What to Expect at RSAC 2025

Jameson Kush and Becky Bracken, senior editor at Dark Reading, discuss what to expect at RSAC 2025, identifying three simultaneous upheavals creating unprecedented uncertainty in cybersecurity.

Federal Government and CVE Program Funding: Under the current administration, CISA is withdrawing from previously leading roles in cybersecurity, including Secure by Design initiatives and basic program funding. Most critically, CISA announced it would stop funding MITER's oversight of the CVE (Common Vulnerabilities and Exposures) program—described as the "Dewey decimal system for vulnerabilities." This matters significantly because a $37 billion cybersecurity vendor market relies on CVEs for basic business operations. Though CISA ultimately continued funding in the short term (providing 12-18 months of runway), long-term sustainability is uncertain. The EU is developing competing CVE standards, raising concerns about fragmentation. Bracken questions whether private vendors should fill this gap, warning that vendor funding could introduce conflicts of interest, compromising the neutral arbitration role government oversight currently provides.

AI's Dual Impact on Security: AI is reshaping both offensive and defensive cybersecurity simultaneously. Attackers are rapidly adopting AI capabilities. Bracken cites a platform used by attackers (similar to "an Amazon for attackers") that recently added an AI component, allowing non-technical attackers to launch campaigns, translate content into any language, and rebrand material. On the defensive side, while real use cases exist, the industry remains in a testing phase. Agentic AI is emerging as a more specific application, but current large language models require clean, controlled training data to be effective. AI currently cannot code securely, creating challenges for organizations deciding whether to invest heavily in AI tooling versus other security priorities.

Quantum Computing and Cryptography: Quantum computing represents a third major unknown. The timeline is unpredictable—potentially tomorrow or four years away—but consequences are severe: when quantum breaks current cryptography, HTTPS-secured websites and all existing encryption become vulnerable. NIST has released post-quantum standards, and teams must begin updating cryptographic infrastructure. However, enterprise teams face difficult prioritization: should they spend billions preparing for quantum when facing immediate threats like Volt Typhoon?

Enterprise Decision-Making Under Uncertainty: The combination of government withdrawal, AI hype, and quantum uncertainty creates significant challenges for enterprise security teams. With limited data to guide decisions, organizations must navigate simultaneous demands: privatization of previously government-led initiatives, rapid AI deployment, and long-term cryptographic modernization. Bracken emphasizes watching for guidance from government keynotes and observing how industry leaders respond to these transformations.