Hugh Thompson on RSAC’s Rebranding and Investment

This is Textron tv. Hey everyone. Welcome back here to Techstrong tv.

You know, I am so excited. I can't, I can barely contain myself for our next guest to be on here. I've wanted to bring them on Techstrong TV for a long time.

You know, I, I've had a almost 25 year relationship with the RSA conference. I think I went to my first RSA conference in 2002. And, um, so just a little short of 25 years, it is by far my favorite place, my favorite conference to go to.

My friends and my friends are older now, though. I make new friends every year, but a lot of the people I broke in with in security, we've all been going to RSA. And it is traditionally a time where we renew our acquaintances, renew our friendships.

We knew our war stories and, and fetching and moaning and everything else we all do in security, because no one takes securities, you know, serious enough for us. I've done so many things over the years speaking there, exhibiting their partying, their, the, my security bloggers network parties, there every so much of my security persona and my own persona is wrapped around that. It, I, I'm thrilled to still be involved with it.

This next guy feels the same way. So much so that he went out and helped make a new, bigger, better RSA conference organization or than there ever was before. And it's put it on a, a really solid footing.

Let me introduce you to Hugh Thompson, you as the executive chairman for RSA conference, RSAC, as we call it, and the program committee chair for RSA conference. Hugh, welcome to Text Drug tv. I hope I didn't embarrass you, but you know, I don't care what anyone says.

I love going to RSA conference, man. It's the greatest. Oh, Alan, it is so great to see you and thanks so much for having me on.

And, you know, I share your feelings and passion about RSA conference. It's, it's, it's just got this community feel to it. And, you know, I've been a program chair now for 17 years, right?

So it's like really, really long time. And just to see the outpouring from the community every year at the conference and the call for speakers, the program committee that has the thankless task of going through all those submissions and making the agenda, it's, it's awesome. It's like a reunion, like you said, when people show up in person.

So great to get to spend time with you and talk about it here. Absolutely. You know, Hugh, when I think back, I think it was the second or third RSAI went to, you guys moved it, well, I don't know if you were even associated then, but it moved from San Francisco to San Jose that year, remember?

Oh, yeah. We Used to switch. Used to oscillate.

Yeah. Between the two uhhuh. Yeah, yeah, yeah.

com bubble head burst. I remember being an exhibitor there. I used to think we were like Star Wars style and one of the outer rims of the galaxy.

It's not in the court where the big ones are, where the big exhibits are, but Things happen. Good things happen. That's where the action is.

And if you don't go to RSA, you don't know that. You wanna see what's happening, go to the outer rim. But anyway, we were getting more resumes than we were of sales inquiries that year.

It was a bad time. But, um, and then of course we moved back to San Francisco. But I, that, I think back to the size of the show then, versus the size of it's e it, it was easier to have that sense of community when it was 10, 12, 15,000 people at most.

Now we're 40, 45,000 plus people. But you haven't lost the community. There's still the community.

How, how do, how do you do it? How do you do it? Oh my gosh, I, I can't take credit for it.

It is the community that has made that so, right. Mm-hmm. And any incredible folks that work for RSA conference, you know, Linda and Brita and the many other folks that you've had on your show, you know, they are so dedicated to the ethos of RSA conference.

And even in internal meetings, first thing we talk about, and the last thing we talk about is the community. What does the community want? How can we better serve the community?

And we've always been community driven. And I think it's because of that. You can't really fake that.

It's like, you either are that or you aren't that. And I think people sense that when they come to the conference, that they have helped to build this thing that they're now sitting in and they're now experiencing. And I think about that, you know, over all these years.

And one of the things I've always asked myself is, there's a lot of people that wanna come to the conference, even though we've got like 45,000 of them there, they can't, like, they, they can't get budget. Like hotels are expensive in San Francisco. They come one year and, you know, it's not my turn now and my group.

And how do we take the same feeling that folks that go there and the people that they meet, and just the relationships that they build and the learning that they get, and how can we extend it? And that's been a huge focus for the last 18 months in terms of the team and what we've been thanking. Yeah, you speak of the team.

