Founder narrative locked T-30 to T-7.
Deliverables (3)
- ▸T-30 to T-7
- ▸30-account cluster
- ▸CISO intro engineering
FORKOFF RSA Conference activation is a 14-day operating cycle for AI security, cybersecurity, and security-tooling B2B SaaS founders shipping enterprise-tier security stack into the CISO buyer cluster in San Francisco. Pre-event narrative, on-site cadence at Moscone, post-event compounding, audit-tracked outcomes.
Most teams pay by application for a Moscone booth and an Innovation Sandbox slot. Some host a SoMa-side dinner and bounce. FORKOFF runs the RSAC week as a 14-day operating cycle.
Anonymized post-engagement. Names surfaced are RSA Conference 2025 ecosystem operators FORKOFF either ran intros into or co-attended Innovation Sandbox sessions with.
The CISO ecosystem compounds in ways no other security-conference week does. 41k attendees plus Innovation Sandbox density plus AI security buyer concentration inside one 4-day SF window.
CISOs + security buyers concentrated across Moscone plus the Innovation Sandbox circuit plus the SoMa side-event web.
Enterprise IT buyers, security tooling SaaS founders, and AI security researchers all in-market across the same 96-hour window.
Side events make CISOs and security operators reachable in 30-person rooms.
InfoSec Twitter and Dark Reading press cluster compound on residual.
The week breaks into a Moscone main-stage cluster, an Innovation Sandbox circuit, and a SoMa side-event web running parallel. Activating well means picking the right stripe of the week.
Apr 5-8, 2027
Main stage at Moscone Center (North + South + West halls). Innovation Sandbox at Moscone West. CISO and operator side events concentrated in SoMa around the InterContinental, the W, and the Marriott Marquis. Tour de RSAC dinners across SoMa.
41,000+ in 2025: 36% CISOs + security buyers + enterprise IT, 24% security tooling SaaS founders + product leaders, 22% security analysts + threat researchers + AI security cluster, 18% press + KOLs + MSSPs.
Where the buyer-relevant rooms live. Pick 2 max for any single activation week.
Two prior cycles run on the FORKOFF audit ledger. AI security SaaS pre-launch, cybersecurity tooling devrel narrative. Both ledger entries delivered within T+30 of close.
Four days across Moscone North, South, and West halls, the RSAC Innovation Sandbox circuit, and the SoMa side-event web. Pre-event narrative, daily on-site cadence, post-event clip cascade. One operator carries every phase. Every phase closes with a verified entry.
Founder narrative locked T-30 to T-7.
Deliverables (3)
Daily founder posts from Moscone, Mon-Thu of RSAC week.
Deliverables (3)
On-site CISO KOLs, Dark Reading + SC Media voices, and InfoSec Twitter operators activated through bot-screened placements.
Deliverables (3)
Clip cadence compounds T+1 to T+30.
Deliverables (3)
Strategy 12 weeks out. Production 4 weeks out. Execution event week. Compounding 30 days post. Each phase closes with a verified entry.
Sample schedule for a Standard-tier engagement. Tier-specific deliverables shown in the next section.
| Day | Date | Motion | FORKOFF owns |
|---|---|---|---|
| Sun (D-1) | Apr 4, 2027 | Land in SF · pre-event Tour de RSAC SoMa dinner setup | Venue + invite list + intro choreography |
| Mon | Apr 5 | Opening day attendance · founder posts from Moscone main floor | Daily post + on-site clip cadence |
| Tue | Apr 6 | ICP-account 1:1 meetings · Innovation Sandbox attendance | Meeting calendar + CISO intro routing |
| Wed | Apr 7 | FORKOFF side event (CISO roundtable / panel / dinner) | Production + KOL invites + recording |
| Thu | Apr 8 | On-site podcast recording day · 3-4 founder + CISO interviews | Studio + production + same-week clip pipeline |
| Fri | Apr 9 | KOL placements live · partnership-conversation closes | KOL proof + per-post tracking |
| Sat | Apr 10 | Founder thread recap of week · InfoSec Twitter cluster reciprocation | Thread craft + cluster activation |
| Sun (D+7) | Apr 11 | Departure · post-event clip cascade live | Distribution sequencing + weekly verified proof |
CISO pipeline from Innovation Sandbox positioning. Enterprise security buyers converted through on-site roundtable.
First RSAC clips live within one day of recording. InfoSec Twitter cluster amplifies for 45 days post-event.
Enterprise security buyer accounts activated pre-event. CISO intros tracked and verified in the verified proof.
Every clip, CISO-intro list, and vendor-pipeline report stays with the founder at engagement end.
14-day pre-event narrative + 30-account CISO ICP map + qualified-intro list shipped before you land in San Francisco. If we do not deliver the intro list inside 14 days, the by application comes back.
