Founder narrative locked T-30 to T-7.
Deliverables (3)
- ▸T-30 to T-7
- ▸30-account cluster
- ▸CISO intro engineering


FORKOFF RSA Conference activation is a 14-day operating cycle for AI security, cybersecurity, and security-tooling B2B SaaS founders shipping enterprise-tier security stack into the CISO buyer cluster in San Francisco. Pre-event narrative, on-site cadence at Moscone, post-event compounding, audit-tracked outcomes.
Most teams pay $75K for a Moscone booth and an Innovation Sandbox slot. Some host a SoMa-side dinner and bounce. FORKOFF runs the RSAC week as a 14-day operating cycle.
Anonymized post-engagement. Names surfaced are RSA Conference 2025 ecosystem operators FORKOFF either ran intros into or co-attended Innovation Sandbox sessions with.
The CISO ecosystem compounds in ways no other security-conference week does. 41k attendees plus Innovation Sandbox density plus AI security buyer concentration inside one 4-day SF window.
CISOs + security buyers concentrated across Moscone plus the Innovation Sandbox circuit plus the SoMa side-event web.
Enterprise IT buyers, security tooling SaaS founders, and AI security researchers all in-market across the same 96-hour window.
Side events make CISOs and security operators reachable in 30-person rooms.
InfoSec Twitter and Dark Reading press cluster compound on residual.
The week breaks into a Moscone main-stage cluster, an Innovation Sandbox circuit, and a SoMa side-event web running parallel. Activating well means picking the right stripe of the week.
Apr 27-30, 2026
Main stage at Moscone Center (North + South + West halls). Innovation Sandbox at Moscone West. CISO and operator side events concentrated in SoMa around the InterContinental, the W, and the Marriott Marquis. Tour de RSAC dinners across SoMa.
41,000+ in 2025: 36% CISOs + security buyers + enterprise IT, 24% security tooling SaaS founders + product leaders, 22% security analysts + threat researchers + AI security cluster, 18% press + KOLs + MSSPs.
Where the buyer-relevant rooms live. Pick 2 max for any single activation week.
Two prior cycles run on the FORKOFF audit ledger. AI security SaaS pre-launch, cybersecurity tooling devrel narrative. Both ledger entries delivered within T+30 of close.
Four days across Moscone North, South, and West halls, the RSAC Innovation Sandbox circuit, and the SoMa side-event web. Pre-event narrative, daily on-site cadence, post-event clip cascade. One operator carries every phase. Every phase closes with a ledger entry.
Founder narrative locked T-30 to T-7.
Daily founder posts from Moscone, Mon-Thu of RSAC week.
On-site CISO KOLs, Dark Reading + SC Media voices, and InfoSec Twitter operators activated through bot-screened placements.
Clip cadence compounds T+1 to T+30.
Strategy 12 weeks out. Production 4 weeks out. Execution event week. Compounding 30 days post. Each phase closes with a ledger entry.
Sample schedule for a Standard-tier engagement. Tier-specific deliverables shown in the next section.
| Day | Date | Motion | FORKOFF owns |
|---|---|---|---|
| Sun (D-1) | Apr 26, 2026 | Land in SF · pre-event Tour de RSAC SoMa dinner setup | Venue + invite list + intro choreography |
| Mon | Apr 27 | Opening day attendance · founder posts from Moscone main floor | Daily post + on-site clip cadence |
| Tue | Apr 28 | ICP-account 1:1 meetings · Innovation Sandbox attendance | Meeting calendar + CISO intro routing |
| Wed | Apr 29 | FORKOFF side event (CISO roundtable / panel / dinner) | Production + KOL invites + recording |
| Thu | Apr 30 | On-site podcast recording day · 3-4 founder + CISO interviews | Studio + production + same-week clip pipeline |
| Fri | May 1 | KOL placements live · partnership-conversation closes | KOL ledger + per-post tracking |
| Sat | May 2 | Founder thread recap of week · InfoSec Twitter cluster reciprocation | Thread craft + cluster activation |
| Sun (D+7) | May 3 | Departure · post-event clip cascade live | Distribution sequencing + audit ledger weekly |
Three RSAC-circuit campaigns, three lanes: AI security pre-launch, cybersecurity devrel narrative, post-event CISO compounding.
Pre-event narrative across 14 days locked the founder's positioning across the CISO cluster before they landed in SF. Side-event roundtable + podcast recording fed a 14-clip post-event cadence. Audit ledger closed T+30 with qualified-pipeline math skewed enterprise security buyers.


