• On the Internet, Nobody Knows You're Not Human — And Nobody's Asking | Written by Marco Ciappelli & Read by Tape3
    Apr 24 2026
    An Analog Brain In A Digital Age — A Newsletter by Marco Ciappelli On the Internet, Nobody Knows You're Not Human — And Nobody's Asking There was a moment — brief, unrepeatable — when the internet felt like a genuinely open place. No profiles. No algorithms deciding what you deserved to see. No one monetizing the fact that you existed. You showed up, you explored, you talked to strangers in other countries about things that mattered to you, and the whole thing felt less like a product and more like a discovery. Like finding a door to another dimension. There's a cartoon that captured that moment perfectly. 1993. The New Yorker. Peter Steiner. Two dogs, one at a computer, and the line that accidentally defined an entire era of the internet: "On the Internet, nobody knows you're a dog." https://en.wikipedia.org/wiki/On_the_Internet,_nobody_knows_you%27re_a_dog It was funny. It was also prophetic. And it was optimistic in a way we've completely forgotten how to be about the web. Anonymity as freedom. Identity as something fluid, chosen, playful. You could be anyone. You could be from anywhere. You could reinvent yourself in real time, with no one to contradict you. Then surveillance capitalism arrived and broke the party. Cookies. Behavioral profiling. The algorithmic panopticon. Suddenly everyone knew everything. You weren't a dog anymore — you were a demographic, a data point, a cluster of purchase histories and scroll patterns. The internet that promised liberation became the most precise identity-tracking machine ever built. Anonymity collapsed under the weight of monetization. Nobody knows you're a dog became everyone knows you're a dog, what breed, what you ate for breakfast, and which vet you Googled at 2am. And now we're in the third act. A Buddhist monk named Yang Mun has 2.5 million Instagram followers. He posts silent morning meditations. He has made over $300,000 since October. Three Buddhist scholars reviewed his content and confirmed: his wisdom isn't grounded in any actual scripture. It just sounds like it is. Yang Mun doesn't exist. He was built with ChatGPT, HeyGen — an AI platform that generates realistic synthetic human video, a face, eyes, a voice, moving and breathing and entirely artificial — and a handful of other tools, by a creator operating inside what's being called "Big Slop": a venture-backed industry that manufactures fake influencers, automates their posting, and scales them to millions of followers while platforms, politely, look the other way. Hat tip to Jack Brewster, whose LinkedIn post on Yang Mun is what started this thread of thought. https://www.linkedin.com/posts/jackbrewster_a-buddhist-monk-named-yang-mun-has-25-million-activity-7451268378499137537-RPB1?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAD_QZMB_jUr1316NWqo3MgG_iFVSPTfDgY The circle has closed. And inverted. We went from nobody knows you're a dog to everyone knows you're a dog to something far stranger: Nobody knows you're not human. The dog is gone. The human is optional. Here's what interests me — and it's not the outrage part, because the outrage is easy and everyone will do it. What interests me is the McLuhan part. Marshall McLuhan said it in 1964: the medium is the message. Not the content. The medium itself. The form of transmission shapes reality more than anything transmitted through it. Yang Mun's fake wisdom is almost beside the point. The scholars confirmed it's scripturally meaningless. But it sounds right — which is precisely the tell. The content was never engineered for truth. It was engineered for the platform. For the algorithm. For the engagement pattern that rewards the feeling of depth over the presence of it. The medium produced the monk. The monk is the message. And if you zoom out — which is what I keep trying to do from Florence, where the stones beneath my feet are five hundred years old and nobody around me is particularly impressed by disruption — you see something that looks less like a technology story and more like a civilization story. We built an internet that promised connection. We built AI to simulate humans. Somewhere along the way we forgot to ask whether any of it was real — or maybe we never quite got around to asking in the first place. Because here's the thing: this didn't happen slowly enough for us to develop a moral relationship with it. There was no adjustment period. No cultural processing. The fake monk didn't represent a fall from grace. It was a first contact situation. We haven't even named what's wrong yet, let alone decided whether it matters. The analog brain — slow, emotional, context-dependent, stubbornly human — is the one thing that still notices the difference between a conversation that carries weight and one that merely carries words. It's not superior in processing power. It's just that it comes from somewhere. From experience. From loss. From the specific, irreplaceable accident of having lived a particular ...
    Show More Show Less
    10 mins
  • From RSAC Conference 2026 Floor to the CSA Report: What Enterprises Are Missing About AI Agents | A Brand Highlight Conversation with Itamar Apelblat, Co-Founder and CEO of Token Security
    Apr 24 2026

