RSAC 2026 wrap-up – Week in security with Tony Anscombe

RSA Conference 2026 highlighted the growing prominence of AI agents in cybersecurity—serving dual roles as both defensive tools and emerging threats. Organizations face a significant gap in understanding and mitigating AI agent-related risks. While AI demonstrates potential for enhancing security postures, many enterprises have not adequately prepared for the attack surface these autonomous systems introduce. Security teams must prioritize AI governance frameworks, implement strict access controls for AI agents, and develop monitoring capabilities to detect anomalous AI behavior. Immediate actions include auditing AI deployments, establishing policies for AI agent permissions, and training personnel on AI-specific threat vectors. The evolving landscape requires proactive engagement with AI security standards.

This year, AI agents took the center stage – as a defensive capability, but more pressingly as a risk many organizations haven't caught up with

RSA Conference 2026 highlighted the growing prominence of AI agents in cybersecurity—serving dual roles as both defensive tools and emerging threats. Organizations face a significant gap in understanding and mitigating AI agent-related risks. While AI demonstrates potential for enhancing security postures, many enterprises have not adequately prepared for the attack surface these autonomous systems introduce. Security teams must prioritize AI governance frameworks, implement strict access controls for AI agents, and develop monitoring capabilities to detect anomalous AI behavior. Immediate actions include auditing AI deployments, establishing policies for AI agent permissions, and training personnel on AI-specific threat vectors. The evolving landscape requires proactive engagement with AI security standards. This year, AI agents took the center stage – as a defensive capability, but more pressingly as a risk many organizations haven't caught up with This year, AI agents took the center stage – as a defensive capability, but more pressingly as a risk many organizations haven't caught up with