Cybersecurity Conferences 2026 to 2027 for Security Leaders

TL;DR: Security leaders still have ISC2 Security Congress (October 24 to 28, 2026), the FS-ISAC Americas Fall Summit in Austin, Black Hat Europe in London and the Gartner Identity and Access Management (IAM) Summit in Las Vegas before year end. RSAC 2027 follows in San Francisco on April 5 to 8, 2027. The August 2026 Las Vegas cluster already ran. RSAC early-bird pricing ends December 18, 2026, so file budget requests early.

Which cybersecurity conferences are still ahead in 2026 and early 2027

The first two start within days.

ISC2 Security Congress

ISC2 holds the congress October 24 to 28 at the Gaylord Rockies and virtually. Leadership topics are part of the program. One listed theme is cyber leadership and workforce development, and one session highlight covers strengthening cyber governance from operations to the boardroom.

ISC2 members can earn up to 81 continuing professional education (CPE) credits.

FS-ISAC events

The Americas Fall Summit runs October 26 to 29 in Austin. The next large gathering is the Spring Summit in Orlando, March 14 to 17, 2027.

Cybex Paladin is different from the summits. FS-ISAC describes it as a two-day functional exercise for small-to-mid-sized financial institutions that tests responses to operational disruptions. We think a leader at a smaller bank or credit union may get more from those two days than from a summit, because the exercise tests the plan itself.

Black Hat Europe

The London event runs four days, December 7 to 10, 2026. In our reading, the summit day is the part most likely to suit someone who cannot spare the full week.

For speaking slots and executive appearances across these events, see /voices/speaking.

Dates and cities for the main security leadership events at a glance

The previous section covered the fall and winter events. This table adds the two large spring and summer gatherings whose 2027 dates were already posted, so you can hold travel dates before next year's budget is fixed.

RSAC 2027 in San Francisco

The Moscone Center page describes an audience of security professionals, technology leaders, researchers, and innovators.

The page asks visitors to register your interest for announcements and registration details. In our reading, that means pass pricing was not final when the page went up. Set an alert and expect the details later.

Infosecurity Europe 2027 in London

The part most relevant to a sitting chief information security officer (CISO) is the Leaders' Programme. The organizer describes it as an invitation-only VIP experience for senior cybersecurity professionals. It includes peer-led, vendor-free Table Talks, along with workshops and roundtables for CISOs and chief technology officers.

Listed topics include large language model (LLM) security, post-quantum cryptography and security leadership.

If you want to speak, the organizer had a call for speakers open for the Cyber Strategies theatre. Our notes on speaking at conferences cover how to frame a pitch.

How to use the table

• Check each date against your board and audit calendar before you commit. A spring event can land in the same weeks as year-end reporting for some fiscal years.
• Ask for the invitation early. We think invitation-only leader tracks fill before general registration does, so contact the organizer as soon as the window opens.

For more planning material, see our other guides.

The 2026 events that already took place

The summer 2026 cluster ran over roughly two weeks in August, first in Las Vegas and then in Louisville. The Cybersecurity and Infrastructure Security Agency (CISA) listed all four events on its conference page and noted that its participation in the listed FY26 conferences was subject to change.

Black Hat USA

Black Hat returned to Mandalay Bay with a re-engineered, six-day program. Trainings ran August 1 to 4. Summit Day fell on Tuesday, August 4, and a two-day main conference followed with Briefings, open-source tool demos in Arsenal and the Business Hall.

In our reading, the layout put the executive day inside the training block. A leader could fly in for Summit Day and the Briefings without committing a full week.

The Las Vegas overlap and Louisville

B-Sides Las Vegas ran August 3 to 5, inside the Black Hat window. DEF CON started August 6, the last day of Black Hat, and ran through August 9. The NHSC opened in Louisville the following week, on August 10.

Gartner's 2026 leadership tracks

Gartner's 2026 summits ran a Cybersecurity Leadership and Innovation track at National Harbor. It covered business-aligned strategy, resource planning and leadership effectiveness.

Its risk track was titled Cyber Risk and Resilience, and it added a track on infrastructure and cloud security.

The 2027 dates are set: June 14 to 16, 2027 at National Harbor and 21 to 23 September 2027 in London.

Using 2026 as a baseline

We think the August pattern is the useful takeaway: one trip can cover the executive day, the research talks and the hacker community, provided travel is booked around the overlap. For 2027 planning, check whether Black Hat keeps Summit Day inside the training days. If you plan to attend the CISO Circle, file the application early. For speaking slots tied to these events, see /voices/speaking.

