RSAC 2026 Parties & Networking Events: The Unofficial Guide to San Francisco’s Cybersecurity Social Season

Let’s be honest about how RSAC actually works. You fly to San Francisco, you badge in at Moscone, you sit through a keynote or two, and then – if you’re paying attention – you start to realize that the most interesting conversations of the week are happening everywhere except the official conference floor.

It’s just the reality of what happens when you put 40,000 security professionals in one city for five days. The formal sessions are good. Some of them are great. But the deals, the hires, the partnerships, the conversations that will actually change something – those mostly happen at a rooftop bar in Union Square, or at a whiskey tasting at Fogo de Chão, or on a yacht in China Basin where the only rule is no pitching.

This guide is about that other conference. The unofficial one. The one that runs parallel to the keynotes, at venues all over the city, from the Friday before the official start through the last stragglers on Thursday afternoon.

We’ve mapped out the events worth knowing about, the venues worth understanding, and – for those of you already thinking about where to find us – where the UnderDefense team will be and what we’ll be talking about.

“The most valuable conversations at RSAC happen in rooms where no one is allowed to pitch anything.”

Why the RSAC 2026 Parties Are Actually the Point

There’s a statistic worth sitting with: 47% of RSAC 2026 attendees hold Director-level titles or above. Another third flew in from outside the United States. You will not find that density of senior security leadership gathered anywhere else on the planet, in any single week.

The expo floor is where vendors fight for attention. The keynotes are where the industry takes stock of itself. But the parties – or more precisely, the right parties – are where things actually get decided. Budgets get informally blessed. Vendors get quietly rejected. Talent gets recruited over a beer at 10 PM. A CISO mentions, almost as an aside, that they’ve been burned twice by a certain kind of product and that conversation saves someone in the circle a very expensive mistake.

This dynamic has been true at RSAC for years, but 2026 marks something of an inflection point. The era of the open-invite mega-party is fading. What’s replacing it – what you see in the best events this year – is more deliberate, more persona-specific, and honestly more valuable. Smaller dinners. Invite-only yacht receptions. Breakfast roundtables with 12 people and a strict no-vendor-pitch rule. The industry has figured out that 800 people in a room is a party, but 15 people in the right room is a strategy session.

If you only have time to absorb one idea from this guide: be selective. Going to everything is the same as going to nothing. A Tuesday night where you attended four events and had no conversation longer than four minutes is a wasted Tuesday night.

The Weekend Before: March 20–22

Most RSAC attendees don’t think about arriving before Sunday. That’s a mistake, and a correctable one.

The Friday and Saturday before the official conference is BSidesSF territory – the community-driven event that runs alongside RSAC and attracts the practitioners who care more about technical depth than vendor visibility. BSidesSF has a different energy than the main conference. Less polished, more honest. The conversations at BSidesSF afterparties tend to be more technically substantive than anything you’ll find at the expo.

Friday, March 20

The BSidesSF 2026 Happy Hour at 149 Maiden Lane, hosted by Formal, Scanner, and Cotool, runs 5:30–8:30 PM. This is the week’s opening bell for the technical crowd. It’s small, it fills up, and request an invite early if you want in.

Saturday, March 21

Two events worth knowing about. The (un)official  BSidesSF Rooftop Afterparty at Chotto Matte (50 O’Farrell St), hosted by Aikido, Chainguard, Sublime, Tailscale, and Torq – runs 5:00–7:30 PM. Chotto Matte is a good venue for this kind of thing: rooftop, Union Square views, feels special without being fussy. Then Vega’s official BSidesSF Party kicks off at 6:30 PM in Participant Hall – BSidesSF badge required.

Sunday, March 22: Things Start to Get Serious

Sunday is when the energy shifts. The technical community events give way to executive programs, and you start to see the CISO circuit activate. Three things are worth noting:

Time	Event	Venue	Host(s)
4:30–7:00 PM	Pre-RSAC with Spades: Cybersecurity for National Security	Private venue near Fisherman’s Wharf	Spades Institute & Rapidfort
5:00–9:00 PM	Fundable or Dead in the AI Era — Exclusive Penthouse for Cyber Founders & VCs	401 Harrison St	Cracken
5:30–8:00 PM	Party for Marketers at RSAC 2026	Novela, 662 Mission St	Cybersecurity Marketing Society
6:00–8:00 PM	Art Gallery BSides Debrief	Address shared upon RSVP	Formal & Corridor
6:00–9:00 PM	Calm Before the Storm	Local Edition, 691 Market St	Aspiron Search, Nullify, Lockstep & Miscreants
6:00–9:00 PM	Pre-RSAC CISO Mastermind Dinner	Upscale restaurant near Moscone	Gigamon
6:00–10:00 PM	Rooftop BSidesSF After Party & RSAC Opening	221 Main St	RunReveal, cside, Keycard, Tracebit & Socket
6:00–10:00 PM	SecOps Leaders Community Event	Address shared upon RSVP	Exaforce

