RSAC 2026: AI Agents, Bad Actors and the Search for Collective Resilience

I came away from RSAC 2026 feeling that I had attended a conference at an inflection point in cybersecurity history.

RSAC 2026, held March 23 through March 26 at the Moscone Center in San Francisco, carried the official theme of "The Power of Community," and that theme grew more meaningful to me as the week unfolded. Now in its 35th year, the conference convened the world's top cybersecurity, government and business leaders to learn, explore current and future trends and strategize on best practices to tackle the threats of today and tomorrow. I chose to focus on sessions related to AI agents and AI security because AI was already top of mind for me before the trip. By the end of the week, I felt even more certain that it was the right call. The conversations were urgent, highly practical and charged with a level of concern that was difficult to miss.

Part of that urgency came from the broader moment in which the conference took place. The physical security at the Moscone Center was noticeably heightened, with bag checks and entry screenings that felt closer to airport security than a convention entrance. And while the lines were long, they were a faint echo of the larger atmosphere outside. The world already felt unsettled while I was traveling. Everywhere you looked, there were reminders of conflict, instability and the reality of bad actors operating across borders, platforms and systems. That atmosphere stayed with me throughout the week and shaped how I heard the speakers. The conference discussions did not feel isolated from world events. They felt deeply connected to them.

That was one of the strongest impressions I took away. The security community is not thinking about AI in the abstract. It is thinking about AI in a world already defined by adversaries, disruption and systems under stress. The top themes on the show floor and in keynote and breakout presentations included securing agentic AI, identity security, physical AI and the rise in global cyber threats, which are increasing exponentially as AI agents proliferate. At RSAC, those threads kept converging. The conference was simultaneously talking about bad actors, the AI space and the growing intersection between the two.

In that sense, the traditional cybersecurity problem and the emerging AI security problem are beginning to merge. The old question was how to defend systems, users and data from malicious actors. The new question is what happens when AI agents themselves become part of that equation, whether as tools for defenders or attackers, or as semi-autonomous actors that introduce new categories of risk. Once agents are given access to data, systems, applications and other agents, the issue is no longer just model safety. It becomes a much larger problem of authority, accountability, traceability and control.

The mood in the room

That is why the atmosphere in so many of the sessions I attended felt so striking. There was real excitement, but running alongside it was something close to alarm. Some speakers conveyed a clear sense that agentic AI is moving faster than the mechanisms needed to govern it, and there were moments when the concern in the room felt almost like panic. At the same time, the optimism was genuine. It felt like being at the right place at the right time, at a moment when the industry is beginning to recognize the scale of the challenge before that challenge fully hardens into a crisis.

Several people framed this moment in terms similar to the early internet era of the 1990s. Back then, innovation surged ahead while security trailed behind, and the community spent years retrofitting protections onto systems that were never designed with them in mind. The comparison felt apt. AI agents may represent a foundational shift in how technology is used, how work gets done and how digital decisions are made. But if that comparison holds, the opportunity now is to embed security thinking into the architecture much earlier than we did in previous eras. One of the lines from the keynote stage that captured the stakes most precisely came from Jeetu Patel, president and chief product officer at Cisco: "With chatbots, you worry about getting the wrong answer. With agents, you worry about taking the wrong action." That single sentence stays with me. The blast radius of a misconfigured or compromised agent is categorically different from anything the field has dealt with before.

The identity problem at the center of everything

The sessions that felt most technically relevant to me were those focused on agent identity, because this is still largely unsolved. We have spent decades building identity frameworks for humans and, to a lesser degree, for services and machines. Agents introduce a different challenge. They can be ephemeral, created and removed dynamically and may spawn child agents acting on behalf of a parent, a user or an organization. When something goes wrong, tracing that chain of delegation is still very difficult.

My notes from these sessions kept returning to the same ideas: OAuth everywhere, scoped authorization tokens from agents, managed identity, attestation-based identity and preservation of origin identity. All of them point to one central problem. Security teams need a dependable way to know who or what is acting, under what authority and through which chain of delegation. In the agentic world, authentication by itself is not enough. Identity must also support accountability. When an agent crosses a security boundary, the original identity context has to remain traceable so the full path of action can be reconstructed if needed.