Events built around the CISO and security leadership

For a chief information security officer (CISO), the useful question is often which part of a conference to attend, not which conference. The Gartner summits and ISC2 Security Congress both run leadership content beside technical tracks, and their program pages show where the line falls.

Gartner: a leadership track plus a public-sector layer

Gartner pitches its leadership track at pressure from above the security team. The track description opens: "Cybersecurity leaders face relentless change from AI, regulation and business demands." The same wording appears for National Harbor and London.

The two 2027 summits listed earlier differ in scale:

• National Harbor lists 4,500+ CISOs and cybersecurity leaders and 60+ Gartner analysts.
• London lists 2,500+ attendees and 40+ analysts.

Analyst access is the main leadership draw in our reading. Paid full attendees can book a private 30-minute one-on-one meeting with an analyst. These meetings are not available to exhibitors.

Public-sector leaders get their own content. In National Harbor the Government Program addresses justifying cybersecurity budgets and workforce. In London the Public-Sector Program covers preparing for resource reductions. London also runs a Technical Insights program aimed at architects, analysts, engineers. We think that makes it workable to bring a CISO and senior engineers to the same event.

ISC2 Security Congress: governance treated as operations

ISC2 Security Congress runs October 24-28 at the Gaylord Rockies and virtually. Its stated themes include governance, risk and compliance (GRC) operationalization and cyber leadership and workforce development.

One session highlight is strengthening cyber governance from operations to the boardroom. That topic connects directly to board cybersecurity oversight. The pass also includes a Town Hall with updates from ISC2 leadership and the Board of Directors, and Bright Ideas Roundtables that are in-person only, limited seating. Attendees can earn up to 81 CPE credits, meaning continuing professional education credits.

Before you register, check two things. First, find out whether the leadership content needs a separate booking. Second, find out which sessions have limited seating. In our reading, Roundtables and one-on-ones fill first, so book them as soon as registration opens. For more on how the role itself is scoped, see what a CISO does.

What RSAC and Black Hat offer a security leader

RSAC and Black Hat are the two large research and expo events on most security calendars. Both put thousands of people, a show floor and a dense session grid in one venue. For a leader with limited days, the question is which parts of each to attend.

RSAC 2027 in San Francisco

RSAC 2027 runs April 5 to 8, 2027, at Moscone Center, billed as four days of sessions, learning and networking. The organizer lists 43,000 attendees, 500 sessions and 600 exhibitors.

The audience skews senior. RSAC states that 49% of attendees are director, VP, senior or C-level executives and that 25% authorize purchasing decisions. It also prompts registered attendees to start scheduling one-on-one meetings before arriving.

The pass tiers shape what you can reach:

• Basic covers the expo, sponsor briefings and the Tuesday and Wednesday main stage keynotes.
• Core adds all keynotes and track sessions.
• Premium adds priority seating for keynotes and advance seat reservation for track sessions, plus unlimited learning labs and roundtables.

Early pricing ends December 18, with prices rising December 19.

Black Hat's format and 2027 dates

Black Hat runs a series of regional events. Black Hat Europe is in London from 7 to 10 December 2026, Black Hat Asia is in Singapore from 28 February to 3 March 2027, and Black Hat USA 2027 returns to Mandalay Bay in Las Vegas from July 31 to August 5, 2027.

The 2026 Las Vegas edition showed the structure. It ran four days of Trainings, a Summit Day on August 4, and a two-day main conference with Briefings, open-source tool demos in Arsenal and the Business Hall.

Fitting either event into an executive week

We think the practical approach for either event is to book meetings first and sessions second. At RSAC that means choosing a pass that matches whether you need track sessions or only keynotes and the floor. At Black Hat, we think a leader gets most from arriving for Summit Day and the first day of Briefings, while engineers on the team take the Trainings.

For tracking who is speaking at upcoming events, see /voices/speaking.

Sector and identity events for financial services and access management leaders

Two groups of events sit outside the general-interest calendar. Gartner's Identity and Access Management (IAM) Summits serve the leaders who own identity programs. In our reading, both suit a leader who wants depth in one area more than breadth across the field.

FS-ISAC for financial institutions

The nearest FS-ISAC date is the Americas Fall Summit in Austin, from October 26 to 29, 2026. After that comes the UK Cyber and Resilience Exchange in London on December 10, 2026, a member event for UK peers.

The bigger planning date is the 2027 Americas Spring Summit in Orlando, March 14 to 17, 2027. FS-ISAC says the Americas Summit is specifically designed for cybersecurity professionals in financial institutions. Sessions are split into three tracks: Intelligence, Security and Resilience.

If someone on your team pitched a talk, the timing is set. The call for presentations has closed, and notifications go out on 4 December.

