The cybersecurity world just wrapped up its biggest gathering of the year, full of discussions about AI, software vulnerabilities and nation-state hacking threats. But for the first time in years, the U.S. government wasn’t there.

The RSAC Conference is widely considered one of the cybersecurity community’s premier events. Every year, technology companies, academic and think-tank researchers, market analysts and independent security consultants fill the halls of the Moscone Center’s three sprawling buildings in San Francisco. The conference also attracts state and local officials, foreign governments and nonprofit groups that are eager to understand the future of cybersecurity.

Over the years, as cybersecurity threats have risen to the top of policymakers’ agendas, the U.S. government has expanded its own presence at the RSAC Conference. Officials have previewed new strategies, sought feedback on planned regulations and collected ideas about how best to defend vital networks. But in January, after RSAC Conference’s organizer hired former Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly as its new CEO, the Trump administration abruptly canceled plans for White House, CISA, FBI and National Security Agency officials to speak at this year’s conference, which took place March 23-26. 

Administration leaders have disparaged CISA for working with tech companies to counter misinformation in 2020 during Trump’s first term, prior to Easterly’s tenure.

The U.S. government’s withdrawal from the RSAC Conference represented a striking rejection of a conference that as recently as 2024 attracted two Cabinet secretaries. The resulting policymaker void resonated loudly in San Francisco at a time when the government has pulled back in many other ways from the partnerships that are vital to national cyber resilience.

In conversations before and during the conference — whose theme this year was “the power of community” — more than half a dozen former government officials and key industry partners said the Trump administration’s absence was a mistake.

“It's a missed opportunity for them to not be here,” Denise Anderson, president and CEO of Health-ISAC, the healthcare sector’s information sharing and analysis center, told Cybersecurity Dive after speaking on a panel at the conference. 

Michael Daniel, who served as President Barack Obama’s cybersecurity coordinator, called it “an unforced error.”

RSAC Conference is “one of the few places where [technological] shifts can be understood and shaped in real time,” said former CISA senior adviser Lauren Zabierek, “so this absence is deeply felt at an important moment.”

Learning from cybersecurity practitioners

At a time when effective cybersecurity policies require broad and deep engagement with non-government partners, RSAC Conference stands out for the wealth of expertise collected in one place. This year’s conference drew more than 43,000 attendees, according to organizers.

“The caliber of the people we could get in one room during RSAC was unique,” said Jeff Greene, a former senior cybersecurity official at the White House, CISA and the National Institute of Standards and Technology.

“I don’t think there's an event in the U.S. that gets more and better people,” added Greene, now a principal at the consulting firm Civira Partners. “If you care about engagement and understanding broader perspectives on policy, technology or operations, it's still the place you can have the best interactions.”

Bob Lord, a former CISA senior technical adviser who co-led the agency’s Secure by Design project, said RSAC helped government officials get a reality check on the ideas they were pursuing.

“The real world is messy, and talking to so many different kinds of stakeholders is a great way to challenge people's preconceived notions,” said Lord, who has been attending the conference since 1996. As a CISA employee, he said, “I got a tremendous amount of value by coming to RSAC. … I found myself challenged by many different people on a regular basis.”

Many of the conversations on stage and on the sidelines at RSAC address emerging technological and societal challenges that inevitably factor into government actions, said Moira Bergin, the Democratic staff director for the House Homeland Security Committee’s cyber subcommittee.

“When [you’re] not here to hear those conversations,” she told Cybersecurity Dive after speaking on a panel, “then you miss out on learning about what’s next.”

Multiple former officials said the conference helped them develop better and more successful policies.

Lord said he found it “incredibly helpful to hear different nuanced perspectives” on Secure by Design from software vendors and their customers. “All of that got fed back into our work there.”

Zabierek, who co-led the Secure by Design program with Lord, said the success of its industry pledge was “driven in large part by the visibility and real-time engagement the conference enables.”

Allan Friedman, a former senior adviser and strategist at CISA, said “RSAC week was one of the most valuable weeks of the year” when he was in the government promoting software bills of materials (SBOM), digital ingredient lists that improve software supply-chain transparency.