The qualification ledger changed how we report to the board. Real attention, verified weekly, not dashboard vanity.
Growth lead
Series A, 2026, AI infrastructure startup
We went from guessing pipeline attribution to seeing it in a weekly audit ledger. Finance signed off on the next quarter before the first one ended.
Marketing director
Mid-market, 2026, B2B SaaS platform
FORKOFF ran our conference activation across three cities in one quarter. Side events, content capture, post-event distribution. One operator, one ledger.
Head of events
Three cities, one quarter, DevTools company
Geo-routing pulled the campaign out of single-market mode. India and Southeast Asia carried the qualified attention count. The unit cost dropped by two thirds.
Campaigns lead
India + SEA launch, Q1 2026, Consumer tech brand
Two weeks of pre-event narrative + 30-account CISO cluster activation + RSAC-specific intro engineering. You leave with a verified record of qualified intros surfaced before you land in San Francisco. Lite tier scopes a single track. Selective on ICP, capped per quarter.
Three ways a team can show up at RSA Conference: a FORKOFF activation, a DIY booth bought through a sponsor package, or a traditional PR firm on retainer. Each is scored on the same 5 dimensions buyers ask about, from the pricing model and the pre-event narrative to the proof you get back after the week. No tier shell games, no asterisks.
← scroll horizontally to see more →
| Feature | FORKOFF activationOutcome-priced | DIY booth + sponsorLogo on banner | Traditional PR firmPress retainer |
|---|---|---|---|
| Pricing model | Outcome-priced. Per-event commit. by application tier band. | Booth fee plus AV plus founder hours. Often by application plus before any sourced CISO lead. | Monthly retainer regardless of event outcome. monthly retainer, by application. |
| Pre-event narrative | 30-day CISO cluster activation plus 30-account security buyer intro engineering | Tweet announcing booth number a week before | Press release embargoed until RSA keynote day |
| On-site cadence | Daily founder posts, Tour de RSAC dinner, SoMa side event, KOL placements, Innovation Sandbox coverage | Founder behind a Moscone podium, hopes the right CISO walks past | Press wrangling around the RSA keynote, no operating cadence on-site |
| Post-event compounding | 30-day clip cascade plus qualified-pipeline record sourced from CISO ecosystem | Folder of phone photos and a Slack debrief written from a SFO flight home | Coverage clipping report, often disconnected from CISO buyer pipeline |
| Qualified-view proof, audited | Signed by operator, qualified-pipeline math, T+30 close | Whatever the founder remembers from the Moscone main hall | Vanity coverage report, no pipeline math |
All tiers carry the verified record + qualified-pipeline reporting. Tier scales scope, not philosophy.
by application
By application
By application
Aug 2026 · Las Vegas · Standard tier by application
Apr 2026 · Las Vegas · Standard tier by application
Nov 2026 · San Francisco · Standard tier by application
Dec 2026 · Las Vegas · Standard tier by application
May 2026 · San Mateo · Standard tier by application
RSA Conference is the world's largest cybersecurity event, anchored at Moscone Center in San Francisco each spring. The 2025 edition drew 41,000+ attendees across Moscone North, South, and West halls plus 120+ side events organized by security tooling vendors, CISO associations, and AI security operators. RSA Conference 2027 runs April 5 to 8 in San Francisco. The room is the highest-density gathering of CISOs, security tooling B2B SaaS founders, AI security researchers, and enterprise IT buyers in the world.
Most teams pay for a Moscone booth and hope the right CISO walks past. The FORKOFF activation is a 14-day operating cycle: pre-event narrative + 30-account CISO intro engineering, on-site cadence + Tour de RSAC dinner + KOL placement, post-event clip cascade + qualified-pipeline record. Same operator, same dashboard, audit-tracked outcomes. Specifically tuned for AI security, cybersecurity, and security-tooling B2B SaaS founders shipping enterprise-tier security stack into the CISO buyer cluster.
Three tiers: Lite tier (single-track pre-event CISO narrative or on-site SoMa dinner or side-event slot), Standard tier (recommended, full week-of presence), Full tier (sponsor-grade with side events + Innovation Sandbox adjacency + CISO roundtable production). All tiers carry the verified record + qualified-pipeline reporting. Tier scales scope, not the underlying philosophy. Reference point: an RSA Innovation Sandbox booth alone runs by application, full RSA Expo booth fees can run by application plus before AV and staff costs.
Yes. Standard + Full tiers include FORKOFF-produced side events at SoMa venues (Tour de RSAC dinner, CISO roundtable, AI security panel, founder talk format). We handle venue, invite list, KOL outreach, and on-site recording. Side events are the highest-leverage on-site moment. 30 right CISOs in one SoMa-side room beats 30,000 random attendees at Moscone main hall. Recommended venues span the InterContinental + the W + the Marriott Marquis + the St. Regis side-event circuit.
