Hugh Thompson on Building the RSA Conference

Ann Johnson: Welcome to Afternoon Cyber Tea, where we explore the intersection of innovation and cyber security. I'm your host, Ann Johnson. From the front lines of digital defense to groundbreaking advancements shaping our digital future, we will bring you the latest insights, expert interviews, and captivating stories to stay one step ahead. [ Music ] Today I am thrilled to welcome Dr. Hugh Thompson, the managing partner at Crosspoint Capital Partners, and the Executive Chairman of the RSA Conference. Hugh is a tenured cyber security expert, and has written more than 100 publications on security. He testified before Congress, and of course, he helps build, execute, and secure the world's largest cyber security conference. Hugh, I'm not sure there is anyone who knows more about what matters to security leaders and professionals than you. Welcome to Afternoon Cyber Tea.

Dr. Hugh Thompson: Ann, thanks so much for having me. I'm so excited to be a part of this.

Ann Johnson: So, as we record this, the RSA 2025 Conference wrapped two weeks ago. And I was there. This year's conference attracted almost 44,000 attendees, is my understanding, which was a new conference record. It was certainly busy as I was walking everywhere [laughter] yeah!

Dr. Hugh Thompson: It was, it was busy.

Ann Johnson: It was amazing, like crossing the street was just a challenge [laughter]. Talk about what goes into building the event. How far in advance do you start planning each conference?

Dr. Hugh Thompson: Ann, so first, it was great to see you there. Oh my gosh. It's incredible to think it has already been two weeks since the event, but it is a-it's a long planning cycle. You think about 44,000 humans getting together, there is a lot to pre-plan. So we start about 18 months in advance of the actual event. And it's everything from, you know, what is the theme going to be? How much space do we think we need for different types of sessions? What have we learned, for my guess, the conference two years prior in order to plan for the one that is coming up 18 months from now? So it's a long cycle, and there is an amazing team that has been working on this for a long time, and it is super exciting. It's a privilege to be able to get this community together.

Ann Johnson: Wow, 18 months. I didn't realize that. So you are actually having to look back on even a conference ago to see what you're going to do for almost two years later. That's interesting.

Dr. Hugh Thompson: It takes a while. It really takes a while. Now, obviously, we learn from the conference that happens in between, and we make adjustments, and it's a team that is never satisfied with great. We always want to make it better, and we are so lucky, because this community as you know, Ann, I mean, you've been a part of it forever, is very, very willing to share, and want to collaborate, and they're very forthcoming with their views on how it can be a better experience for them, and how they can get even more out of it. So it is such a community effort to get this conference together.

Ann Johnson: That's great. I love to hear that. You know, we talk about having a learn it all attitude here at Microsoft, and you truly are. You learn from each conference to take the feedback and to improve the experience for the attendees. It shows up, right? It shows up when you go, that the adjustments, even if you think they're little adjustments, they're really meaningful for those of us who are attending. So let's talk a little bit about you. I think everyone knows you as the Crosspoint Capital person, or the Executive Chairman of the RSA conference. We were at an event a couple of weeks ago, even pre-RSA Conference, and you were showing your degree. Your applied mathematics. By the way, I love your slides [laughter], someday I'll have to understand who makes your slides, because I want to at least hire that person part-time. But anyway [laughter]--

Dr. Hugh Thompson: Don't steal the man, don't steal the man [laughter].

Ann Johnson: They were great. But you have an educational background in applied math. Your Bachelor's, your Master's, your Doctoral degrees are all in applied mathematics. How has that shaped the way you think about cybersecurity and also a large-scale event like RSAC?