One of the things, and I've told this to people over the years, you know, it kind of wizard of the Wizard of Adish, you know, you've got this huge event, huge 40,000 plus people, the people behind RSA, like the actual full-time RSA conference employees. I remember it was just a couple years ago, I think there were like six or eight full-time RSA conference people, Right? That was all women, by the way, a conference that was put on by women for anybody out there who wants to talk about diversity and then everything else, right?

These were six powerhouse women who Oh my gosh, so talented. Yeah. Who just rocks it, rock it in year in, year out, everything else.

But the, the future is brighter than the past in a lot of ways. There's, so the recently last six months, you talk about the last 15 months, you've been planning that long, but we've seen in the last, let's say four months, a lot, a lot of news coming out, right? Well, we could go back, I guess maybe two years ago, q when you led the charge of, of taking RSA private, not that it was public per se, but taking your private, so to speak, setting it up on solid financial ground, on, on a real course as a, as a business, not just an appendage to someone else's business or what have you, but really a, a standalone organization.

And, and, you know, and there's been a plan since then. And if people are following the bouncing ball at home, they've seen it. But you give us, give us the timeline if you don't mind.

Yeah, sure. So, uh, you phrased it right? For a long time.

RSA conference sat inside the RSA corporation and RSA then, you know, through various periods of time, sat inside of other places like EMC and then EMC Dell inside of Dell. And so, but to the credit of all of the folks that ran the RSA parent company, they always had this idea of keeping RSA conference as independent, right? It had an independent program chair, which is me, had an independent program committee, which is all kinds of representatives from the community and what those folks say, at least the program committee folks on these specific tracks of what gets in and what doesn't, it's up to them.

Like, there is no other influence on 'em than, than their opinions. But, you know, all of that being said, we saw some significant potential in making the conference itself a standalone entity. So Crosspoint Capital made an investment in this standalone entity of RSA conference, pulled it out of the RSA parent, and it's now a fully fledged, you know, you mentioned the kind of six or eight core people that were there, they're still there, all of 'em.

And we've now got, you know, a lot of folks that have joined them. So I think we're up to 50 people now that are full-time employees of, of RSAC, which is super exciting. And what we wanted to do is ask how we can double down on what already has been done.

So the spirit of community, you know, the way that we gather people together, how can we serve you getting shaped by the community, but could we extend the conference from just being a thing that you go to for a week to something that can help you all year long? And maybe it's not just the people that go, it's all of these cyber professionals. It might be new that they just don't have the opportunity to be there.

And that's what most of those new folks have been working on for, you know, call it 15, 18 months now, is how do we create something that has the same spirit, is true to the community, helps the community, and they can use it all year round. I love it. You know, crystal, all you mentioned RSA and, and the, the, the kind of good shepherding that they did, I, I'd be bereft if we didn't mention we lost Amit Urine.

Ah, what, what A huge loss to this community. Yeah. Just an He was, yeah.

He led RSA through many years of probably of your time there as well as my time there. Yeah, for sure. And, um, so just a, a shout out a loss there, but most recently we've, we've seen this plan come into place to extend RSA, let's say, beyond the four walls of the Moscone Center, right?

Right. And, but there's also money going and resources being poured into making the onsite activities better and more exciting than ever. Um, you know, I want to specifically you, if you, we wouldn't mind talking about you guys have, you know, set aside and able to raise with partners a $50 million fund, I guess that's the right word to call it, a $50 million fund that's gonna go to the, uh, internet sandbox or the in, excuse me, innovation Sandbox finalist, which, you know, if you look over the years, I think is the 19th or 20 year for Sandbox, um, One years.

Yep. I mean, the companies that have come through, there's a who's who of security, right? This year we're actually gonna put some money behind this talk.

Talk about that. It's, it's an exciting year for, for our state conference in general. And I think folks will, will, will feel it, right?

You know, we're doing a bunch of new stuff, a bunch of additive things, but innovation sandbox, Alan, I can't even tell you. If you wound a clock back 20 years ago and you went to that first innovation sandbox, or even the second one or the third I did. Oh, did you really?

Yeah, I did. Yeah. I was in startup world then.

You know, I wasn't always the media guy. Oh My gosh. You know, you, you'll, you'll then viscerally feel it.

I'm about to say it was a small room. There were yeah. Companies, there were good companies that were up there, but then if you looked at the audience, almost everybody, not everybody, but almost everybody was an employee of those of good Companies.