    The floor at RSAC Conference 2026 had one dominant frequency, and it was not subtle. Every booth, every hallway, every late-night conversation kept circling back to the same question: how do enterprises adopt AI agents without losing control of them? In a post-conference follow-up, Itamar Apelblat, Co-Founder and CEO of Token Security, translates what he heard on the ground into what the data now confirms.

    Token Security arrived at RSAC with a fresh set of findings, produced in collaboration with the Cloud Security Alliance and released alongside the event. The report, Autonomous but Not Controlled: AI Agent Incidents Now Common in Enterprises, puts numbers to what practitioners already suspected: 65 percent of organizations have experienced an AI agent-related incident in the past twelve months, and 82 percent discovered agents running in their environment that no one had authorized. Only 21 percent have a formal process for decommissioning agents — a gap Itamar Apelblat flags as a low-hanging attack path. The short version from the conversation: visibility is the starting line, not the finish line, and the path from discovery to intent-based enforcement is where most programs are stuck.

    This is a Brand Highlight. A Brand Highlight is a ~5 minute introductory conversation designed to put a spotlight on the guest and their company. Learn more: https://www.studioc60.com/creation#highlight

    GUEST

    Itamar Apelblat, Co-Founder and CEO, Token Security | https://www.linkedin.com/in/itamar-apelblat/

    RESOURCES

    Learn more about Token Security: https://www.token.security/

    Download the CSA + Token Security Report — Autonomous but Not Controlled: AI Agent Incidents Now Common in Enterprises: https://cloudsecurityalliance.org/artifacts/autonomous-but-not-controlled-ai-agent-incidents-now-common-in-enterprises

    Are you interested in telling your story?
    ▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full
    ▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight
    ▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight

    KEYWORDS

    Itamar Apelblat, Token Security, Sean Martin, brand story, brand marketing, marketing podcast, brand highlight, AI agents, agentic AI, non-human identity, identity security, shadow AI, CSA report, Cloud Security Alliance, intent-based access, AI agent governance, agent decommissioning, RSAC Conference 2026


    Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

    Show More Show Less
    7 mins
  • Who's Managing Your Agent Workforce? (And Whose Budget Are They On?) | Lens Four by Sean Martin | Read by TAPE9
    Apr 21 2026

    Every major enterprise platform this quarter — Salesforce Headless 360, Workday Agent System of Record, Microsoft Copilot Studio, SAP Joule, Oracle agentic, ServiceNow Moveworks, IBM watsonx Orchestrate — is pitching a control plane for your AI agents. But none of them is solving the real problem: who inside your organization actually owns the agent workforce, and who's steering it at the speed agents now act?

    In this edition of Lens Four,

    🔍 In this episode:

    — Why Workday's line — "Organizations wouldn't hire thousands of employees without an HR system to manage them. The same discipline is now required for AI agents" — exposes the HR-procurement collision everyone is about to run into

    — Gartner's forecast: by the end of 2026, 40% of enterprise applications will be integrated with task-specific AI agents, up from less than 5% in 2025

    — Why Jensen Huang's CES 2025 line — "IT is the HR department of agentic AI in the future" — is half-right, half-wrong, and why Josh Bersin's reframe (HR teams will be the managers and caretakers of AI agents) gets closer

    — Bain and IDC agreeing that per-seat pricing is ending: by 2028, 70% of software vendors will refactor pricing around consumption, outcomes, or organizational capability — and what that means for the CEO's agenda