The CyberMarketing Society’s Party for Marketers at Novela deserves a separate mention even though it appears in the table above. If you work on the go-to-market or communications side of cybersecurity, this is legitimately one of the best events of the week – a rare gathering of people who share your specific professional context, without the usual dynamic of being the “marketing person” at a table full of engineers. It’s worth going to even if you arrive tired from travel.

Monday, March 23: Government, Tradition, and Kickoff Energy

Monday has a split personality, and both sides of it are worth understanding.

The morning is government day. Carahsoft’s 13th Annual RSA Public Sector Day at the Hilton SF Union Square (8 AM–3 PM) has become its own institution within the institution – the essential gathering for federal, military, and state/local government security buyers and the vendors trying to reach them. If public sector is part of your world, this isn’t optional.

By early afternoon the energy starts to shift toward the commercial market, and by evening Monday is just…a lot of things happening simultaneously. Here’s the map:

Time	Event	Venue	Host(s)
3:00–5:00 PM	Exclusive Happy Hour at The Olympic Club	The Olympic Club, 524 Post St	Echelon Risk + Cyber
4:00–7:00 PM	The Modern CISO: Cogent x Anthropic Fireside Chat	Address shared upon RSVP	Anthropic & Cogent Security
4:30–6:30 PM	RSAC CISO Panel & Reception	The Vault Steakhouse, 555 California St	Cyberhaven
4:30–6:30 PM	RSAC 2026 CISO Happy Hour	DECANTsf, 1168 Folsom St	Arctic Wolf
4:30–7:30 PM	Night at the Mercantile	The Box SF, 1069 Howard St	Dune Security, Abstract Security, Reality Defender
5:00–7:00 PM	PwC’s Underground Cyber Lounge	Local Edition, 691 Market St	PwC
5:00–8:00 PM	Cyber Leaders VIP Reception	680 Folsom St	Trident, AWS, CyberArk Ventures & Davis Polk
5:30–7:30 PM	RSAC 2026 Happy Hour (Scanner & Monad)	Fang, 660 Howard St	Scanner & Monad
5:30–8:30 PM	Founders & Friends Happy Hour	House of Shields, 39 New Montgomery St	Runtime Ventures
6:00–9:00 PM	RSAC Kickoff Party	Chotto Matte, 50 O’Farrell St	FireMon, Fortinet, Illumio, Armis & Keyfactor
6:00–9:00 PM	Darktrace After Dark	Novella, 662 Mission St	Darktrace
6:00–9:00 PM	Agave After Dark: Curated Tequila & Candid Conversations	ZOÉ Cocktail Bar, 579 Howard St	Rad Security
6:00–9:00 PM	The Rumble After Party	Hawthorn SF, 46 Geary St	Commvault, Kyndryl & Purestorage
6:00–10:00 PM	The Old Fashioned Future — Whiskey Tasting	Fogo de Chão, 201 3rd St	Synack
6:00 PM–1:00 AM	CSides San Francisco 2026	LinkedIn HQ, 222 2nd St	Knostic, TachTech & Confide
6:30–9:00 PM	Guidepoint RSAC Happy Hour	The Grand, 520 4th St	Guidepoint
6:30–10:30 PM	The Calm Before	Temple SF, 540 Howard St	Vanta
7:00–9:30 PM	🌮 CYBERTACOS is Back for RSAC 2026	Merkado SF, 130 Townsend St	W2 Comms, NightDragon, Lasso, Carahsoft & N2K Cyberwire
7:00–9:30 PM	Rockin’ Mocktails 2026	KPMG Building, 55 2nd St	Sober in Cyber
9:00 PM–12:00 AM	CISO Karaoke	Pandora Karaoke, 50 Mason St	TRIDENT CONNECT
9:00 PM–Late	CISOs x Founders Speakeasy	TBA	The Founders House

CYBERTACOS. It keeps coming back, it keeps being good, and it keeps being one of the more genuinely fun events of the week. W2 Communications, NightDragon, Lasso, Carahsoft, and N2K Cyberwire co-host it at Merkado SF, and the crowd there tends to be less self-serious than some of the evening’s other options. If you’re between events and need somewhere to land, CYBERTACOS is your safe harbor.

