Presented by RSAC
For two decades, the RSAC Innovation Sandbox contest has been the industry's most reliable crystal ball. With over $50.1 billion in investments and more than 100 acquisitions across its alumni, the contest has an extraordinary track record of spotting cybersecurity's future leaders before the rest of the world knows their names.
The contest's track record also offers a story of generational innovation that speaks for itself, says Cecilia Marinier, vice president of innovation and scholars at RSAC.
"We see one founder buying another founder buying another founder," Marinier says. "Think about the amount of accumulated knowledge, and how powerful it is to continue to build on such solid foundations."
It's a pattern that repeats throughout the Sandbox's alumni network. Last year, Donnchadh Casey and James White, CEOs of Calypso AI sold their company to F5, whose current Chief Product Officer is Kunal Anand. Anand was on the RSAC 2016 Innovation Sandbox stage as co-founder of Prevoty. His company was bought by Imperva, which was the winner of the contest in 2007. It’s all resulted in a tight-knit cycle of founders, operators, and acquirers that continues to shape the cybersecurity ecosystem.
Oliver Friedrichs, currently GM of CrowdStrike appeared on the Innovation Sandbox stage twice, winning in 2016 with Phantom, which was acquired by Splunk. He then returned as a 2023 finalist with Pangea, which was later acquired by CrowdStrike. Ali Golshan, a 2017 finalist with StackRox, went on to sell Gretel AI to Nvidia. Rehan Jalil, the 2020 winner who brought Securiti AI to the stage, saw his company acquired by Veeam for $2.7 billion.
"That's with a B," Marinier notes, underscoring the scale of value emerging from the Sandbox alumni network. "Those numbers also speak for themselves."
See the 2026 RSAC top 10 finalists live on stage
This year's Top Ten finalists take the stage at Moscone Center in San Francisco on Monday, March 23, each delivering a three-minute pitch to a panel of seasoned industry judges. The lineup reads like a map of enterprise security's most urgent pressure points in 2026: agentic AI governance, non-human identity management, social engineering defense, supply chain provenance, and AI-native code security, among others.
Finalists include:
Charm Security: uses its agentic AI workforce to targets scams and human-centric fraud
Clearly AI: helps teams ship secure software fast by replacing manual work with AI-powered reviews
Crash Override: embeds in CI/CD to capture build execution data that APIs can't access
Fig Security: finds and fixes broken security flows across the entire SecOps stack
Geordie AI: a security and governance platform purpose-built for AI agents
Glide Identity: verifies users instantly and securely—without passwords or SMS codes
Humanix: designed to stop social engineering attacks by detecting and responding to attacks on people
Realm Labs: enables enterprises to see inside the AI's "brain" and monitor its thoughts during inference
Token Security: focused on governing AI agents and machine identities at enterprise scale
ZeroPath: replaces traditional SAST, SCA, and secrets scanning with a single AI-native engine capable of detecting complex business logic flaws.
"The most disruptive technology right now is obviously AI, and it's bringing with it some brand-new security challenges that are being developed at the same rate that AI is evolving," Marinier says. "Our finalists are bringing cutting-edge solutions for tackling those problems and beating those nefarious actors."
Agentic AI, in particular, emerged as a dominant theme this cycle.
"Governance for AI, continuous monitoring, automation, SecOps resilience, everything from threat modeling to how to use agentic AI, and then controlling against agentic AI getting into systems, it's all there in our top 10," she says. "It's the call to action to today and tomorrow's security leaders."
Who selects the winners, and why it matters
One of the less-discussed secrets behind the Sandbox's track record is the rigor of its judging panel. This year's panel includes:
Nasrin Rezai, SVP & CISO at Verizon
Larry Feinsmith, head of global technology strategy at JPMorganChase
David Chen, head of global technology investment banking at Morgan Stanley
Paul Kocher, cryptographer and entrepreneur
Niloofar Razi, operating partner at Capitol Meridian Partners
"We're very careful about how we put together the panel," Marinier explains. "They have to represent a variety of perspectives, including an eye for startups that are likely to have positive trajectories. They're top leaders in the industry, who are able to recognize the companies that have risen above the noise."
Critically, RSAC itself plays no role in the selection, she adds.
"The judges select these companies," she says. "They have for the past 20 years, and they will be going into the future." That independence, she argues, is a core reason why the contest carries such weight with the industry.
The $5 million investment for the future of finalists
Beginning in 2025, as part of the contest's 20th anniversary, all 10 finalists receive a $5 million investment in the form of a SAFE note, funded by Crosspoint Capital. It's still early days for measuring the full impact, but Marinier points to the trajectory of ProjectDiscovery, last year's winner.
Funding launched ProjectDiscovery from a hopeful startup to a company with enough traction to hire industry professionals with experience and know-how, who wouldn't have previously considered an early-stage startup. Not only did they have the funds, they had the recognition, and they were able to attract great talent because they're obviously going somewhere.
"The money is ultimately about extending the runway," Marinier adds. "The SAFE note gives finalists breathing room to scale infrastructure and capitalize on the visibility the contest generates, before the spotlight fades."
RSAC's broader innovation ecosystem
The Innovation Sandbox contest is the flagship, but it's the centerpiece of a significantly larger innovation infrastructure that Marinier has built over the past decade. In that time, RSAC's innovation programming has touched more than 1,000 companies across multiple programs.
Launch Pad, now in its sixth year, functions as the Sandbox's "little brother," a Shark Tank-style forum where earlier-stage companies receive real feedback from judges without a winner being declared, though some of those companies are already starting to "graduate" to the next level of industry success. The Early Stage Expo, featuring 78 companies this year, gives attendees a window into what's coming down the pipeline, sitting alongside the conference's 600 main exhibitors.
The Innovation Showcase runs year-round, not just during conference week, with live Q&A sessions between entrepreneurs and audiences that are then carried into RSAC's new membership platform, an effort to sustain connections across the full year, not just the five days in San Francisco.
There's also a dedicated track for investors and entrepreneurs, featuring VCs sharing forward-looking perspectives, sessions on fundraising strategy, and design partnership frameworks. And for the next generation, RSAC's Security Scholars program selects 60 students from universities across the country, with 22 presenting research posters on Wednesday of conference week.
"The security scholars are presenting their research that could lead to nascent technology," Marinier says. "They're in theearly phase, working their way up the ladder. One day they'll make it onto our stages, and after that, the world's their oyster."
Why RSAC Conference is unmissable
For anyone serious about the future of cybersecurity, whether you're a CISO, a founder, an investor, or an engineer, Marinier makes the case plainly.
"Building a safer society requires bold ideas, and new technologies, and real-world solutions," she says. "RSAC Conference is bringing together some the newest, the smartest, the most innovative security perspectives in the industry for critical conversations about solving the security problems the world faces."
The RSAC Innovation Sandbox contest kicks off at Moscone Center on Monday, March 23 at 9:30 AM PT. Winners will be announced by approximately noon the same day.
Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.
[/gpt3]
