RSAC and Black Hat: Getting Value From the Worst Week to Announce Anything

RSAC Conference (formerly RSA Conference) and Black Hat are the two fixed points in the security calendar, and they distort behavior around them in a predictable way. The next ones are RSAC 2027, April 5 to 8 at Moscone Center in San Francisco, and Black Hat USA 2027, July 31 to August 5 at Mandalay Bay in Las Vegas.

Companies save announcements for the conference on the theory that the audience is concentrated there. The audience is concentrated. So are many competitors' announcements, which is why I'd give routine company news its own window. RSA Conference PR that works plans around that: brief reporters in the weeks before the show, announce real news two to three weeks ahead or after it, and use the week itself for meetings, research talks and customer conversations.

In my experience, the companies that get the most from these events do most of the work before the event starts.

Key takeaways

• RSAC 2026 drew nearly 44,000 attendees, more than 600 exhibitors and about 400 members of the media, according to the organizer's closing release, so exhibitors outnumbered reporters.
• Vendor staff can't count on a press badge: RSAC doesn't give media credentials to anyone attending in a sales, marketing or PR capacity, and Black Hat's 2026 media page said marketing and PR professionals would not be accepted.
• RSAC's Innovation Sandbox takes 2027 entries from December 1 to January 14. Each of the 10 finalists must accept a $5 million SAFE from Crosspoint Capital, and the winner is featured in an RSAC press release.

What happens to an announcement during RSAC week?

Security reporters covering RSAC are fielding a flood of pitches and running from briefing to briefing, and a lot of what they file that week is roundups. The arithmetic is against you: RSAC 2026 drew nearly 44,000 attendees, more than 600 exhibitors and about 400 members of the media, which is more exhibitors than reporters. A funding announcement or product launch released that week may end up as a paragraph in a roundup, though strong news can still earn a standalone story.

Much of the coverage that does emerge is thin. A mention in a roundup is not the same asset as a substantive feature, and it's easy to spend a quarter's budget and come home with a sentence.

How should you time RSA Conference PR?

The timing I recommend for RSA Conference PR puts the briefings and the news in the weeks before the show, and holds anything left over until after it.

Brief before the show. I recommend offering briefings in the weeks before the conference and checking each reporter's availability rather than assuming they'll have time on site. A relationship built in the quiet period gives you a real shot at a story; a pitch during the keynote rarely goes anywhere. Even the in-person slots get settled early: RSAC runs media one-on-one meeting rooms during the show, and the details for booking them go to approved press in the weeks before it.

Announce two to three weeks out. Your news gets considered on its own terms, and if the reporters who matter have already written about you by the time the conference arrives, I think they're more likely to include you in what they publish that week.

Or wait until after. In my experience the weeks after a major conference are quieter, and your announcement is no longer competing with the conference itself. Coverage of the event itself can run on for a while, so check what the reporters you want are still writing before you set a date.

The announcements that clearly belong during the week are ones tied to the event itself: research being presented, a keynote, an award. Other news can still work that week if it's strong enough to stand on its own, but I'd want a reason it can't go early.

What are RSAC and Black Hat actually good for?

RSAC and Black Hat are most useful for the things that need everyone in one place: meeting reporters, presenting research, entering startup contests, talking to customers and seeing what competitors claim.

Meeting reporters in person. This is the real value and it's routinely wasted. Security journalists attend, and in my experience a fifteen-minute in-person conversation builds more than months of email. Book the time ahead rather than counting on finding them free on site. I'd make relationships the goal for the week, not placements. Plan to pay for the badge: RSAC doesn't give media credentials to anyone attending in a sales, marketing, PR or other vendor capacity, and Black Hat's 2026 media page said marketing and PR professionals would not be accepted (its 2027 page isn't up yet).

It works the same way outside security shows. One developer-space client came to us two or three weeks before KubeCon wanting meetings at the show. They weren't sponsoring, so there was no organizer media list to work from. In that window we lined up 20 meetings with analysts and reporters.

Original research presentations. Black Hat in particular rewards genuine technical research, and a talk accepted there is a credential no amount of marketing buys. Its Briefings are picked by a review board, Black Hat says it does not support pay-for-play Briefings, and its terms disqualify product pitches and submissions from PR firms. RSAC's speaking call draws more than 2,900 submissions, and its own FAQ warns that "it is very clear on the review end when a marketing or PR person is tasked with the submission." When we help an executive prepare a speaking proposal, we first read the previous year's agenda for who spoke, which job titles were on stage and whether vendors get programmed at all. At Black Hat, the researcher or speaker has to submit the proposal. This is a months-long process, not a marketing decision made in the spring. Black Hat's 2026 call closed March 23 for an August show, and RSAC's 2027 call closed October 15.

