CIS’s Tony Sager Reflects on AI Governance and Cybersecurity Priorities at RSAC 2026
Summary
Tony Sager’s RSAC 2026 reflections emphasize separating AI governance from AI-assisted GRC, grounding trust in established security practices, and sustaining cybersecurity work through practical outcomes, outreach, visibility, and partnerships.
Key points
- AI governance and using AI to improve governance, risk, and compliance workflows are distinct challenges requiring different assurances and measures of success.
- AI automation does not automatically improve governance; it can accelerate outdated or misaligned processes.
- Sager identifies CIS Controls, CIS Benchmarks, and assessment models as established foundations for trust in changing security environments.
- Attendees are seeking decision-ready outcomes that turn complexity into prioritization and action.
- CIS must renew trust through outreach to newer practitioners and continued visibility in the cybersecurity community.
- Partnerships can extend organizations’ impact in AI-enabled security and governance while preserving independence.
- Sager’s overarching takeaway is to build adaptable, responsible systems and sustain security efforts over time.
Article Details
- Topic
- Reflections on RSAC 2026, focusing on AI governance, trust, governance-risk-compliance practices, and cybersecurity partnerships.
People
Products
CIS BenchmarksThe CIS Critical Security Controls® (CIS Controls®), the CIS Benchmarks®, and assessment models matter not because they are new but because they are deliberately unglamorous: familiar, transparent, and operationallyCIS Critical Security ControlsThe CIS Critical Security Controls® (CIS Controls®), the CIS Benchmarks®, and assessment models matter not because they are new but because they are deliberately unglamorous: familiar, transparent, and operationally