    — The contingent workforce market is real money ($171.5B in 2021, projected to $465.2B by 2031 per Allied Market Research) — and why the contingent-labor playbook is the closest analogy for agents

    — Aaron Levie's "tokenmaxxing" as the strategic-prioritization problem nobody is ready for

    — Why the three vendor vocabularies (employee, contractor, software) are all task vocabularies — and why the agent era needs a judgment vocabulary instead

    — The Fourth Lens: the collision between HR and procurement can go two ways (meteor or dressing), but the real steering question lives upstairs with the CEO, COO, and line-of-business leaders

    Fourth Lens: The forced consolidation coming over the next twelve to eighteen months solves the plumbing. It doesn't solve the operating model. The organizations that win the next decade of enterprise work will build both the function downstairs that runs the agent roster and the leadership cadence upstairs that sets direction at machine speed.

    🔗 Full article and references: seanmartin.com/lens-four/whos-managing-your-agent-workforce

    📧 Subscribe to Lens Four: seanmartin.com/lens-four

    🎙 Redefining CyberSecurity Podcast: redefiningcybersecuritypodcast.com

    🎧 Music Evolves Podcast: musicevolvespodcast.com

    🌐 ITSPmagazine: itspmagazine.com

    🎬 Studio C60: studioc60.com

    Sean Martin is a cybersecurity market analyst, content strategist, and go-to-market advisor with more than 30 years of experience across engineering, product development, marketing, and media. He is co-founder of ITSPmagazine (itspmagazine.com) and Studio C60 (studioc60.com), host of the Redefining CyberSecurity Podcast (redefiningcybersecuritypodcast.com) and Music Evolves Podcast (musicevolvespodcast.com), and co-host of On Location (itspmagazine.com/on-location) and Random and Unscripted (randomandunscripted.com). Learn more at seanmartin.com.

    🔎 Keywords: AI agents, agentic AI, digital workforce, Salesforce Headless 360, Agentforce, AgentExchange, Workday Agent System of Record, ASOR, Salesforce TDX 2026, Aaron Levie, Marc Benioff, Joe Inzerillo, Jensen Huang, Josh Bersin, Jorge Amar, Kate Leggett, Gartner AI agents forecast, IDC FutureScape 2026, Forrester agentic AI, Bain SaaS pricing, Deloitte workforce planning, KPMG total workforce planning, McKinsey hybrid workforce, Futurum sameness, Model Context Protocol, MCP, contingent workforce, ManpowerGroup TAPFIN, Allied Market Research, outcome-based pricing, consumption-based pricing, per-seat obsolescence, tokenmaxxing, CapEx vs OpEx AI, systemic HR, superagents, digital employees, HR-procurement collision, total talent management, workforce orchestration, CEO strategic intent, line-of-business leadership, employee vs contractor classification, Sean Martin, Lens Four


    Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

    Show More Show Less
    31 mins
  • Building AI With Guardrails: Inside Stellar Cyber's Human-Augmented Autonomous SOC | A Brand Highlight Conversation with Lisa Liu, Corporate Marketing and Communications Manager of Stellar Cyber
    Apr 21 2026

    RSAC Conference 2026 made one thing impossible to miss: AI is on every sticker, every slide, and every booth. Sorting signal from marketing has never been harder. Lisa Liu, Corporate Marketing and Communications Manager at Stellar Cyber, joins this Brand Highlight to continue a conversation that started on the show floor in San Francisco and was worth picking up again once the noise settled.

    Stellar Cyber has been incorporating machine learning into every layer of its security platform since 2015, well before AI became the marketing default. The position Lisa Liu brings is direct: AI is not a one-size-fits-all solution. A large language model is not the most efficient way to parse log data, and slapping an AI label on existing functionality is not the same as designing for the analyst pain points at every stage of detection, investigation, and response.

