RSA Conference Guide: Planning, Security, and Vendor Evaluation

This RSA Conference guide explains how to plan for RSAC in San Francisco, evaluate its sessions and expo, protect sensitive information, and turn a large cybersecurity event into useful work rather than a collection of vendor pitches. The conference is now promoted under the RSAC brand, but “RSA Conference” remains the familiar name.

Event dates, pass types, programs, speakers, prices, and access rules change annually. The official site currently lists RSA Conference 2027 for April 5–8, 2027, at Moscone Center in San Francisco. Treat those as dated details for that edition and verify the current event page before booking travel.

What is RSA Conference?

RSAC is a large professional gathering for cybersecurity practitioners, researchers, executives, vendors, policymakers, educators, students, and media. Its official FAQ traces the first event to 1991, when it consisted of one panel discussion. The modern conference combines educational sessions, keynotes, an extensive vendor expo, startup programs, workshops, community activities, and networking.

The name originated in the cryptography and security community, but the program now spans many disciplines. Typical subjects include application security, cloud security, identity, incident response, privacy, governance, cryptography, operational technology, threat intelligence, artificial intelligence, workforce development, and security leadership.

What you can do at RSAC

Program area	Best use	What to verify
Track sessions	Structured learning and practitioner case studies	Speaker expertise, evidence, and pass access
Keynotes	Broad industry themes and major announcements	Whether content is independent or sponsored
Expo	Compare products and meet technical teams	Demo conditions, integrations, pricing, and roadmap status
Innovation Sandbox	See selected startup pitches	Pitch claims versus deployed customer evidence
Launch Pad and Early Stage Expo	Explore early-stage companies	Product maturity, support, financing, and availability
Networking and community programs	Peer exchange and recruiting	Purpose, privacy, and time commitment

Programs and pass entitlements change. For the current edition, compare the official agenda and pass matrix rather than assuming an expo credential includes every educational session or special program.

How to build a useful agenda

A large schedule can encourage random session hopping. Start with two or three outcomes: learn how peers solved a specific problem, evaluate a defined product category, meet particular people, earn applicable continuing-education credit, or gather information for a decision.

1. Identify priority questions. Write the operational, technical, financial, or policy questions you need answered.
2. Choose primary sessions. Read abstracts and speaker biographies; avoid selecting by title alone.
3. Add backups. Rooms can fill, schedules can change, and a session may not match its abstract.
4. Reserve unscheduled time. Allow for travel between buildings, meals, vendor meetings, and unexpected conversations.
5. Plan daily review. Capture conclusions, follow-ups, and evidence while they remain fresh.

Adding a session to a personal schedule does not always reserve a seat. Check the current event instructions for advance reservations, room access, and first-come policies.

Evaluating conference sessions

Cybersecurity presentations range from peer-reviewed research and detailed case studies to product demonstrations and opinion. The conference setting does not make every claim equally reliable.

• Ask whether the speaker describes measured results, a lab test, a simulation, or a forecast.
• Look for deployment scale, time period, baseline, sample selection, and known limitations.
• Separate correlation from proof that a control caused an improvement.
• Note sponsor relationships and whether a product is generally available.
• Record citations, standards, advisories, or repositories that can be checked later.
• Do not photograph sensitive slides or share restricted material.

Technical claims about connected industrial environments benefit from the lifecycle and safety context in our guide to cyber-physical systems. A security control that works in office IT may need different testing in operational technology.

How to evaluate products on the expo floor

The expo is useful for comparing many companies quickly, but a polished demonstration is not a production deployment. Bring a consistent question set so every vendor is evaluated against the same requirements.

• Scope: Which assets, operating systems, clouds, identities, regions, and data types are supported?
• Deployment: What privileges, agents, sensors, integrations, and professional services are required?
• Detection claims: What was measured, against which dataset, with what false-positive and false-negative rates?
• Operations: Who investigates alerts, tunes rules, maintains content, and covers after-hours incidents?
• Security: How are the product, update channel, support access, secrets, logs, and customer data protected?
• Commercial terms: What drives price, what is excluded, and how can data be exported at contract end?
• Evidence: Can the vendor provide architecture documents, independent assessments, references, and a representative pilot?

Do not upload production data, credentials, malware samples, confidential architecture, or regulated information into an expo demonstration. Use synthetic examples and complete a formal security and privacy review before any pilot.

AI claims at a cybersecurity conference

Artificial intelligence appears across detection, investigation, code analysis, fraud, identity, and user support. Ask what the term means in each product. A rules engine, statistical model, large language model, and autonomous agent have different data needs, failure modes, and controls.

• What data trains, retrieves, or prompts the system?
• Is customer data used to improve a shared model, and can that use be disabled?
• How are hallucinations, prompt injection, poisoned content, and unsafe actions handled?
• Can a human review and reverse decisions?
• Which evaluations demonstrate performance on the buyer’s environment?
• What happens when the model, provider, or licensing terms change?

For another sector’s approach to data provenance, human review, and rights, see our article on AI in film production. The applications differ, but vague “AI-powered” labels are insufficient in both.

