RSAC 2026 Pulse Report Reveals AI‑Driven Shift in the Cyber Threat Landscape

The ISMG Pulse Report on the RSA Conference 2026 synthesises insights from more than 130 interviews, offering a data‑backed view of how artificial intelligence is reshaping attack techniques, ransomware operations and security‑team confidence across three thematic acts: transformation, crisis and response.

---

A New Analytical Lens on RSAC 2026

Traditional conference coverage often strings together quotes from executives and vendors. The Pulse Report, authored by Dan Verton, takes a step further by converting those statements into weighted judgments, assigning confidence scores, and mapping them onto a 16‑theme taxonomy that reflects the conference’s core discussions.

Methodology at a Glance

Step	Description
Interview collection	130 + conversations with CISOs, practitioners, vendors, investors, government officials and analysts.
Claim extraction	Each interview processed through ISMG’s IRIS platform; statements are identified, attributed and categorized.
Weighting	Sources are scored for credibility; contradictions are measured to gauge “contradiction pressure.”
Mapping	Findings aligned with the conference’s 16‑theme taxonomy and organized into three narrative acts: Transformation, Crisis, Response.
Confidence rating	Every core judgment is accompanied by an explicit confidence level, distinguishing consensus from emerging uncertainty.

The result is a structured, evidence‑based narrative rather than a collection of isolated sound bites.

---

Key Findings

1. AI at the Core of Every Dangerous Attack Technique

• For the first time in RSAC’s 35‑year history, every high‑risk attack vector discussed in the conference featured an AI component.
• This reflects a broader industry trend where adversaries embed machine‑learning models into malware, phishing, and credential‑stuffing tools.

2. Ransomware Has Become Predominantly AI‑Managed

• 80 % of ransomware operations surveyed are now coordinated by AI systems that automate target selection, encryption timing and ransom negotiation.
• The shift raises concerns about speed of propagation and the difficulty of disrupting automated decision loops.

3. Explosion of Endpoint Agents

• Vendors originally anticipated ≈ 25 agents per enterprise; in practice, thousands are deployed per organization.
• While 90 % of surveyed firms have rolled out agents, confidence in their security posture remains low, indicating gaps in governance, visibility and control.

4. Data Foundations Lag Behind AI Ambitions

• Only 20 % of CISOs feel their data infrastructure is ready for AI workloads.
• The remaining 80 % are proceeding with AI deployments despite acknowledged data‑quality and governance shortcomings.

5. Rapid Emergence of New AI Security Market Segments

• 12 distinct AI‑focused security categories have materialised within the past year.
• Strategic buyers accounted for 92 % of M&A volume in 2025, underscoring consolidation around AI‑centric capabilities.

---

Interpreting the Three Acts

Act I – Transformation

The conference opened with a focus on how AI is redefining threat creation and detection. Interviewees highlighted the democratization of AI tools, enabling smaller threat actors to craft sophisticated campaigns previously reserved for nation‑state groups.

Act II – Crisis

Panelists expressed alarm over the speed at which AI‑enabled ransomware spreads and the erosion of confidence in endpoint‑agent ecosystems. The lack of robust data foundations was repeatedly cited as a systemic vulnerability that could amplify AI‑driven attacks.

Act III – Response

The final segment explored emerging defensive strategies: real‑time micro‑segmentation, AI‑augmented threat‑led defense, and the push for standardized data‑governance frameworks. However, confidence ratings for many of these approaches remained moderate, reflecting the early‑stage nature of the solutions.

---

Implications for Security Leaders

1. Re‑evaluate Threat Models – Traditional signatures and rule‑based defenses are insufficient against AI‑generated attacks.
2. Prioritize Data Hygiene – Investing in data quality, labeling and governance will be a prerequisite for effective AI security tools.
3. Scale Governance of Agents – With thousands of agents per environment, automated policy enforcement and continuous monitoring become essential.
4. Watch Market Consolidation – The concentration of AI security capabilities in the hands of a few strategic buyers may limit options but could also accelerate integration of advanced analytics.

---

Looking Ahead

The Pulse Report’s confidence‑rated judgments suggest that while the industry is rapidly adopting AI, many foundational elements—particularly data readiness and agent governance—remain underdeveloped. As AI continues to permeate both offensive and defensive cyber operations, the next RSAC will likely focus on bridging the gap between AI ambition and operational maturity.

---

The full Pulse Report, including detailed chapter summaries and confidence scores, is available through ISMG’s publication channels for readers seeking a deeper dive into the data.