John Z Black

John Z Black Mar 24, 2026 Policy, Law & Governance #RSAC 2026 #AI Security #agentic AI #CISA #government cybersecurity #Google Cloud #Microsoft #CrowdStrike #Wiz

RSA Conference turned 35 this year. Day one at Moscone Center played out like every vendor got the same memo simultaneously: launch an agentic AI product, preferably before lunch.

Google Cloud announced an agentic AI security strategy with deep Wiz integration operating at “machine speed.” Microsoft rolled out agentic capabilities across Defender, Entra, and Purview, plus a Shadow AI protection feature in Edge for Business that blocks unauthorized AI tools. CrowdStrike expanded Falcon to close what it’s calling an AI security gap. Wiz launched Red Agent, an AI-powered autonomous attacker designed to continuously red team your own environment. All of that in roughly 24 hours, all pointing the same direction.

Sitting in the middle of it: a notable absence.

According to reports, CISA, the FBI, and the NSA were not on the RSAC 2026 program roster. Those three agencies have been the public face of government-private sector cybersecurity collaboration for years. Salt Typhoon. Volt Typhoon. Shields Up. Ransomware advisories. And reportedly, no seat at the table this year.

What makes it genuinely strange is what the panels that did happen were saying. Speakers described the Trump administration’s cyber strategy in terms of unprecedented public-private cooperation and offensive action at scale. Big promises. Aggressive framing. The agencies that would actually execute any of that cooperation weren’t in the room.

The shift to agentic AI security isn’t a minor product update. These are systems designed to act autonomously at scale, blocking threats, hunting vulnerabilities, or in Wiz’s case running continuous simulated attacks against your own infrastructure. That’s a significant change in who and what makes security decisions. Faster. Less transparent. Harder to audit. In past years, NIST and CISA were at least adjacent to conversations about standards and accountability. Their absence creates a vacuum. Private industry is filling it.

If you’re evaluating any of these agentic platforms, do it on the merits. A government framework isn’t coming soon.

What the day-one vendor rush at RSAC 2026 reveals about where AI security is headed, and why the government’s absence from the conversation matters more than the product announcements.