Yeah. 'cause like they're like, what is this? Like, I don't know.

Mm-hmm. It's some, some startups and what are they doing? They're competing.

But I don't quite get it. If you fast forward to now, it is like the mentor of the next generation of cybersecurity companies. It's amazing.

Like the submissions that come in that amazing companies that have come through the door, you know, you think about Imperva as an example. Sentinel One is an example. You know, Wiz is an example.

All of these people that have been in the top 10 finalist group of RSA conference and to see how many exits those companies have had, it's, it's truly remarkable. And if you look back and you talk to these folks, and I'm sure you've had many of these people on before, and you've talked 'em directly, many of them would say that the publicity that they get from being in the top 10 was a huge impactor to their business. Sure.

Was in, in a positive way, right? Because it's a noisy space. You're looking for differentiation.

Why, why are you better than the next company that says they're doing the same thing as you? And it was something that gave you a stamp. It's always been judged by an independent group of judges.

We've got an amazing group for 2025, I think five of them are all returning judges, and there's one sixth new judge, Dave Chen from Morgan Stanley. And you're right, there is a big difference this year in that we will be giving a $5 million safe note to each of the top 10 finalists, which is a huge change. And it's a huge amount of money that's 50 million bucks, you know, going out the door effectively to that top pen.

And why would we do that? Because Crosspoint Capital, the company that owns R-S-A-C-R-S-A conference is, is basically has no role in deciding who's in the top 10. It's all in the hands of these independent judges.

But if you look over time, the process of independence, the process of betting on the community has yielded unbelievable results. And so that's why we feel super confident about doing that. And I can't, what happens?

I can't wait to see what happens Either, could I I we'll be watching it, you know, generally, so we always, we always interview Cecile. Yeah, Cecile, yeah. Yeah.

She's amazing. Yeah. Mar And then she, and turn, when the finalists are announced, we try to get as many of the finalists on Techstrong TV as we can.

We'll do it this year. Well, look, we're $5 million. It's $5 million.

Whether they win or not. Right. You know, you always hear this at contest, everyone's a winner where if you make the finalist, you're a winner.

Yeah. But they really are this year. Right.

If you make the finalist, you're a winner, man. Man, you got $5 million. So that's fantastic, man.

And, and it, it's gonna get real interesting there, but that we didn't stop there. You guys have come up with the new logo because, you know, we, we do our thing every Monday at RSA, the DevSecOps Connect event. Oh, yeah, yeah, yeah.

This year it's cybersecurity and AI on app dev. Um, so we've putting all, we had to redo everything with the new logo, right? Oh yeah.

Sorry about that. Yeah. Sorry.

No, don't be sorry. I'm glad we did. Okay.

The new RSA logo and a new website, and then I've seen it, uh, webinars throughout the year learn you, I, we call webinars here, Textron Learning Events. So you have RSA learning events consistently through the year. So the learning doesn't stop, the teaching doesn't stop.

The spreading of that security knowledge doesn't stop. You guys are doing that. Um, am I missing it?

What else do we got going on as part of this? Yeah, no, I think I, I think you called it outright. And so, you know, we, you mentioned us changing the logo and, you know, sort of changing the framing.

The goal is to build a bigger tent, right? Right. Now we have RSA conference, and then we were thinking about, geez, what do we call the company that does the conference will continue to invest in the conference.

I mean, geez, last year, for example, we had Alicia Keys close it, the Secretary of State open it, and, you know, amazing Mm-hmm. Magic Johnson this year, right? That's right.

And he's only the first that we Okay, very cool. So, well, I've seen Magic Keynote before. Oh, really?

You go see? Oh, I love, I saw him do a keynote about how he became truly wealthy, not just rich from playing basketball, but wealthy in business. Amazing.

He's an amazing, you probably know this already too, but anyway, yes. Magic's only the first. I can't wait to hear more.

Yeah, no, he's, he is gonna be great. And so we're continuing to amast in the conference, but how do we create this bigger tent that we can have the conference as the annual event, and then also be able to service people with, with other offerings through the year, things to do training and education, and also connect people with each other. That's one of the biggest things you struggle with in security, is how do I find a peer that's going through the same dilemma as me, and like, I gotta write a new LLM policy for the company.