Synack’s whiskey tasting at Fogo de Chão is worth calling out specifically. Fogo de Chão is already a venue that puts people in a good mood, and a well-run whiskey tasting creates exactly the kind of relaxed, sensory environment where people drop their conference-face and have actual conversations. These events work because shared physical experience – tasting something, reacting to it together – does more relationship-building work in 30 minutes than most breakout sessions do in 90.

Tuesday, March 24: The Big Day (And Night)

Tuesday is the day that defines RSAC week for most people. It’s the day when every major vendor makes their social investment, when the entertainment gets serious, and when the sheer density of overlapping events requires you to make hard choices.

It starts, improbably, at 6:15 AM. The Netskope Fun Run across the Golden Gate Bridge has become a genuine RSAC tradition – an early morning slice of normalcy before the day gets overwhelming. It also, practically speaking, gets conversations going with people before anyone has had a chance to become their conference-persona. There’s something disarming about talking to the CISO of a Fortune 500 company at mile three of a run. Recommended if you can drag yourself out of bed.

Daytime: Where the Serious Work Gets Done

Cyera’s Dataverse Café at the Hyatt Regency SoMa is a good spot for a midday reset. Infinigate’s CyberLunch at Top of the Mark (noon–3 PM) has views of the city that make it hard to be stressed about anything, which is probably the point.

Tuesday Evening: Pick Carefully

Time	Event	Venue	Host(s)
4:00–6:00 PM	Cyber Lounge – Live Music & Happy Hour	The Cyber Lounge, 145 4th St	MorganFranklin Consulting
4:00–7:00 PM	World Whiskey Tour @ RSAC	1 Montgomery St	AegisAI Security
5:00–7:00 PM	Security Leaders Reception	Address shared upon RSVP	Ballistic Ventures, Rubrik & Holly Ventures
5:00–7:00 PM	Google Cloud Security — Tasting Tuesday	SF Marriott Marquis	Google Cloud Security
6:00–9:00 PM	AI & All That Jazz	The Dawn Club	Harmonic & Intruder
6:30–8:30 PM	Starlite Soirée	Beacon Grand Hotel	Elastic, AWS & Tines
7:00–10:00 PM	After Dark — Ping Pong Night	SPIN SF	Cloudflare
7:30–10:30 PM	Mortal vs. Machine: BarOne Closing Night	BarOne at Moscone North	SentinelOne
8:00 PM–Late	After Dark — Busta Rhymes Concert	The Warfield, 982 Market St	Abnormal AI
8:00 PM–Late	Surf the Galaxy — Year 2125	SFMOMA, 151 3rd St	HackerOne

Abnormal AI has reserved The Warfield and booked Busta Rhymes. Full stop. If you want to understand what it looks like when a vendor is making a statement about where they believe they sit in the market, this is it. The Warfield is a legendary venue and Busta Rhymes is a real headliner. This event will be talked about.

HackerOne’s Surf the Galaxy party at SFMOMA is a different kind of ambitious. A futurist theme – “Year 2125” – inside one of the better contemporary art museums in the country. It’s a thoughtful choice for an event that wants to open conversations about AI and the long arc of security without feeling like a product pitch. These two events – The Warfield and SFMOMA – are happening at roughly the same time on Tuesday night, which means you’ll need to decide what kind of Tuesday you want.

For something more low-key and genuinely fun, Cloudflare’s ping pong night at SPIN SF is the answer. Physical game, relaxed atmosphere, easy to meet people. Don’t underestimate it.

The AI Thing: Some Honest Context

Half the events on Tuesday have some version of AI in their marketing. That’s the reality of where the industry is in 2026. Some of it is genuine – the OWASP GenAI Security Summit on Wednesday, for instance, is actual substantive engagement with real implementation questions. Some of it is the word AI dropped into event copy because the word AI is in all event copy right now.

The signal worth paying attention to is which vendors are using AI as a mechanism for engagement versus which ones are using it as a talking point. SentinelOne’s live “Mortal vs. Machine” demos at BarOne, where attendees go head-to-head against their Purple AI platform, fall into the first category. It’s experiential. You can evaluate it yourself in real time. That’s different from a party with “AI” in the theme that is otherwise just a party with AI in the theme.