Dr. Hugh Thompson: Yeah, it's interesting, I'd say mathematics, to me, is just very pure. Right? It's an expression of logic, but it allows you to try and make some structural sense out of what seems like chaotic activities [laughs]. You had 44,000 people together and there is a lot of brownie in motion, right, folks are moving around, and you know, what patterns are they following? I think it helps a little bit there. But it really helps you to systematically think through complex problems. And break them down. And it has helped me in my whole career, even though my background is in mathematics, my whole career has been in cybersecurity. I'll tell you a quick story, I always thought that I was going to be a math professor, right? Because it's what I loved, and I was entering the first year of my PhD, and it was almost summer time, and I'd just gotten, for me, unbelievable news that my teaching assignment for the summer was Calculus 3. I was going to teach my own section of Calculus 3, which is my favorite Calculus. I think it's everybody's favorite Calculus. It's surfaces, triple integrals, you know, I was just on Cloud 9 and so I went to my favorite falafel place, which was right next to the campus, sat down, the places is packed, and there is a guy that wanders over, sits next to me, and he's like hey, you know, is this seat taken? Place is pretty crowded, I'm like yeah, come on down. And we end up talking for maybe three hours about graph theory, which he was really into. I was really into it at the time, and only at the end of this like three-hour falafel fest did I ask him, well hey what are you doing here? Like, do you teach here, you know, because he was a little bit older than I was. And he said, "No, I'm a recruiter for Microsoft," and this is why I share this story with you. And I'm like wow, okay great, you know, what are you doing? He's like, well, you know we're looking for bright folks to bring for the summer, I think this was 1999, and he's like, "You should come. You've got to come over, come over to the campus," I'm look, "I would love to come, but you don't understand. I am teaching Calculus 3 this summer," this is, you would never give up an opportunity like that. And he said he understood, although I don't think he really did, but he asked me to, you know, just come, and for the summer, meet some of the people, and it really changed the trajectory of my career. I went over there, and I met so many just curious people, from all kinds of different backgrounds. I ended up staying there for the summer, was an intern, I worked on Microsoft Exchange, through Microsoft Research. It really convicted me that what I want to do for the rest of my career is continue to do what I'd always done as a hobby, which is break software, and find weaknesses, and protect people. I just share that with you, because it was a really pivotal movement for me.

Ann Johnson: So, that is really interesting, how you made that change, and I have to tell you I don't have a favorite Calculus subject, but probably because I was never much of a math person in school, so it's also fascinating for me to hear you describe, very seriously Calculus 3 being your subject. And then how you actually, I think it was developed the hunger for cyber, right? Because cyber, we always describe as a very mission-driven field. So just thinking, yeah, when you get in it and you realize you can change the world, you don't really want to leave.

Dr. Hugh Thompson: You don't! You're right! It is a mission. It is a calling. It's something that really fills you up every day when you know that you're making a difference, or at least you're trying to make a difference in such an important area.

Ann Johnson: So let's pivot from there. So you chose this career in cyber, which is fantastic. I'm glad we pulled you out of being a university professor, so I know the industry is greatly-yeah, it's greatly benefited from having you. When you think about RSAC, what is your approach to choosing a theme? How does that work? How do you think about a theme that resonates with such a diverse, such a global audience?

Dr. Hugh Thompson: It's tough, and there is a lot of debate that goes on internally around the theme every year, and we've done a lot over the years, quite diverse, you know, we have had this dragon theme one year. We had a, you know, ancient secrets of mythology one year, and about, I'd say 12 years ago we started a track called The Human Element, and it was all about how people interact with systems. And it was really popular. We got to explore all kinds of different things inside of that track, and then the next year, when the debate came up, you know, gee, what is the theme for you know 18 months from now? And everybody agreed-human element was the right one. Because cyber really comes down to people, whether it's the folks that you're trying to protect, the folks that are the defenders, that are in cyber, or the attackers, and ever since then, I think you'll notice if you go back over the last six or seven years, many of the themes have had this human element touch to it. It has been a real privilege to go through that process. A lot of thought goes into it. This year, the theme was Many Voices, One Community. I don't think there has ever been a more important time for the community to come together, and everybody has a voice in this community. It's incredible to see the unexpected places that great contributions come from. SO I'm really, really happy with the theme this year. Last year was The Art of Possibility. So we always try and inject some hope into the themes, too.

Ann Johnson: I love that. And I remember, because I was privileged to be at RSA, the company, starting in 2000, but we had this woman, Louise Johnson, who would build our booths. And they would be unbelievable. She would envision and you know, take the conference theme, and RSA had these unbelievable booths. I don't know if you remember that?