Startup contests. These are the exception to the rule about announcing elsewhere, because the organizer does part of the announcing for you. RSAC's Innovation Sandbox names 10 finalists, and to be picked a company must accept a $5 million uncapped SAFE (Simple Agreement for Future Equity) from Crosspoint Capital, plus a side letter of investor rights, so it is a financing as well as a stage. Finalists pitch for three minutes on the conference's first day, and the winner is featured in an RSAC press release. Geordie AI won in 2026, ProjectDiscovery in 2025. The 2027 contest takes entries from December 1 to January 14 from privately held companies with under $5 million in annual recurring revenue and a product launched between December 1, 2025 and January 10, 2027. Under its 2026 rules, Black Hat's Startup Spotlight was open to companies five years old or younger with fewer than 50 employees, required no booth and started with a five-minute video. In 2026 entries closed May 27, four finalists pitched in August, and Opnova won.

Customer conversations. If your customers are on the floor, it's a good week to ask whether they'd be willing to speak publicly, because you're face to face and the ask is easier.

Competitive intelligence. Walking the floor shows you what the competitors who exhibit are claiming this year, which is genuinely useful for positioning and costs nothing beyond the pass.

What to stop spending on

Booth scale as a signal. A larger booth reaches attendees who were already going to walk past. On its own it won't get you in front of the reporters or analysts who shape the category; meetings booked in advance will.

Conference-timed press releases with no story. The wire distribution costs real money, and the syndication it produces is distribution, not a newsroom choosing to cover you.

Parties as a strategy. Fine as relationship maintenance. Not a communications program.

The practical plan

My starting point is to begin reaching out to reporters six to eight weeks out about something substantive. Announce your actual news two to three weeks before the conference so it has room to be covered properly. Use the week itself for in-person relationship building, research presentation if you have it, and customer reference conversations. Hold anything remaining until after the show, and check reporters' schedules before you set the date.

Common questions

Should security companies announce news at RSAC? Usually not during the conference itself, in my view. Hundreds of companies are competing for the same reporters that week, and a lot of conference-week news ends up in roundups. Announcing two to three weeks earlier, or after the show, gives the story more room, though strong news can still earn standalone coverage during the week.

What is RSAC Conference actually useful for? In-person access to reporters and analysts, customer conversations that are easier face to face, research presentation, and competitive intelligence from the show floor. Book reporter time before you arrive, and plan to buy a pass: RSAC doesn't give media credentials to people attending in a marketing or PR capacity.

Is Black Hat different from RSAC? Black Hat skews more technical and rewards genuine security research. Its Briefings are chosen by a review board that disqualifies vendor pitches, so an accepted talk carries credibility that marketing spend can't replicate, but submission is a months-long process.

When should you brief reporters about conference news? Start reaching out six to eight weeks ahead, while reporters still have room on their calendars, and agree briefing dates with each one. During the conference their schedules are packed.

Is RSA Conference a big conference? Yes, by the organizer's own count. RSAC 2026 in San Francisco drew nearly 44,000 attendees, more than 600 exhibitors and about 400 members of the media. With more exhibitors than reporters, press attention that week is scarcer than the attendance suggests. RSAC 2027 runs April 5 to 8 at Moscone Center.

Does booth size matter for security marketing? Not on its own for the audiences that shape the category. A bigger booth reaches attendees already walking past; reporters and analysts are better reached through meetings booked in advance.

Sources

• RSAC, RSAC Conference Closes 35th Annual Flagship Event Backed by The Power of Community, PR Newswire, March 27, 2026
• RSAC, Media (RSAC 2027 media credentials), accessed November 8, 2026
• RSAC, Call for Submissions and FAQ, accessed November 8, 2026
• RSAC, Innovation Sandbox and How it Works, accessed November 8, 2026
• RSAC, Geordie AI Named "Most Innovative Startup" at RSAC 2026 Conference Innovation Sandbox Contest, PR Newswire, March 23, 2026
• RSAC, ProjectDiscovery Named "Most Innovative Startup" at RSAC 2025 Conference Innovation Sandbox Contest, PR Newswire, April 28, 2025
• Black Hat, Upcoming Events, accessed November 8, 2026
• Black Hat, Black Hat USA 2026 Successfully Closes with Focus on AI Security and Emerging Threats, August 11, 2026
• Black Hat, Black Hat USA 2026 Media Registration, accessed November 8, 2026
• Black Hat, Call for Briefings, accessed November 8, 2026
• Black Hat, Black Hat USA 2026 Startup Spotlight Competition and Global Startup Spotlight Competition, accessed November 8, 2026

Salient PR works with security and compliance companies on media relations, research publication and event-adjacent campaigns. Conference dates, figures and rules come from the organizers' own pages as of November 2026.