When it comes to cybersecurity, one of the biggest annual get-togethers is the RSA Conference (or RSAC) in San Francisco, which brings together industry experts, companies, and decision-makers. This year, it was overshadowed by the war in Iran. As the event drew to a close, the FBI revealed that its director, Kash Patel, had had his personal email account hacked by an Iran-linked group.
The RSAC reflects the major trends shaping the global cybersecurity debate, from advanced attacks and digital defence methods to artificial intelligence (AI) and infrastructure security, but this year felt more political. Although European voices were still prominent in discussions, many US officials who had attended previously were absent, after US federal agencies withdrew following the appointment of Jen Easterly, former director of the Cybersecurity and Infrastructure Security Agency, as the conference’s chief executive in January 2026.
Although it wasn't an official conference talking point, Iran was nevertheless the big topic of conversation because the impact of the war was evident at multiple levels, from delegates' travel movements to the kinds of threats now topping the agenda. War in the Middle East made this year’s most important cyber issues feel more immediate and urgent.
There were reports that Israeli cyber companies were keen to attend, despite the country being at war, but were forced to adjust their plans due to travel disruption and airspace restrictions, with some relying on their US-based teams to represent them. Beyond logistics, however, the conference discussions were also influenced.
A digital casus belli
This year, sessions repeatedly returned to a central question: when might a cyberattack warrant a direct military response? After all, if digital attacks disrupt vital facilities such as communications networks or power stations, their effect is no longer merely virtual or technical.
In the Middle East today, this question is no longer theoretical. War means the debate is now closely tied to deterrence, escalation, and the boundaries of state response. Hive Pro, a consultancy, presented the Iranian threat as a hybrid cyber-kinetic escalation that could not be isolated from the wider war, noting that the risk was to specific sectors and infrastructure, including energy, telecoms, and financial services.
There are ongoing assessments of cyber adversaries, their methods and tactics, the most exploited vulnerabilities, and defensive measures, but recent reports of Iranian activity suggest clear, specific attack patterns. For example, Unit 42, the threat intelligence and incident response team at Palo Alto Networks, said it had identified an active phishing campaign using a malicious version of the Israeli Red Alert app on Android. The fake version is used to install surveillance tools and steal data.
Estimates suggest that there are currently around 60 hacking groups active in relation to the war, with some operating within what has been described as an “electronic operations room” since late February 2026. This highlights an important dimension of the Iranian threat: it does not always appear as direct state attacks. More often, it takes the form of a complex network that includes state-linked entities, digital personas, hacking groups, and aligned or allied factions.
