohibit high-risk transfers.
- Provide a safe path: Offer sanctioned models, approved extensions, enterprise logging and clear escalation channels.
- Require engineering checks: Apply peer review, secret scanning, software-composition analysis, testing and provenance requirements to AI-generated code.
- Measure exceptions: Record bypasses and near misses, then adjust policy and training instead of relying only on punishment.
Shadow use often signals unmet productivity needs. A usable approved alternative is therefore a security control, not merely a convenience.
5. Plan for SOC autonomous remediation
Gee’s fifth priority is the move toward AI-native security operations that detect, triage and remediate with increasing autonomy. The strategic question is not whether automation is good; it is where an organization will permit an automated action to cross from analysis into change.
Set explicit autonomy boundaries
| Action class | Typical treatment | Required evidence |
|---|---|---|
| Low impact | Automated enrichment, deduplication or ticket classification | Quality monitoring and normal audit logs |
| Moderate impact | Temporary isolation or credential suspension | Predefined policy, notification and rapid reversal |
| High impact | Production deletion, broad blocking or business-critical configuration changes | Named human approval, testing, detailed audit trail and rollback |
These categories are decision criteria, not vendor-tested performance claims. Before enabling an autonomous playbook, verify its false-positive handling, escalation path, change window, approval record and rollback procedure. Run it in simulation or a constrained environment first, and preserve enough context for an investigator to reconstruct why the action occurred.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What RSAC 2026 adds to the five-priority frame
The conference itself included more than 700 speakers, 31 session tracks, over 570 sessions and more than 600 exhibitors, according to the official opening release (RSAC, March 23, 2026). Those figures describe the completed 2026 event, not a promise about a future edition.
RSAC’s categorized 2026 topic list placed GRC first. Its top ten also included AI and ML applications to security, identity and authentication, hackers and threats, leadership, business perspectives, DevSecOps and application security, the human element, AI and ML security, and incident response and recovery. RSAC projected GRC and the two AI categories to remain near the top in 2027. These are conference-topic rankings and projections, not a survey of all CISOs or a universal investment sequence.
Best Value
The identity report also found that 70% of surveyed organizations were seriously concerned that their IT or service desk would fail to stop a social-engineering attack. In the same vendor report, 83% believed AI would help cybersecurity more than cybercrime, while 91% planned to implement some form of AI in their technology stack in the following year. Treat those percentages as reported organizational opinions and plans, with the survey’s scope and publisher attached—not as causal proof that any one priority reduces breaches.
How to turn the agenda into a 90-day CISO plan
- Baseline visibility: Inventory AI systems, machine identities, AI services, generated-code workflows and SOC automations.
- Choose accountable owners: Assign executives and technical custodians for each risk domain, with review dates.
- Close one high-risk gap per domain: For example, remove standing administrator keys, block sensitive uploads to unapproved AI tools, or add human approval to a destructive playbook.
- Test the controls: Conduct tabletop exercises for prompt injection, compromised service accounts, shadow-AI disclosure and an erroneous automated remediation.
- Report evidence: Track inventory coverage, identity age and privilege, policy exceptions, review completion, detection quality and rollback time.
Used this way, Gee’s five priorities become a risk-management checklist rather than a conference shopping list. They also leave room for RSAC themes that are less explicit in the five—workforce burnout, partnerships and community collaboration—when setting the next planning cycle.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