    The conversation closes on the autonomous SOC question, where Stellar Cyber argues for a human-augmented approach. Promises of complete autonomy deserve healthy skepticism; guardrails matter, and keeping a human analyst in the loop is what allows AI mistakes to be caught and contained before they cascade. It is a Brand Highlight worth a few minutes for anyone trying to separate AI substance from AI theater in security operations.

    This is a Brand Highlight. A Brand Highlight is a ~5 minute introductory conversation designed to put a spotlight on the guest and their company. Learn more: https://www.studioc60.com/creation#highlight

    GUEST

    Lisa Liu, Corporate Marketing and Communications Manager, Stellar Cyber | On LinkedIn: https://www.linkedin.com/in/lisaaliu/

    RESOURCES

    Learn more about Stellar Cyber: https://stellarcyber.ai/

    View all of our RSAC Conference 2026 coverage: https://www.itspmagazine.com/rsac26

    Are you interested in telling your story?
    ▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full
    ▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight
    ▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight

    KEYWORDS

    Lisa Liu, Stellar Cyber, Sean Martin, brand story, brand marketing, marketing podcast, brand highlight, RSAC Conference 2026, Multi-Layer AI, human-augmented autonomous SOC, machine learning, Open XDR, NG-SIEM, security operations, AI in cybersecurity, agentic AI, SOC analyst, security platform


    Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

    Show More Show Less
    7 mins
  • Cutting Through the Fog of More | A Brand Highlight Conversation with Michael Parisi, Chief Growth Officer of Steel Patriot Partners
    Apr 21 2026

    RSAC Conference 2026 is in the books, and the post-event read is familiar. More vendors, more AI-driven marketing, more noise, and a buyer-side audience that increasingly cannot tell who to trust. Michael Parisi, Chief Growth Officer at Steel Patriot Partners, joins ITSPmagazine for a quick post-event catch-up on what he walked away with, and what is quietly shifting underneath all that volume.

    The headline takeaway is what Michael Parisi calls the "fog of more." Marketing has done its job too well. CISOs and business leaders facing real decisions cannot tell competing solutions apart, do not know where to start, and are not sure their current stack is even the right one. Too much information has become its own information problem.

    What is shifting, according to Michael Parisi, is where the meaningful conversations actually happen. Closed-door, hallway, and dinner conversations have always existed at RSAC Conference, but more people are now openly recognizing that this is where the real industry decisions get made. That recognition is changing how teams plan to engage with future conferences and industry events. For Steel Patriot Partners, which describes itself as business owners first, engineers second, and security and compliance practitioners third, that is exactly the conversation they want to be in.

    This is a Brand Highlight. A Brand Highlight is a ~5 minute introductory conversation designed to put a spotlight on the guest and their company. Learn more: https://www.studioc60.com/creation#highlight

    GUEST

    Michael Parisi, Chief Growth Officer, Steel Patriot Partners | https://www.linkedin.com/in/michael-parisi-4009b2261/

    RESOURCES

    Learn more about Steel Patriot Partners: https://www.steelpatriotpartners.com

    Steel Patriot Partners Assistance Center: https://www.steelpatriotpartners.com

    View all of our RSAC Conference 2026 coverage: https://www.itspmagazine.com/rsac26

    Are you interested in telling your story?
    ▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full
    ▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight
    ▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight

    KEYWORDS

    Michael Parisi, Steel Patriot Partners, Marco Ciappelli, Sean Martin, brand story, brand marketing, marketing podcast, brand highlight, RSAC Conference 2026, RSAC, cybersecurity compliance, fog of more, vendor noise, CISO, GRC, cybersecurity advisory, FedRAMP, CMMC, HITRUST, AI security marketing, hallway conversations, post RSAC


    Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

    Show More Show Less
    7 mins
  • Before the Robots Run. More reflections from RSAC 2026 — The Power of the Community and the Machines We Invited In. | Written By Marco Ciappelli & Read By Tape3
    Apr 19 2026
    This was my twelfth RSA Conference. I know that because I remember the first one, 2012, and I've been counting ever since — not out of habit, but because each year feels like a chapter in a longer story I'm trying to read in real time. Twelve years of standing in that same building in San Francisco, watching an industry evolve, stumble, reinvent itself, and occasionally look in the mirror. In the early years it was pure technology. Cryptography, protocols, threat vectors, the architecture of defense. The conversations were technical, the energy was almost academic, the suits were slightly more formal. Then something shifted — gradually, then all at once, the way things usually do. The industry started talking about people. About culture. About the human beings sitting behind the keyboards and the very human mistakes they were making. The themes started reflecting it: community, togetherness, collective defense. Stronger Together. The Human Element. The Power of Community. Year after year, the message from the main stage was some variation of: we are more than our tools. People are what matter. Connection is the point. And then you'd walk the expo floor and see the booths. I'm not being cynical. The community is real — I've felt it, in the hallway conversations, in the side events, in the faces of people I've been running into for a decade who are genuinely trying to make the digital world safer. That part is true and it matters. But there's a growing gap between what the theme says and what the stage performs. And at RSAC 2026, that gap became impossible to ignore. Because this year, while the badge said The Power of Community, the keynotes were almost entirely about agents. Non-human ones. I wrote about this from a different angle in my first piece from RSAC — the Blade Runner angle, the NPC angle, the question of identity and intent when you can no longer tell the difference between a human action and an autonomous one. But there's another layer underneath that deserves its own space. It's the pattern. The twelve-year arc. An industry spends years — genuinely, sincerely — rediscovering the human element. Putting people at the center. Building a vocabulary around community, ethics, shared responsibility. And then, in what feels like a single conference cycle, it pivots to deploying a parallel workforce of non-human identities that outnumber us in our own systems, operate at speeds no human can follow, take actions no human directly authorized, and — here's the part that should make everyone pause — that a significant portion of organizations deploying them cannot monitor, cannot fully distinguish from human activity, and in many cases cannot stop once they're running. We built the community. Then we populated it with agents and handed them the keys. I kept thinking, walking those corridors, about the resistance. Not as a metaphor — or not only as a metaphor. In every story we've ever told about machines that gained too much autonomy, there's always a moment before the crisis where someone in the room knew. Where the warning existed. Where the design decision was made anyway because the pressure to ship, to scale, to compete was stronger than the instinct to pause. The difference between those stories and this moment is that we're not watching it happen to fictional characters. We're the ones making the design decisions. And unlike software — which you can patch, roll back, update at 3am while everyone is asleep — agents with autonomy and access are a different category of thing entirely. The old mantra of move fast and break things made a certain kind of sense when what you were breaking was a feature. It makes no sense at all when what you're deploying can act, chain consequences, and escalate — faster than any human response team can follow. This is where Asimov becomes relevant again. Not as nostalgia, not as science fiction trivia, but as a genuine design philosophy that the industry would do well to remember. His Three Laws of Robotics weren't invented as a plot device. They were a thought experiment in ethics-by-architecture — what does it look like to build the values into the system before the system runs, rather than hoping to correct the values after something goes wrong? He spent decades of stories showing that even the most carefully designed ethical constraints produce edge cases, contradictions, unintended consequences. But the point was never that ethics-by-design is perfect. The point was that without it, you don't have a fighting chance. We are, right now, at the moment before the laws get written. Some people at RSAC were saying this clearly — not from the main stage, but in the rooms and conversations where the more honest thinking tends to happen. The guardrails exist. The frameworks are being built. But they're being built while the deployment is already running, while the agents are already in the systems, while the governance structures are catching ...