“SBOM was forged and tempered by criticism, suggestion, and feedback from repeated presentations” at RSAC, Friedman said. 

The conference also helped technical experts alert the U.S. government to the dangers of an international export-control regime adding cybersecurity software to its list of restricted technologies. Nick Leiserson, who was then a staffer for Rep. Jim Langevin, D-R.I., a cybersecurity aficionado in Congress, said “we would never have known about this as an issue” if not for conversations at RSAC and other conferences. After learning about the situation, Langevin and other lawmakers repeatedly pressed the White House to renegotiate the provisions.

More recently, President Joe Biden’s administration found the conference to be a venue for frank, if tense, conversations about the impacts of new cybersecurity regulations for critical infrastructure sectors.

“Some of the roundtables and off-the-records I did were brutal, because industry didn’t always love what we were doing, but that’s why you do them — to hear the hard truths and to understand opposing views,” Greene said. “It made our policy better, and it made sure industry knew they were being heard, even if they didn’t like every outcome.”

Relationship-building opportunity

Beyond gathering feedback on planned policies, government officials have also used RSAC to build and strengthen the relationships they rely on every day.

“The interesting thing about cybersecurity in general is that, compared to other national-security domains, you have to do so much more where … the folks who are taking defensive actions on behalf of the whole country are private citizens,” Leiserson said. “So engagement with industry is vital.”

Grant Schneider, who held senior cybersecurity roles in the Obama and Trump White Houses, said that “what would otherwise take months of fragmented research happens [at RSAC] in a few days of direct engagement with vendors and global thought leaders.” The massive conference, he added, “is the most efficient way for government executives to communicate our expectations to the industry.”

In addition, informal gatherings on the sidelines of the conference “can cement relationships that you need when things get rough,” Greene said.

International allies also send representatives to the conference, meaning that its sidelines often turn into impromptu global summits — the kind of events that the U.S. is ill-served by missing.

Unanswered questions on Trump’s cyber strategy

The U.S. government’s absence from RSAC came just a few weeks after the White House released President Donald Trump’s cybersecurity strategy. The document’s brevity and lack of detail — as well as its promise that the administration would “partner closely with industry and academia” — made it even more striking when the government declined to send anyone to San Francisco to elaborate on what the plan would mean in practice.

The White House “has said that they need to put some meat on the bones” of the strategy, Bergin said. “There is a lot of expertise here where they could learn about how to put meat on the bones — what is feasible, what’s not feasible, how the private sector can partner effectively, what’s a reasonable metric to say, ‘This type of policy has reduced risk in this way and is valuable.’”

H-ISAC’s Anderson called the government’s absence “another missed opportunity for them to collaborate.”

“That would have been awesome for them to be here to talk about” the strategy and get “industry perspectives on it,” Anderson said. “There’s not a lot of specificity to it right now. … It’s coming out in a vacuum.”

The Trump administration says it engaged extensively with industry groups before releasing the strategy. But Anderson, the chair of the National Council of ISACs, said “no one’s really understanding what it means or where it’s going to go or how they can play a role in all this.”

Easterly in eye of storm

The Trump administration has never confirmed that it blocked officials from attending RSAC Conference because the event’s organizer appointed Easterly as CEO. But on the same mid-January day that the organization announced her hiring, Nextgov reported that senior administration officials were planning to withdraw from the conference because of it, and within days, RSAC’s schedule no longer listed speakers from CISA and other agencies.

The apparent retaliation “absolutely is worrying,” said Leiserson.

“The main signal the administration is sending is that it continues to allow petty, perceived grievances to drive decisions,” Daniel said. “That decision just harms the U.S. government by limiting insights and curtailing relationships.”

Since leaving CISA, Easterly has been careful not to antagonize the Trump administration, which already rescinded a planned offer of a teaching chair at the U.S. Military Academy at West Point, her alma mater, after right-wing backlash. In an interview with Axios before RSAC, Easterly said she hoped the government returned to the conference “in the coming years,” because “you have to be in the room to build” the trust needed to sustain partnerships.

Or, as Leiserson put it, “The first step in working together is showing up.”