Personal and organizational security at RSAC

A cybersecurity conference attracts security professionals, vendors, researchers, recruiters, and media. It can also attract opportunistic phishing, fake event messages, malicious QR codes, device loss, and aggressive data collection. Treat event travel as a security scenario.

• Update devices before travel and use strong screen locks and phishing-resistant authentication where available.
• Bring only the data and accounts needed for the trip.
• Verify schedule changes, invitations, payment requests, and QR-code destinations through official channels.
• Use trusted charging equipment and do not connect unknown USB devices.
• Avoid discussing confidential incidents, customers, vulnerabilities, or architecture in public areas.
• Report lost credentials, devices, or badges promptly according to company policy.
• Review new contacts and shared files before importing them into corporate systems.

Our practical cybersecurity checklist covers account, device, update, and phishing protections that also help during travel.

Badges, lead retrieval, privacy, and photography

Conference badges can control access and may support attendance records or exhibitor lead retrieval. RSAC’s current registration terms describe badge scanning and similar technologies for administration, identity verification, access, attendance, capacity, continuing education, surveys, analytics, and related functions.

Before allowing an exhibitor to scan a badge, ask what data will be shared and how follow-up will occur. A scan can be a commercial lead, not merely proof that you visited a booth. Review the current privacy notice and registration terms, use available preference controls, and provide minimal extra information.

The event occurs in public spaces where photography and recording may happen, subject to venue and session restrictions. Do not display confidential information on a laptop or badge, and follow instructions that prohibit recording. RSAC’s 2027 terms also prohibit using event content, recordings, materials, or attendee and sponsor information to train AI or machine-learning models.

Networking without wasting the week

Travel, budget, and practical logistics

Conference cost includes more than registration. Budget for travel, lodging, local transportation, meals not provided, device connectivity, accessibility needs, and time away from normal work. Hotel blocks can have separate cancellation terms, and unofficial booking messages may be scams. Use accommodation links and contacts verified through the event’s official domain.

Moscone Center spans multiple buildings and a large event can involve queues, security checks, crowded walkways, and off-site meetings. Review the current campus map, venue rules, weather, and accessibility routes. Choose footwear and a bag suitable for a long day, carry required medication, and leave realistic travel time between sessions.

Organizations sending several employees should divide coverage intentionally. Assign topic areas, use a shared note template, and schedule a short internal debrief. That reduces duplicate attendance and makes it easier to compare findings. Do not require employees to collect leads or attend evening events in ways that conflict with company policy or personal safety.

If the business case depends on education, list the decisions or capabilities the trip should improve. If it depends on vendor research, define the shortlist and evaluation criteria before arrival. A lower-cost virtual resource may be sufficient when the objective is simply to watch a few recorded talks.

Useful networking is specific. Decide whether you need peers with a particular architecture, researchers in a specialty, candidates, customers, or implementation partners. Request short meetings with a clear topic and leave time between appointments.

• Prepare a concise description of your role and the problem you are exploring.
• Ask permission before adding someone to marketing lists or sharing their information.
• Keep confidential customer, incident, and employer details out of casual conversation.
• Write one sentence about the next step after each important conversation.
• Send selective follow-up rather than a generic message to every badge scan.

Accessibility, conduct, and remote participation

Review the official campus, accessibility, and accommodation information before travel. The current RSAC code of conduct applies to physical and virtual events and prohibits harassment, discrimination, hostile behavior, stalking, and intentional disruption. It provides an event contact for reporting suspected violations.

If travel is not practical, check the official library, webcasts, recordings, and virtual offerings for the current edition. Availability and access may vary by pass or membership. Our guide to accessible and secure virtual events explains how online delivery differs from simply filming a physical stage.

Post-conference follow-through

1. Separate verified findings from product claims and personal impressions.
2. Share a short internal summary tied to the objectives set before the event.
3. Assign owners and dates to follow-up meetings, pilots, research, or policy questions.
4. Evaluate vendors through normal procurement, security, privacy, legal, and architecture reviews.
5. Revoke temporary access, process expenses, and report any security issue.
6. Unsubscribe from irrelevant marketing and retain only useful contacts and materials.

Frequently asked questions

When is RSA Conference 2027?

The official site currently lists April 5–8, 2027, at Moscone Center in San Francisco. Confirm dates, venue details, and registration status before making nonrefundable arrangements.

Is the expo included with every pass?

Access depends on the pass and edition. Compare the current official pass chart for expo, sessions, seminars, programs, recordings, and special events.

Are expo demonstrations independent tests?

No. They are controlled presentations. Ask for methods and limitations, then validate shortlisted products in a representative pilot with normal organizational review.

Can sessions provide continuing-education credit?

Some activities may qualify, but requirements depend on the certification body and current conference process. Keep attendance documentation and confirm acceptance with the organization that issued the credential.

Conclusion

RSA Conference can compress months of learning, product research, and professional contact into several days, but scale alone does not create value. Set concrete objectives, verify the current program and access rules, evaluate evidence rather than slogans, protect sensitive information, and assign follow-up. That turns a large cybersecurity gathering into decisions and practices that survive after the expo closes.