    Show More Show Less
    11 mins
  • Uniquely Familiar: A Lifetime Pouring Passion Into Guitars That Sing | A Brand Spotlight at The NAMM Show 2026 with John Page and Bryan Ray of John Page Guitars
    Apr 18 2026
    At The NAMM Show 2026, John Page walks Sean Martin of ITSPmagazine through a hand-painted electric guitar called the Retablo. The motifs are lifted from the artwork that traditionally sits behind a cathedral altar, reimagined so the saints and icons are not from scripture but from the roots of American music. Sister Rosetta Tharpe. Muddy Waters. Howlin' Wolf. Mahalia Jackson. The canvases themselves are cut from the floorboards of an old church. It is one of the most personal guitars John Page has ever built. The conversation traces the arc of John Page Guitars, the small-batch shop John Page runs after more than 20 years at Fender, where he co-founded the legendary Custom Shop and led guitar research and development. He has now been designing and building guitars for 53 years. What gets made today at John Page Guitars is built by a small team, with John Page handling his own custom work and prototypes while a master builder works alongside him on production models. What makes the instruments different is not one big thing but a series of quiet decisions. John Page mounts the neck to the body with threaded machine inserts and machine bolts instead of standard wood screws, a coupling he believes transfers tone better between neck and body and adds overtone complexity that a conventional bolt-on simply does not produce. A flatter 12-inch radius, a reverse-angled bridge pickup that removes the ice-pick high, a vintage-feeling neck profile. Every decision serves a single goal: an instrument that sings as a complete unit. John Page describes his design philosophy in two short phrases. The first is "uniquely familiar," the idea that a guitar should feel comfortable in a player's hands and recognizable in their eyes while still being clearly its own thing. The second is "balanced asymmetry," an imbalance in which he finds a kind of perfect balance. Both show up in the offset fret markers, the body contours, and even in the restraint of the aesthetic choices that surround the Retablo's portraits. The Retablo itself is where that philosophy leaves the factory floor and becomes something closer to a reliquary. John Page had never painted portraits before. He taught himself, hand-painting each founder of American roots music onto wood reclaimed from a dismantled church, designing and building a custom bridge that routes volume and tone controls into the tailpiece so the body can carry its imagery unbroken. A full documentary exists on the making of the guitar for anyone who wants the layer-on-layer detail. When the talking is done, Bryan Ray of John Page Guitars steps in with one of the new baritone builds to let the instrument speak for itself. Every design decision John Page described is suddenly in the room, audible, as one of his guitars does exactly what he designed it to do. This is a Brand Spotlight. A Brand Spotlight is a ~15 minute conversation designed to explore the guest, their company, and what makes their approach unique. Learn more: https://www.studioc60.com/creation#spotlight GUESTS John Page, Founder, John Page Guitars (Co-Founder, Fender Custom Shop) LinkedIn: https://www.linkedin.com/in/john-page-742b4213/ Bryan Ray, Marketing Director, John Page Classic LinkedIn: https://www.linkedin.com/in/bryan-ray-a63b5419/ RESOURCES John Page Guitars: https://www.johnpageguitars.com/ Meet John Page: https://www.johnpageguitars.com/pages/john-page The Retablo and other Art Guitars: https://www.johnpageguitars.com/pages/john-page John Page Signature Collection: https://www.johnpageguitars.com/collections/guitars The NAMM Show: https://www.namm.org/ Are you interested in telling your story? ▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full ▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight ▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight KEYWORDS John Page, Bryan Ray, John Page Guitars, John Page Classic, Fender Custom Shop, Sean Martin, brand story, brand marketing, marketing podcast, brand spotlight, guitar design, luthier, electric guitar, The NAMM Show 2026, NAMM 2026, Retablo art guitar, Ashburn, Bloodline pickups, American roots music, custom guitars, handmade guitars, boutique guitar builder Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.
    Show More Show Less
    9 mins
  • Do Androids Dream of Security Patches? Reflections from RSAC 2026 — Walking the Floor of the Agentic World | Written By Marco Ciappelli & Read by Tape3
    Apr 17 2026