Dr. Hugh Thompson: Oh my gosh. Oh! I do, I do. They were incredible! And incredible, multi-story if I remember correctly.

Ann Johnson: Yes, they were. But I love the human aspect. I love the pivot, because as you're modernizing the conference, right, and meeting people where they are, cyber is about human beings, right? It's about the humans that attend. It's about the humans that speak, it's about the humans that secure the world, which brings me to your programming. The conference has a really diverse set of content, to appeal to all different types of humans. I've been privileged to be able to speak at the conference. I understand there were over 450 sessions this year. How do you strike that balance? How do you strike the balance between meeting deeply technical people where they are with content, and then sessions that are accessible to non-technical attendees, maybe policy people, or people that want to talk about the business of cybersecurity.

Dr. Hugh Thompson: Yeah, it's a difficult balance, because as you know, there are so many different types of people that comprise our community. Some are technical. Some aren't technical. Some are policymakers. So we have an open call for speakers. That happens every year. This year, we had a record number of submissions, I think just over 2,800. And this is from around the world. I mean, you wouldn't believe how diverse the pool is of submissions that come in. Typically they're very detailed, right? There's a short abstract that says here's what I'm going to talk about, and then there is this more detailed on that, here is point by point, the things that we all want to hit, that we think are important, and here is why we think that we are the right people to talk about it. And then, those 2,800 get narrowed down by an independent program committee, so it's content that comes from the community that then gets adjudicated by the community, and we've got two to three chairs for each track, and I can tell you Ann, those program committee meetings, and specifically the track meetings, they can get pretty wild, you know, people come into it as like great friends, and you know, then they have their favorite session, and they're like, there's no way I'm going to put my name on this track and this session doesn't get in there. I just love the passion. But it really comes down to setting what those tracks are to make sure that we do have the content that touches everybody. So we've got a track on policy and government, for example. We've got multiple hackers and threats tracks, for example, for very technical content. This year we partnered with Usenext, to have breaking research tracks that are focused on, you know, two to five years from now. And then I've just got to hand it to our amazing program committee, that dedicates so much time into not just reading these submissions, but really passionately advocating for the ones that they think matter. It's-I don't know, I walk away from that process every year just so blown away by how passionate this community is. And how willing they are to give back.

Ann Johnson: Yeah, and that's, I think, your program committee is outstanding, and I know they work tremendous hours in reviewing all the content, yeah, and pulling it all together, and this is a side job for them. They aren't a full-time program committee, so, they deserve a lot of recognition for the work that they do.

Dr. Hugh Thompson: Oh, my gosh! I couldn't agree with you more. And like you said, it's a hobby for them, and they put so much of themselves in it. And that's something that I don't think folks outside of security understand, which is how open this community is. How willing they are to share with each other, and that's evident by the response to the call for speakers, for example. But also how willing they are to give their time, to make the industry better, and help to shape it. I've never seen anything like it. It is amazing. Amazing to watch. Every year.

Ann Johnson: It really is, and speaking of being amazing, the speakers, right? You get these speakers that have such high profiles, you also get everything from hackers to CEOs, so how do you ensure the program, again, appeals to all levels of experience as you work through those program committee decisions?

Dr. Hugh Thompson: Yeah, great question! So as part of the submission, there is a level rating of how technical do you have to be to really get something out of this talk? And what we aim for, depending on the track, is to match up the level of technical sophistication with the track. So let me give you an example. In policy and government, there are sessions that are really deep in the weeds, not technically, but in policy and government, like, you know, based on case X, Y, Z, we're seeing the transformation of, you know, how regulation Q is being interpreted. And that is not accessible to the average person, but we need some of that content for folks that are in the legal department, for example, or maybe a Chief Privacy Officer, and we always strike the balance between things that are very specific to a field, and also things that can be accessible by just a wide variety of folks that are just curious and want to learn more. One of the activities that we do is before the call for speakers even opens is we ask those track chairs to do a blue sky exercise. So you don't know what's coming in. but what ideally-what topics would you want covered? At what level? And just them thinking through that process is super helpful because then when you get the flood of submissions in, it really re-grounds you, to not just get enamored with every AI talk that shows up, and turn the whole track that way. So I think that process has gotten honed very well over 34 years now.