Well, geez, I'd love to know what five peers are doing on that front. How can we connect 'em together? And so we went around a bunch of different, you know, kind of corners of what do, what do we call this thing?

And we landed on RSAC, which is something we use today to abbreviate RSA conference. But I really think over the years, the C has become so much more than just conference. It's the connections that you make when you're at the conference, it's the content that's there, but most importantly, it's the community.

And so that's what RSAC means to us, and that's why you see the new branding. That's why you see, you know, the new website that'll be sort of a central hub that can then point you to RSA conference and point you to other things in the future. I'm really, really excited about it.

I think it's gonna be awesome. So am I. So am I.

Hey, we only got a minute or two left, but you, I, we waited this long. AI is sucking the oxygen out of every conversation I have. How do you think AI is gonna affect the RSA conference and RSAC going forward?

Oh my gosh. It, it is everywhere. I can tell you, like, geez, all the submissions that we got, even for Innovation Sandbox, by the way, record number of submissions for Innovation Sandbox this year was very exciting.

Uh, but it's permeated everything and in, in so many different ways. There's, how can we as security profession professionals use AI and in particular, these LLMs, to make what we do better, right? To defend against the bad guys to do forensics, do pen testing, you know, you name it.

But then obviously significant concern is how are the adversaries gonna to use it against us and the rest of the world? And then there's all these concerns around these LLMs themselves. Have they been tampered with?

You know, can, can you verify what it was trained on? All of these questions that are related to security and governance of the LLMs. I think from a conference perspective and from an RSAC perspective, we see it as a huge opportunity.

We see it as an opportunity, for example, to take some of the content that we have, make it even more digestible to users and to people that would come in and, you know, wanna watch a video. Do they want it summarized? Do they want to see it, you know, in a different light?

Like, what is this person saying versus what this person is saying? So we think it's something really interesting. It's gonna be manchin, I would guess in almost every talk that you go to at R Yes, it will be blast year, no doubt, year, Any indication doubt.

So it's gonna be really interesting to see where things land, uh, at the end of April at, at RSA conference. Well, every day it just, I mean, the, the timeframe is so condensed here. What the of changes happening, this deep sea thing from China a couple weeks ago, kind of, it was kinda like a Sputnik moment, if you will.

And, but it also made us realize this two sides to this AI thing. One is we could wield it as a sort, but with our other hand, we need a shield from it, right? Because, you know, the bad guys never miss an oppor.

That's the lesson we've learned in security, right? The bad guys never miss an opportunity to take an opportunity. And, um, we, we've gotta be on guard.

And that means, you know, using it where we can, but being able to defend against potential threats from it. I, I, I, I completely agree. And I just a last thought on AI to leave you with, you know, we've had other disruptions before cloud, for example, right?

Sure. I remember the CSA launching at RSA, it was 2006. Yeah.

Yeah. Hoff with Chris Hoff and Res everyone. Yeah.

Yes, I remember That. Mm-hmm. I was there.

And, but, and, but the time between sort of the introduction of it as a term and then these huge providers and then full scale adoption, it's a little bit spread out. It's pretty quick, but a little bit spread out. This AI slash LLM attacks surface is expanding so fast because adoption is happening so quickly, more quickly than I've ever seen any other technology get adopted.

We gotta be vigilant, we gotta be on top of it. That's gonna be a big topic. Amen.

You, I wish I had another hour to sit here and chat with you. Awesome. Hey, we've got a few months before RSA, so you could come back on and we can continue this conversation anytime.

Loved here, loved here. Any, look, we do this every day, so anytime I'm, you know, anytime you got some time to talk, come on and talk, man. Um, but in the meantime, congratulations on everything going on with not just the RSA conference, but with RSAC, the, the industry welcomes it and is excited by it.

You're doing God's work, man. So keep it up. Thank you very much for coming here on Textron TV as well.

So great to see you, Alan, and thanks for everything you do for this community every day. I Really, it's part of being in the community, man. All right.

You Thompson, executive chairman for RSAC and the program committee chair for RSA conference here on Techstrong tv. We're gonna have a lot more RSA conference news leading up to, to, uh, was it April 28th? Is the first day.

Is that Monday? Right? Um, so very excited.

You take care. It was great seeing you. We're gonna take a break here on Techstrong tv.

We'll be back in a minute.