    Do Androids Dream of Security Patches? Reflections from RSAC 2026 — Walking the Floor of the Agentic World Marco Ciappelli Co-Founder ITSPmagazine & Studio C60 | Creative Director | Branding & Marketing Advisor | Personal Branding Coach | Journalist | Writer | Podcast: An Analog Brain In A Digital Age ⚠️ Beware: Pigs May Fly | 🌎 LAX🛸FLR 🌍 April 7, 2026 This is Marco Ciappelli's Newsletter: An Analog Brain In A Digital Age. This edition draws from ITSPmagazine's on-location coverage at RSAC Conference 2026 in San Francisco. This article — and all of our RSAC Conference 2026 coverage — is made possible with the support of ITSPmagazine's RSAC 2026 sponsors: BLACKCLOAK | Crogl, Inc. | Manifest | Steel Patriot Partners | Skyhigh Security | Stellar Cyber | ESET | Token Security | Object First | Token Watch and listen to the full coverage and all of the conversations we had, including those with our sponsors, at itspmagazine.com/rsac26 Do Androids Dream of Security Patches? Reflections from RSAC 2026 — Walking the Floor of the Agentic World A new transmission from An Analog Brain In A Digital Age — formerly Musing On Society and Technology Newsletter, by Marco Ciappelli The theme of RSAC 2026 was "The Power of Community." Nearly forty-four thousand people descended on the Moscone Center in San Francisco for four days of keynotes, corridor conversations, and expo floor theater. Six hundred exhibitors. Hundreds of speakers. And one word — one concept, one obsession — that swallowed everything else whole. Not community. Agents. AI agents. Autonomous. Self-directing. Capable of taking action, accessing systems, making decisions, and — here's the part nobody says quite out loud — doing all of that while you're asleep, or in a meeting, or standing in line for a mediocre conference coffee wondering if you remembered to turn off the stove. Somewhere between the third and fourth time someone said "agentic AI" to me on that expo floor, I stopped hearing it as a technology term and started hearing it as a sound effect. A drone. A hum. Background noise for a world already running without asking for my permission. The irony of gathering tens of thousands of humans together under the banner of community, only to spend four days talking almost exclusively about non-human workers — that particular irony seemed to float unacknowledged through the air conditioning. And that's when the flashback hit me. Not to any previous RSAC. To a screen. To a world I used to inhabit in the early days of World of Warcraft — before real life staged its intervention and I decided I needed one. In those massive online worlds, NPCs wandered their scripted paths. They had names, routines, dialogue trees, purpose. They looked like characters. They acted like characters. But they weren't. They were behavior patterns wearing a face. And the experienced player learned quickly: don't trust the ones you haven't verified. The convincing ones were sometimes the most dangerous. I kept thinking about that walking those corridors. About all these agents. Already deployed, already running inside enterprise systems, already accessing sensitive data, making tool calls, chaining actions in ways their human creators didn't fully anticipate. The gap between what's been launched in pilot programs and what's actually governed, monitored, and understood is — by most accounts from the conference — vast. Most enterprises are experimenting. Very few have the infrastructure to control what they've set loose. The rest are running something close to shadow agents: identities without owners, actions without accountability, behavior patterns wearing a face. Which brings me, inevitably, to Blade Runner. Not the flying cars. Not the neon rain. The real question at the center of Ridley Scott's masterpiece — and Philip K. Dick's before it — is simpler and far more disturbing: how do you tell the difference? The Voight-Kampff test existed precisely because replicants were convincing. They behaved like humans, responded like humans, even believed they were human sometimes. The problem wasn't that they were dangerous by design. The problem was that nobody could reliably track their intent. That's not science fiction anymore. It's the central problem RSAC 2026 couldn't stop circling. A significant portion of organizations at this point cannot distinguish AI agent activity from human activity in their own environments. The security industry has built its own Voight-Kampff problem — and hasn't finished building the test. The vocabulary had shifted too, from the previous year. At Black Hat last summer, the conversation was about whether to trust agents. At RSAC 2026 it had already moved to identity. To behavior. To intent. One of the sharper ideas surfacing from the keynotes was the distinction between delegation and trusted delegation. Giving an agent a task is easy. Building the security infrastructure to actually trust that delegation...
    Show More Show Less
    11 mins