Single-track Lite tier: 14-day pre-event narrative + 1 on-site podcast recording timed to the founder's RSAC Innovation Sandbox slot. Audit-ledger entry shipped T+14 with qualified-intro list surfaced before the founder landed in San Francisco.

Sponsor-grade activation across the parallel DEF CON week for an offensive-security tooling vendor. Side-event tour (3 venues), 5 podcast recordings on-site, English-language clip cycle that rode the residual attention curve for 45 days. Same playbook ports to RSA Conference.
14-day pre-event narrative + 30-account CISO ICP map + qualified-intro list shipped before you land in San Francisco. If we do not deliver the intro list inside 14 days, the $5,000 comes back.
FORKOFF runs the only RSAC activation we have seen built around a 14-day operating cycle, not a Moscone booth fee. The audit ledger told us exactly which CISO intros compounded into pipeline conversations.
Founder · AI security SaaS
RSAC 2025 standard tier · CISO roundtable layer
Two weeks of pre-event narrative + 30-account CISO cluster activation + RSAC-specific intro engineering. You leave with the audit ledger of qualified intros surfaced before you land in San Francisco. Lite tier scopes a single track. Selective on ICP, capped per quarter.
Receipt-by-receipt, on the same five dimensions every buyer asks about. No tier shell games, no asterisks.
| Feature | FORKOFF activationOutcome-priced | DIY booth + sponsorLogo on banner | Traditional PR firmPress retainer |
|---|---|---|---|
| Pricing model | Outcome-priced. Per-event commit. $5K to $40K tier band. | Booth fee plus AV plus founder hours. Often $75K plus before any sourced CISO lead. | Monthly retainer regardless of event outcome. $10K to $25K per month. |
| Pre-event narrative | 30-day CISO cluster activation plus 30-account security buyer intro engineering | Tweet announcing booth number a week before | Press release embargoed until RSA keynote day |
| On-site cadence | Daily founder posts, Tour de RSAC dinner, SoMa side event, KOL placements, Innovation Sandbox coverage | Founder behind a Moscone podium, hopes the right CISO walks past | Press wrangling around the RSA keynote, no operating cadence on-site |
| Post-event compounding | 30-day clip cascade plus qualified-pipeline ledger sourced from CISO ecosystem | Folder of phone photos and a Slack debrief written from a SFO flight home | Coverage clipping report, often disconnected from CISO buyer pipeline |
| Audit ledger receipt | Signed by operator, qualified-pipeline math, T+30 close | Whatever the founder remembers from the Moscone main hall | Vanity coverage report, no pipeline math |
All tiers carry the audit ledger + qualified-pipeline reporting. Tier scales scope, not philosophy.
$5,000 to $10,000
By application
By application
Aug 2026 · Las Vegas · Standard tier by application
Apr 2026 · Las Vegas · Standard tier by application
Nov 2026 · San Francisco · Standard tier by application
Dec 2026 · Las Vegas · Standard tier $15K to $25K
May 2026 · San Mateo · Standard tier by application
RSA Conference is the world's largest cybersecurity event, anchored at Moscone Center in San Francisco each spring. The 2025 edition drew 41,000+ attendees across Moscone North, South, and West halls plus 120+ side events organized by security tooling vendors, CISO associations, and AI security operators. RSA Conference 2026 runs April 27 to 30 in San Francisco. The room is the highest-density gathering of CISOs, security tooling B2B SaaS founders, AI security researchers, and enterprise IT buyers in the world.
Beyond RSAC week. SaaS-side ICP playbook for security tooling and enterprise B2B buyers.
AI-side ICP playbook for AI security founders and foundation-model security teams.
Pre-event narrative + intro engineering across 30 ICP accounts attending RSAC.
On-site podcast recording day during RSAC week. Studio + crew booked at SoMa partner venue.
Bot-screened CISO + InfoSec Twitter + Dark Reading KOL placements during RSAC week.
Beyond RSAC week. SF tech-conference GTM playbook + on-ground partner network.
Lite activation $5,000 to $10,000 single-track. Standard tier by application end-to-end. Full tier by application sponsor-grade with CISO roundtable production. Audit ledger on qualified pipeline across every tier.

ETH NYC 2026 hits June 8 to 14 (ETHConf + ETHGlobal NY). The 3-week activation playbook that lifted sponsor day-30 dev activations 8.9x across 11 audited teams.

Step-by-step Twitch clipping for desktop, mobile, and OBS plus the vertical re-cut workflow that earns qualified views off-platform.

Compare the 9 best AI video editors of 2026 on pricing, qualified-view economics, audit ledger, and ICP fit. Apply now to test the managed lane.