Our Full tier includes a CISO buyer adjacency layer for partnership conversations and procurement-cycle starts. We coordinate with the founder's CISO advisor before any pre-event narrative goes live, route 30-account intros across CISOs and security operations leaders, and structure side events so enterprise security buyers can participate in pipeline-acceleration conversations. This is critical for security tooling SaaS founders who treat RSAC as the budget-anchor week for CISO partnership decisions.
Yes. FORKOFF has working relationships with AI security researchers, threat intelligence operators, and InfoSec Twitter voices across the cybersecurity ecosystem. Standard tier includes 1 ecosystem KOL placement; Full tier extends to 3-5 placements across CISO KOLs, Dark Reading + SC Media voices, AI security researchers, and InfoSec Twitter operators. RSAC is the one event week where enterprise security buyers are reachable in the same room as the AI security research cluster, and our intro engineering is built around that crossover.
Every podcast recorded on-site feeds the clipping pipeline at clips.forkoff.xyz. One 60-minute recording produces 8-12 cross-platform clips (X / TikTok / Reels / Shorts), distributed over the 30 days following RSAC. Each clip is tracked in the qualified-view record and reported in the T+30 audit close. The post-event cadence is what compounds the week's investment. For RSAC specifically, the InfoSec Twitter cluster (CISO operators + security tooling founders + Dark Reading-adjacent analysts) keeps the residual attention curve elevated.
Yes. RSA Conference is one of 12 plus events on the FORKOFF event roster. DEF CON, Google Cloud Next, Microsoft Ignite, AWS re:Invent, SaaStr Annual, NeurIPS, Dreamforce, HubSpot Inbound. Each event has its own activation page with cadence + tier pricing tuned to the event format and ICP. AI security, cybersecurity, and B2B SaaS ICPs map cleanly across events; see /for/saas-companies and /for/ai-startups for ICP-side detail.
Beyond RSAC week. SaaS-side ICP playbook for security tooling and enterprise B2B buyers.
AI-side ICP playbook for AI security founders and foundation-model security teams.
Pre-event narrative + intro engineering across 30 ICP accounts attending RSAC.
On-site podcast recording day during RSAC week. Studio + crew booked at SoMa partner venue.
Bot-screened CISO + InfoSec Twitter + Dark Reading KOL placements during RSAC week.
Beyond RSAC week. SF tech-conference GTM playbook + on-ground partner network.
As Featured In
Full press shelf







FORKOFF has run activations across 42 events since 2023, per our own operating record, including Korea Blockchain Week, ETHDenver, and Token2049. Each was a curated gathering or side event sized between 100 and 250 people, built around a pre-event narrative, an on-site cadence, and a post-event compounding motion. RSA Conference packs the Moscone Center with security practitioners and CISOs every spring, one of the most skeptical technical audiences you can pitch, so the plan on this page is drawn from reps we have logged winning rooms full of people paid to distrust the pitch.
RSA is wall-to-wall vendor booths making near-identical claims, and the practitioners walking the floor have been trained to discount every one of them. Across our 42-event history the security deals that moved skipped the claim entirely and led with substance, a technical teardown, a practitioner roundtable, a briefing that respected the buyer's expertise. A 100 to 250 person format aimed at real CISOs and their teams earns the credibility a booth cannot, because this audience buys from peers and proof, not from a tagline on a banner.
Because we have run the pre-event to post-event loop dozens of times, an RSA engagement starts from a plan tuned to a distrustful, expert audience. We know when to open the narrative, which briefing format a security buyer actually shows up for, and how to keep a technically-vetted relationship moving after the Moscone floor clears. The full method is on the event management service page, every activation window lives on the events hub, and a team also running a broader San Francisco motion should read the San Francisco events breakdown.
Reviewed by the FORKOFF events team, the operators who run these activations on the ground.
Lite activation single-track, by application. Standard tier end-to-end, by application. Full tier sponsor-grade, by application with CISO roundtable production. verified proof on qualified pipeline across every tier.

Affiliate Conclave 2026 runs December 15 to 16 at Emirates Palace, Abu Dhabi, co-located with Global Trading Show. Dates, tickets, tracks, a neutral read.

The Algorithm Alliance is an AI and ML builder community run by VAP Group. Its editions, format, who it is for, and the next Singapore meetup, 6 October 2026.

Crypto Mining Guild 2026 is a December 10 Global Blockchain Show side event at Space42 Arena, Abu Dhabi. Date, venue, format, and the mining-to-AI pivot.