RSAC Conference 2025: Welcome To The Petting Zoo
If you walked the RSAC Conference 2025 show floor this year, you could be forgiven for thinking you were at the world’s strangest petting zoo or furry convention. There were goats! There were puppies! And if real animals on the conference show floor isn’t your thing (social media posts from RSAC 2025 attendees revealed mixed opinions), you also had robot dogs or your pick of people in furry animal costumes. Both on the expo floor and on the streets outside the Moscone Center, we found people dressed in full costume as rabbits, ducks, bees, and even a yeti. Read on for our key takeaways from this year’s RSAC Conference and find out which of these numbers were greater: the number of Forrester analyst steps taken at RSAC 2025 or the number of mentions of agentic AI (see the answer at the end of the blog). Agentic AI Was Everywhere This year’s unofficial RSAC Conference theme seemed to be: AI agents and agentic AI are the future … as long as people don’t mind the additional work of teaching, training, and supervising them. Today’s version of agents and agentic AI mostly consists of a smattering of half-complete processes dropped into a human’s lap. It’s a lot like living with a productive but easily distracted DIY’er, where many projects get started, few ever finish, and you learn to live with the messy results. In short: Agents will do some work and complete tasks but not workflows. This will leave people with more alerts and activities to perform. Some of the manual toil will be removed, if your environment is ready for automation (something most vendors ignore for now). The RSAC sessions focused on skills and talked about how the cyber workforce did not consider the human challenges around agentic AI. Agents will create more alerts, but those alerts will need a mid- to senior-level practitioner to 1) check the agent’s work and 2) take action on the alert. At the same time, the increased usage of copilots and large language models by current early-career practitioners and the vendor promise and roadmap of agents as a replacement for those practitioners (such as tier 1 and 2 security operations center analysts) will eliminate the hands-on work needed to build domain and institutional knowledge. The trade-off here sets us up for potential issues down the line. In the hopes of solving today’s — supposed — early-career skills shortage, we will create a shortage of skills in the mid- to senior levels in the long term. Efficiency Drove Vendor Messaging Aside from an overload of agentic AI (and a few uses of AI that just didn’t make sense), most of the messaging was rather bland (not necessarily a bad thing). A lot of vendors emphasized platformization, automation, and intelligence. When considered together, this emphasized an underlying theme of helping security leaders do more with less in a struggling economy, although vendors avoided coming right out to talk about economic uncertainty. They also avoided any discussion of the geopolitical volatility and tariff mayhem gripping the world and the implications for everything from nation-state attacks and less cooperation and unity on fighting insidious ransomware to dealing with other rising risks such as deepfakes and undermining trust in tech and traditional government and societal institutions. Related to various security markets, we found that: Application security messaging shifts to platformization and application detection and response. Application security (AppSec) is still prominent at RSAC Conference, but the key messages have changed. API security signage dropped significantly, with only a couple of vendors highlighting API security capabilities, even though APIs remain a common cause of major breaches. The most precipitous drop in the AppSec world, though, was application security posture management (ASPM). Eight months ago at Black Hat while walking through Startup City, we saw four or five early-stage vendors pitching ASPM. Walking through the RSAC Early Stage expo last week, there were none. It wasn’t that the early-stage vendors had graduated to the main expo, as we didn’t notice any ASPM signage there either. Instead, emerging companies pitched runtime application security, sometimes called application detection and response, while established vendors touted their unified web application protection platforms. Identity maintains a strong showing. Identity vendors of all shapes and sizes were present, including a healthy dose of non-human identity management and identity verification offerings. Identity vendors featured heavily in the Early Stage expo. Announcements from identity vendors were muted, however, as many vendors are holding product announcements for the upcoming Identiverse event. The FIDO Alliance’s seminar on the state of passkeys was lightly attended compared to previous years. Quantum security has a light presence on the show floor, with signs of growth. Some smaller vendors in the quantum security space could be found on the outskirts of the expo pitching post-quantum, cryptographic agility, or quantum key distribution solutions. We also noticed one quantum security vendor at the Early Stage expo. As we get closer to 2030 and some of the first deadlines for quantum migration, we expect these vendors to be more prominent and for quantum security messaging to grow. The combination of insider risk management + DLP grows. The convergence of insider risk management solutions with strong data loss prevention (DLP) controls was showcased at some very large booths. Insider risk continues to be a primary use case for data protection solutions, and employee monitoring solutions (for security and productivity) are enjoying a moment in the limelight. DLP itself had a strong presence across the show floor as existing providers continue to push AI capabilities into their offerings or different ways to enforce DLP policies, such as through a browser. MIND, one of the startups showcased in Innovation Sandbox, also focused on an AI-driven approach to DLP. Cyber resilience has an even stronger showing than last year. A modern data resilience strategy today includes security as a core component. Your data resilience platform must be architected with Zero Trust principles and have additional security integrations. Major data resilience, backup, and
RSAC Conference 2025: Welcome To The Petting Zoo Read More »