Ann Johnson: So you've been leading the conference for quite a while. Can you talk about how the cybersecurity conversation has changed since you first started programming RSAC?

Dr. Hugh Thompson: Yeah, I think it has changed quite a bit. There's a lot more consequence to cyber today than there was going back let's say 20 years ago. You know, at that time, it was a pretty obscure field for the average person. The way that I judge this is I travel quite a bit and you know, you sit next to somebody, and you know you're about to be sitting next to them for the next 10 hours on a flight, and you have the normal just intro conversation like hey, weather looks good today, great, and then eventually you get to well what do you do for a living? And everybody I sit next to seems to always have something very interesting that they do, right? A veterinarian, or you know, I captain a ship. And then I say, well, I'm in cybersecurity and 20 years ago I always got the same response from the person sitting next to me was, well gee I just picked up this really great book at the airport and I'm looking forward to reading it during the flight [laughing] meaning we won't be talking during the flight, because that sounds really boring. But today it's completely different. I think the average person has interacted with some kind of cyber incident, like it's relevant in their lives. They've maybe personally suffered some kind of ransomware attack, some virus that has hit their system, something that has wiped out all of their personal photographs, for example, or a scam. We've seen the elevation of security in society and you know, you can see RSA Conference evolving that way too. So you've got key government officials, for example, that show up every year at the conference. You've got folks that are leaders, not just the Chief Information Security Officers, but CIOs and CEOs, of very large companies that come because they realize they need to understand what really is this cyber risk? Like what is the dimensionality of it? And so it has been an expansion of our programming to not just have some of the very technical sessions, but also have these higher level philosophical futures, policy sessions, too. And it really is a testament to how important this industry has become in society.

Ann Johnson: I think that's great. And I used to say, because I started in the industry 25 years ago, that people spend more on their coffee budgets than they spent on their security budgets at that point in time [laughter], and now we're board room conversation, right? We are on the front page of papers. There are some organizations that have billion dollar security budgets, so I think we've come into our own, Hugh. But with, you know, that becomes a great responsibility, right? Now that people know who we are.

Dr. Hugh Thompson: Oh, and I can tell you, Ann, and I know you feel the same way. I feel the weight of that responsibility every single day. I know the role that RSA Conference plays in the world, and I can't tell you how much of a privilege, but also how much of a burden it is. To know that every session that we have, every activity, it really matters. Like it's probably going to touch someone, and change how they do something. And that could have serious implications for a company, a person, a business, a country, for society. It's an amazing thing to watch, but it's also an awesome responsibility.

Ann Johnson: It really is an awesome responsibility, because you not only bring in the world's top cyber minds, you bring in people like Jamie Foxx [laughter], yeah, can you talk a little bit about-there's celebrities that come to the RSA Conference. How do you decide what celebrities to bring in, and how do you get them to come?

Dr. Hugh Thompson: Oh, my gosh, again, we've got such an amazing team. So Linda Gray Martin, and Brita Glade, are two of the folks that I call out in particular here, and I think you've met both of them.

Ann Johnson: I've worked with both of them.

Dr. Hugh Thompson: They're fantastic, right?

Ann Johnson: They are.

Dr. Hugh Thompson: You know, just like us, just so passionate about this field, obviously, about this event, and every year we sit down and we say gee, who is it that we can add to the conversation that is going to offer something new that's not necessarily cyber. Maybe it's a lesson on leadership? Maybe it's a lesson on personal growth, or recovery, or how do you deal with massive amounts of stress, for example? Which is a big part of being in cyber security. It's a very interesting process, so this year, and you called out Jamie Foxx, and I thought it was fantastic. I don't know if you were at that session [laughing], but-

Ann Johnson: I wasn't, unfortunately, and I was really disappointed, just so you know.