Smaller institutions have a separate option. Cybex Paladin 2027 is a two-day functional exercise for small-to-mid-sized financial institutions, held virtually on February 17 and 18, 2027.

Gartner IAM Summits

The US edition runs December 7 to 9, 2026, in Las Vegas. The London edition follows on March 8 to 9, 2027. Both list priorities that include governing AI agents and machine identities.

The Las Vegas session list makes the agent theme concrete. One title reads "AI Agents Need Their Own Identity" (Gartner). Another argues for a shift from periodic access reviews to risk-based continuous certification. Gartner lists 30+ on-site analysts for Las Vegas and 20+ for London.

We think these are good events to hand to a deputy CISO or an identity lead. Ask them to come back with one change to your access review cycle or your agent identity plan. That gives the budget line a result you can check.

How a sitting CISO gets onto a conference program

Speaking slots at the larger security events are filled through open calls that close months before the doors open. For a sitting chief information security officer (CISO), the practical work is knowing which window is open, what reviewers select for, and having material ready before the next call.

Where three calls stand in late October 2026

Infosecurity Europe runs June 8 to 10, 2027, at Excel London, and its call for speakers is open for the Cyber Strategies theatre. In our reading, that theatre suits a leader with a strategy story more than a product demo.

At ISC2, the 2026 agenda came out of a review process. Earlier in the year, an advisory panel of cybersecurity experts reviewed hundreds of submissions to identify the trends that mattered most. The themes it settled on included AI security and governance, Zero Trust and identity-first security, operationalizing governance, risk and compliance (GRC), quantum computing risk, and cyber leadership and workforce development. The program offers 60 breakout sessions.

Smaller formats that build a speaking record

The main stage is not the only way onto a program. At Infosecurity Europe, Table Talks are led by peers rather than presenters, with each session on a single challenge. We think leading one is a lower-stakes way to test material before submitting it to a theatre.

What to prepare before the 2027 calls

• Keep a talk file. Log decisions, incidents and program changes as they happen, with the outcome and what you would do differently. Reviewers pick specifics, and specifics fade.
• Clear disclosure early. Ask your communications and legal teams now what you may say about named incidents, vendors and metrics. Approval can take longer than the call stays open.
• Map your story to stated themes. The ISC2 themes above are a public signal of what one review panel wanted. A talk on board reporting fits leadership and GRC. A talk on agent identity fits the AI and identity themes.
• Write the abstract first. A tight title, three takeaways and one concrete example give a reviewer enough to judge quickly.
• Line up a co-presenter. A peer from another sector, or your business information security officer, can widen a talk's appeal.

For more on building a public profile, see our guide to security thought leadership and speaking notes from CISOs.

Registration deadlines, pass prices and continuing education credits

RSAC 2027 pricing

The RSAC early-bird rate ends December 18, 2026, at 11:59 PM PT, and prices increase December 19. Both full passes are $800 cheaper before that cutoff.

• Premium: $2,595 early bird, against $3,395. Premium is limited in quantity and adds unlimited Learning Labs and Interactive Roundtables.
• Core: $1,695 early bird, against $2,495. Core includes an attendance report for CE (continuing education) credits, which you will need when filing credits after the event.

The $800 saving is measured against the onsite price. An approver will ask about that. Basic pass pricing was still listed as coming soon at the time of writing.

For a budget holder who asks who attends, RSAC reports that 49% of attendees are director, VP, senior or C-level.

ISC2 credits and SECURE Los Angeles

ISC2 Security Congress 2026 also has a virtual pass. It gives on-demand access to sessions and can earn up to 60 continuing professional education (CPE) credits through January 31, 2027.

ISC2 SECURE Los Angeles runs December 10, and early bird pricing is open.

A one-page request for the approver

In our view, the request goes further when you plan the whole year with the executive who signs travel, rather than sending one ask at a time. Put the deadlines at the top of the page, because those are the dates that cost money if they slip. A worked example:

1. Price deadlines. RSAC early bird closes December 18, 2026. The ISC2 virtual credit window closes January 31, 2027.
2. Line one: the leader. One RSAC Core pass at the early-bird rate. Record the CE attendance report as the credit evidence.
3. Line two: the engineer. Price it once the organizer publishes training fees.

We think one page that shows the dates first, the passes second and the expected return third is easier to approve than a forwarded registration link. For more on how leaders brief the executives they report to, see /guides/ciso-reporting-structure.

What this guide does not cover

This guide does not cover events outside those listed, travel and visa logistics, or exhibitor and sponsorship costs. Dates and prices can change, so confirm on each organizer's page before booking. Nothing here is financial or legal advice. For the rules and the record behind it, see CISO Reporting Structure, the Five Models and What the Filings Show.