PR's Role in Earning an RSA Speaking Slot (Hint: It's likely not authoring speaking submissions)

I've authored dozens of RSA Conference submissions over the years and have earned some acceptances. I have learned that it’s generally impossible for a comms person (like me) to write a successful entry alone. It’s a team effort, and PR pros serve a super important role that many companies overlook. 

Any strategies to improve a submission’s chances would certainly be welcomed. The RSA Conference 2027 Call for Submissions, which opened last week, expects more than 2,900 entries this cycle, reviewed by more than 80 Program Committee judges, for a fixed and genuinely limited number of speaking slots. Do that math against my own track record and the pattern isn't mysterious. It's a competitive field.

It’s logical why a PR person isn’t the ideal person to write a submission. Nobody on a PR team ran the pen test, deployed the model, or sat in the room when the deal happened. RSAC's own guidance is blunt about what it wants: highly technical, specific, or strategic information, not a market overview. A submission written by someone one step removed from the actual work rings hollow.

For many PR and comms pros, “involvement” in the RSA speaking submission process involves two connected things. First is reminding internal experts when the submission deadline is (it’s October 9), and for the ambitious, creating a workflow so submissions are made on time. Second is watching with an eagle eye for an extension to that deadline, which RSA threatens will not happen (even though it does happen every year).

What PR should be doing 

But there is far more that PR and comms pros could be doing to give their teams the best chance for a speaking acceptance. And while PR teams probably should not be writing entries, they should demand a seat at the discussion table.

Based on a review of what was accepted in 2026, here are some recommendations:

FIRST, DIG DEEPER THAN SURFACE LEVEL FOR A TOPIC.
Push past the hot topic into whatever proprietary evidence sits underneath it. Governance, risk and compliance, AI and ML security, and AI applied to security are projected to dominate 2027 again, which means naming any of them by itself does nothing. Every vendor at the conference will say "agentic AI." What separated the strongest 2026 sessions was a specific thing sitting behind the label. When Agents Fail: What 194,000 Attacks Reveal About LLM Security wasn't a talk about AI agent risk in general. It was built on 194,000 adversarial attacks across more than 30 models, and it came back with something counterintuitive: reasoning improved an agent's security, model size didn't. That's the question PR should actually be asking an expert, not "what topic should we submit on" but "what's the number, the dataset, or the deployment you have that nobody else in this building has?"

SECOND, PICK A FIGHT WORTH HAVING.
RSAC's own guidance treats this almost as a requirement for panels: are there genuinely different opinions here, or is everyone on stage going to agree with each other for forty-five minutes? Agentic AI on Trial: Human Identity or Machine Identity? staged an actual argument, one speaker making the PAM case, another making the machine-identity case, with the audience voting on the outcome. PR is often the one function inside a company that's talked to enough people to know where the real disagreement sits: between the security team and the product team, or between what leadership wants to say in public and what the engineers actually believe. Named honestly, that friction is almost always a stronger submission than either side's polished position.

THIRD, FIND WHO ACTUALLY LIVED IT.
RSAC's list of the ten 2026 sessions selected by more than one Program Committee had eighteen speakers across it, and the common thread among them is hard-won experience. Seven of the eighteen came straight out of the work itself: researchers, engineers, a head of threat intelligence. Dumb Ways to Die: Cybersecurity Edition, one of RSAC's own published examples of a submission that worked, is built around roughly a year the presenter spent inside a genuinely complicated environment spanning more than 90 companies. Nobody could have written that material secondhand. The instinct in most companies is to put the most senior name on the submission. The data says the better question is who actually lived the thing, because that's the person who can still defend it when a reviewer, or a room full of ten-year veterans, pushes back on it.

Determining when you are ready to submit

There's a simple test for whether an idea is a good one: Could ten other cybersecurity experts credibly submit essentially the same session? If the honest answer is yes, it needs a narrower problem, a firsthand detail, or a disagreement nobody else in the room has already had. 

If your team is staring down October 9 with more instinct than evidence, that's exactly the conversation Brands2Life has with clients before a submission goes in. We’re happy to chat more about your RSA Conference plans, including speaking submissions, onsite activity, and your news strategy.