Ephemeral agents make this harder. A persistent service account is one thing. An agent that exists for thirty seconds, performs a task with elevated access and disappears is another. Just-in-time identity and attestation-based models came up repeatedly as the direction the industry needs to move toward, but the honest view in many sessions was that the tooling is still immature.

Data access, data loss and the live transaction path

Another major cluster of discussion centered on data access and control. The phrase I kept hearing, in various forms, was that data security needs to move closer to the point of action. It cannot remain a passive governance layer sitting on the sidelines while agents operate in real time against production systems. Concepts like application firewalls positioned in front of data layers, inline data loss prevention (DLP) for agent traffic, AI data loss proxies and content inspection firewalls all pointed toward the same architectural shift: security has to be part of the live transaction path, not an audit function that reviews what happened afterward.

The principle of using only production data where genuinely necessary, and synthetic data for testing, also came up in the context of limiting agent exposure to sensitive information. Several speakers noted that insurance companies are beginning to lead on this, pushing policy-based, volumetric governance frameworks as a condition of coverage. That is a notable signal. When insurers are ahead of the technical community on governance architecture, it usually means the risk is being priced before it is fully understood.

MCP servers: Capability and exposure arriving together

Secure Access Service Edge (SASE) architecture, approved browser controls and edge-only execution environments were identified as foundational controls, with several speakers making the point that a virtual private network (VPN) alone is no longer sufficient for governing agent behavior across distributed environments. But the topic that generated the most pointed discussion was the Model Context Protocol (MCP), which enables agents to connect to external tools and data sources in a standardized way.

The tension in these sessions was palpable. MCP enables powerful integration patterns, but it also creates new trust boundaries, new supply chain risks and new avenues for unsafe interactions to propagate. Notes I kept from these conversations included concerns about MCP servers functioning effectively as malware if the source code is not carefully vetted, the need for mutual authentication on the back end of every MCP connection and the principle that MCP servers should only be permitted to com

Collective resilience as the organizing principle

What stayed with me most during the week was the idea of collective resilience. That phrase kept returning as I moved from one session and conversation to the next.

No single vendor, platform or enterprise can solve this alone. The threats are deeply interconnected, the technology is moving fast and the effects can spread widely. Across the conference floor, there was a clear shift toward proactive security, real-time detection and the sharing of intelligence across organizations.

This felt especially urgent because agents operating across organizational boundaries create dependencies that security teams have only begun to understand. If an agent in one organization calls an MCP server run by a vendor, which then queries data from a third-party platform, the security posture of each party affects the others. Collective resilience, in that sense, means building trust frameworks and shared accountability across those boundaries, not just inside them.

That is also why the convergence of bad actors and AI felt so significant at this conference. Agents are entering a world already shaped by adversaries seeking scale, leverage, ambiguity and weak points of trust. Agents can amplify all four. They can act quickly, touch many systems, obscure human intent and move through environments that are hard to inspect unless controls are built in from the start.

Leaving San Francisco

So when I reflect on the conference theme, "The Power of Community," I hear it differently now than I did when I walked in. It was not simply a statement about networking or professional belonging. It pointed toward a genuine operational requirement. In the age of agentic AI, security will likely need a stronger model of collective defense. Shared standards, shared governance frameworks, better identity infrastructure, common approaches to runtime monitoring and faster learning across organizations may prove just as consequential as any single product capability.

That was the real value of the trip for me. I arrived wanting to understand where the conversation around AI agents and AI security was heading. I left feeling that the conversation was becoming more serious, more realistic and more grounded in the problem's actual complexity. There is real concern in this community, and rightly so. But there is also a clear opportunity to shape the foundations of this era before they are fully set in place.

I left RSAC 2026 holding both of those things at once: concern, because the risks are real and the bad actors are not waiting, and optimism, because the right questions are finally being asked at the right scale, and more people seem to understand that resilience in this new era will have to be built together.