On AI and the SOC:  We’ve watched the AI narrative at RSAC evolve for several years, and we have a perspective on it. The vendors who lean hardest on AI automation often have the most opaque incident triage processes. Their customers get alerts back without context, without clear next steps, without anyone having talked to the affected user. Our ng AI SOC uses machine intelligence where machines are actually better – pattern recognition at scale, enrichment, initial triage – and human analysts where humans are irreplaceable: judgment, communication, the phone call to figure out whether they actually made that configuration change or whether their account has been compromised. That distinction matters more than most marketing copy acknowledges.

Wednesday, March 25: UnderDefense & Cracken Channel Partners Appreciation Night

After three days of booth shifts, back-to-back demos, and conversations you had to perform energy for even when you were running on fumes – Wednesday evening deserves to be different.

This one is ours to host, and UnderDefense and Cracken are hosting it for the people who made our year possible.

On Wednesday, March 25th from 5 to 8 PM, we’re holding a Channel Partners Appreciation Night at a penthouse in SoMa – a ten-minute walk from Moscone, which means you can get there before the post-conference rush. The gathering is small by design. We want the people in the room to be able to have real conversations, which rules out anything resembling a convention hall.

Why We’re Doing This

UnderDefense has grown 84% year-over-year in ARR, and the honest answer to how that happened is that our channel partners made it happen. The VARs, MSPs, and resellers who understand our value proposition well enough to bring us into their customers’ environments – and who trust us enough to stake their own reputations on that recommendation – are the backbone of what we’ve built. That kind of partnership sustains itself on evenings like this one, where there’s no agenda, no slide deck, and no one asking you to sit through another product overview.

The bourbon is good. The view from the penthouse is better. But the actual point is to spend three hours with the people who’ve been in the trenches with us, without anyone needing to be “on” for any particular reason.

What to Expect

• Premium bourbon and craft cocktails – properly selected, not the default open-bar situation
• A room intentionally kept small so conversations don’t get swallowed by noise and crowd
• Peers who understand exactly what the past three days have been like, because they lived the same ones
• No pitch. No deck. No awkward product mention sandwiched between small talk.

Event Details

Date & Time	Wednesday, March 25 | 5:00 PM – 8:00 PM PT
Venue	Penthouse, SoMa area – 10-min walk from Moscone (exact address shared after confirmation)
Dress Code	Business Casual
What’s Included	Premium bourbon, craft cocktails, and real conversation with your peers
Who’s Invited	Current and prospective channel partners – VARs, MSPs, and resellers
Capacity	Limited – private gathering, invitation-confirmed only
Your Host	UnderDefense & Cracken

One More Thing

There’s a version of RSAC week where you show up, run hard from Sunday to Thursday, and fly home with a full calendar of follow-ups, a dead phone battery, and a vague sense that it was all worth it but you’re not entirely sure what you’re bringing back.

There’s another version where one or two evenings in the week actually refilled your tank instead of draining it further. Where you had a conversation that reminded you why this work matters and why the right partnerships make it better. Where you left a room feeling genuinely appreciated rather than just attended to.

That’s what Wednesday night is supposed to be. We’d like you there.

Thursday, March 26: The Day You Actually Use Everything You Learned

Practically speaking, Thursday is for follow-up. The conversation you had Monday evening that you meant to continue. The person you met at a party who mentioned something about their IR process that you want to understand better. The meeting you agreed to schedule “sometime this week” that you haven’t scheduled. Thursday is when you do that work, or it doesn’t get done.

The connections you made in San Francisco are only as valuable as what you do with them in the 10 days after you leave. That’s true every year, and it gets forgotten every year, and it’s worth saying out loud.

The Thing That Actually Matters

RSAC 2026’s theme – Power of Community – sounds like conference marketing until you’ve actually lived through the week and felt what it describes.

Somewhere in that week, if you’re paying attention, you’ll have a conversation that couldn’t have happened anywhere else. With someone who has a complementary perspective on a problem you’ve been carrying. In a venue that made it easy to be honest. At a time of night when the professional performance has worn off and people are just talking.

Those conversations are what you’re actually going to San Francisco for. The parties are the infrastructure. The real event is whatever happens between two people who found each other in the right room at the right moment.

Show up prepared. Be selective about where you spend your time. Stay in the conversations that matter. And when you get home and the week has faded and you’re back in your normal environment dealing with the same problems you had before you left – remember which of those conversations you still want to continue.

That’s the part that turns a conference into something with a lasting return.

The post RSAC 2026 Parties & Networking Events: The Unofficial Guide to San Francisco’s Cybersecurity Social Season appeared first on UnderDefense.