Dr. Hugh Thompson: Oh my gosh! It was-and I don't want to make you feel bad, but it was epic. It was epic! Like, you know, he gets up on the mic, he starts singing, he brings people up to the stage, and people are dancing, and it's like-it was almost just a wonderful community bonding event, right? That was the beginning part of it. And then when I sat down with him and we started to talk, I asked him about, you know, how he got where he was, and what has he learned about community? Like his own community of actors, and comedians that he'd grown up with, and how did they shape him? At the very end, he had been in the news for about a year or so, but he had suffered a major medical incident, and he was just very open about, you know, just recovery, and what matters in life. And he was so sincere, and vulnerable, and I think at the end of the day, the people in the crowd, even though they're in cybersecurity, they're people first. And you need to nurture those human beings. It comes back to this human element point, where we also had Magic Johnson this year, and that guy is just incredible. I mean he was roaming the seats, and bringing people in for selfies, he challenged somebody in the audience, who was very surprised by the way, to a chest bump check competition [laughing]-

Ann Johnson: Wow. That's wild.

Dr. Hugh Thompson: It was [laughing], my god, it was incredible, and you know, I'm thinking about things like, gee what is our insurance policy like? And does it cover this? And you know [laughing], it was just awesome, and he talked about leadership, and you know, his time in the NBA, and how he helped to lead a team into victory and one of the lines that, you know, because I learn something in every one of these talks, one of the lines he came out with that is going to stick with me for a long time is, if you go into anything, and in his case, a game, and you think you're going to lose, you're going to lose. And that's actually so profound, when you think about it. Right? It comes so much down to mindset, and the mindset we approach what we do every day with, and how important it is to understand and believe that no, we're going to win, even though we've got this active adversary on the other side, even though the odds are stacked against us, we're going to win. It's amazing, and it has become an important part of the conference.

Ann Johnson: That's really great. How do you think about the exhibition floor? And the experience there, and how that factors into the programming? And I'm going to combine another question since we're talking about the exhibition floor-there were puppies this year, which was amazing [laughter], but there were also goats this year. Can you talk a little bit about the most unusual vendor request you've received, and was it the goats?

Dr. Hugh Thompson: It was not the goats! Although, I mean, those dwarf goats were just amazing and people really gravitated towards them [laughing] and there were multiple puppy booths this year, so that was sort of an animal trend this year. The weirdest request that we got and I am not going to name names, for reasons that will become obvious, it wasn't really a request-it just showed up on the show floor. So apparently this one company had smuggled a llama into-

Ann Johnson: A llama!

Dr. Hugh Thompson: Yeah! Yeah, and I don't know how much time you've spent with llamas-

Ann Johnson: Oh my gosh!

Dr. Hugh Thompson: But-

Ann Johnson: No, they're not the friendliest creatures.

Dr. Hugh Thompson: No, no, that would be accurate. They're not the friendliest creatures. They're quite large, and you know, very unpredictable. And so suddenly this llama just shows up, right? Inside of a booth. And you know, that was a very interesting conversation not just with that particular exhibitor but you know, police, and others, apparently you cannot get a permit for a llama inside of the Mosconi Center, which is something that I now know [laughter], after that-

Ann Johnson: I would never have even thought about that [laughter].

Dr. Hugh Thompson: I know that was-so now, when you read some of the contracts, there's like a "no llama" policy. You don't think you have to call this stuff out specifically, but just to get back to your earlier question, I think the show floor...look, there's a lot of new people that come into cyber every year, and they are just looking for some kind of wayfinding of who are the vendors that can help? Because you can't do it without vendors. And I think for those folks, there's great value in just the time savings of having all of those vendors in one spot. And you can go in and yes, some people spin a wheel, and just won a T-shirt, and that's true. But then there's others that really are about to make a decision on behalf of their company of a new technology and they can visit 10 vendors that have competing products for them very quickly. And so I think that's a huge benefit for attendees. I think it's a great benefit for the vendors themselves, and it's an important part of the conference.

Ann Johnson: So I know you've delivered a keynote every year since 2007. I've a couple questions for you. One, do you ever get to experience the conference, like as an attendee? Do you get to walk the floor, and be an attendee? And then, when you're thinking about your keynote, how do you keep it fresh every year? You know, we're what, 17 years into it, 18 years into it? How do you keep it fresh?

