I just got back from RSAC 2026 in San Francisco. I've been going for years and every year has a vibe. Last year was the year AI crashed the security party. This year? AI wasn't crashing anything. It was the party.

Honestly, if you blindfolded me and dropped me on the expo floor, I would've guessed I was at an AI conference that happened to have some security vendors. Not the other way around.

From AI to Agentic

Last year, everyone was bolting LLMs onto their existing products and calling it innovation. This year, the buzzword evolved: agentic. AI agents everywhere. Agentic workflows. Agentic detection. Agentic response. Agentic everything.

The pitch at almost every booth followed the same formula: "Our platform now has AI agents that autonomously do X." Cool. But when you pressed on what that actually means for the customer — what outcome it drives, what workflow it replaces, what metric it moves — things got fuzzy fast.

Wiz apparently felt the same way. They set up a "No AI Zone" at their booth. I respect the move. When literally everyone is shouting the same thing, sometimes the loudest statement is silence.

AI Is a Feature, Not an Outcome

Here's my biggest takeaway, and I'll be blunt: the industry is confusing capabilities with outcomes.

"We have AI" is not a value proposition. It's a feature. And features don't close deals with CISOs who have real problems and shrinking patience for hype.

The pitch I heard over and over was some version of: "Bad actors are using AI, so you should be too." That's fear-based marketing dressed up as strategy. It's not wrong — adversaries are absolutely using AI — but "keep up with the bad guys" is not a compelling reason to rip and replace your security stack.

What I never heard enough of: what does agentic AI let me do that I literally could not do before? Not faster. Not cheaper. New. What investigation can I run that was impossible? What decision can I make that I didn't have the data for? What class of threat can I now detect that was invisible?

That's the conversation the industry needs to have. And almost nobody is having it.

More New Companies Than I've Ever Seen

We work with a lot of early-stage cybersecurity companies at Good Code — it's our bread and butter. This year, the number of new startups on the floor was noticeably higher than any year I can remember.

That tells me something important: AI is lowering the barrier to entry. You can stand up a security product faster than ever. The tooling is better, the models are accessible, and the infrastructure is commoditized.

That's great for innovation. It's also going to create a brutal shakeout. When everyone can build a product, the companies that win will be the ones that tell a clear story about outcomes — not the ones with the most impressive demo of an AI agent doing something cool in a controlled environment.

The Vibes Were... Different

No animals on the expo floor this year. No monster trucks. No F1 cars. The spectacle has dialed back a bit, though the booths themselves were still wild — massive builds, creative activations, and production quality that keeps going up.

The energy felt more focused. Less "look at us" and more "here's what we built." Whether that translates to better products remains to be seen, but the shift was noticeable.

What I'd Tell Product Leaders

If you're building in security right now, here's my unsolicited advice:

Stop leading with AI. Your customers are drowning in AI messaging. Every vendor they talk to says the same thing. You will not differentiate by having AI. You'll differentiate by solving a problem so clearly that the customer doesn't care whether AI is involved or not.

Start with the outcome. What can your customer do now that they couldn't do yesterday? If your answer requires the word "AI" in the first sentence, you haven't found it yet.

Show, don't tell. A before/after demo that shows a real workflow — real alerts, real triage, real resolution — will close more deals than any pitch deck full of AI architecture diagrams.

The companies that figure this out are going to eat the ones that don't. The bar to build has never been lower, which means the bar to matter has never been higher.

At Good Code, we help cybersecurity and AI companies design and build products that tell clear stories about outcomes — not features. If you're building something in this space and need a design and engineering partner who actually understands the domain, let's talk.