Dr. Hugh Thompson: [Laughing] Yeah, I know, well, you know so a couple of things. So first, on the enjoying the conference, yeah, absolutely. I make sure to carve out some amount of time. Obviously it's very busy during the conference week, but some amount of time to walk the show floor, because it's very important to go to at least two sessions, where I don't know the person, and it's something that's very interesting to me, and it's something that I feel like I don't know very much about, even though I've been in security my whole career, and have written three books on it, you can always learn something from somebody else. No matter who they are. So I do carve out time for that. And in terms of the keynotes, you know, I have the great benefit and blessing of having five young kids, and the reason that I bring that up is just strange things happen when you have such a high volume of kids. And so I think about security all the time. And we always run into these bizarre, usually harrowing kind of safety incidents, for them [chuckling] and they often help shape my thinking of if this a way-is sharing this story, is sharing this experience-a way to help convey a complex security concept or topic to a broad audience, that has very, very, very diverse backgrounds? And people think in stories. That's what they remember. That's, you know, that's how information was passed down for hundreds of thousands of years. And I'm fortunate enough that my kids helped to get us in predicaments that lead to stories that I think are helpful to relate concepts that matter to people, right now. It's such a privilege ever year. It's so much fun. And it's wonderful. It's wonderful.

Ann Johnson: That's fantastic, and you do such an amazing job, and it's good to hear that you get a lot of your inspiration from your family. It's just a great way to connect it, even though I'm sure that having five-I only have one-but having five children, I'm sure there's a lot of hijinks that happen. Even with one, there are entertaining experiences. My child actually password surfed me once. They were--

Dr. Hugh Thompson: Oh! Tell me about that!

Ann Johnson: Yeah, they were about 11, they shoulder surfed my iTunes password, and downloaded about $100 worth of music.

Dr. Hugh Thompson: [Laughing] Oh wow!

Ann Johnson: And I kept getting alerts, and I'm like what is going on? And finally, you know, I went and found the child, and they owned up to it. So no matter how long you've been in cyber, we all have opportunities to learn.

Dr. Hugh Thompson: Oh my god, I'm so happy you shared that story, and I'm going to advertise for the next year's 2026 conference, there is a track called "The Insider Threat."

Ann Johnson: There you go, because that was an insider threat-so funny.

Dr. Hugh Thompson: It's an insider, it's an insider.

Ann Johnson: Very much. Well, I always close Afternoon Cyber Tea with a bit of optimism, with that in mind, and I know you're an optimist like me--

Dr. Hugh Thompson: I am.

Ann Johnson: Yeah, I'd love to hear what your optimists think about when it comes to the future of cybersecurity.

Dr. Hugh Thompson: You know, look, you can't walk away from RSA Conference. Especially this past year, and not be optimistic about what we can accomplish if we band together as a community. You just can't. Because you see the ethos of the people that are in the fight with you. They're folks that really care. They actually care. Like, it's a mission for them. It is a calling. And when you have smart people that are aligned together with a mission against a common enemy, amazing things can happen. That has been true throughout history. It predates technology. We have that as in such abundance, inside of our cyber security community. How could you not be optimistic about the future. Now, we've got to organize better. We've got to make sure that the right things are in place for people to share, and collaborate, which we're working on, others are working on. But it is a field that I believe that the folks that are in it, and they see that communal aspect of it, you cannot not be an optimist.

Ann Johnson: I love that. And thank you for joining me. I know you need some down time post conference. I hope you get that down time, and I appreciate you making the time, because I know how incredibly busy you are.

Dr. Hugh Thompson: Ann, thanks so much. It's just a privilege to be a part of it. And thank you for everything that you've done for this industry. All the advocacy, the leadership that you've given. I can't thank you enough.

Ann Johnson: Thank you. And many thanks to our audience for tuning in. Join us next time, on Afternoon Cyber Tea. [ Music ] I invited you to join me, because RSA Conference is the largest and most influential cybersecurity conference. It is a massive undertaking, involving multiple site locations, tens of thousands of attendees, and hundreds of exhibitors. Hugh has so much knowledge to share about the industry, about the conference, the way it all comes together, and also about the cybersecurity lessons he and his team put in place to protect and secure every attendee. [ Music ]