SANS Releases its 2026 Threat Hunting Survey Report

SANS 2026 Threat Hunting Survey reveals, half of threat hunters now call data their biggest barrier, overtaking staffing for the first time.

SANS Institute has released the SANS 2026 Threat Hunting Survey: The Evolution of Threat Hunting authored by Josh Lemon, SANS Principal Instructor, and this year’s data shows staffing is no longer the top concern it once was. The survey finds the same structural friction that has defined threat hunting since its first iteration, this time rooted in the data that hunters depend on rather than the people running the hunts.

The survey collected responses from 500 cybersecurity practitioners and security leaders across North America, Europe, Latin America, and Asia. The survey has tracked how organizations approach proactive threat detection since 2021.

According to the report, eighty-two percent of respondents have been hunting for at least two years. Despite that experience, 50% now name data quality or quantity as their primary barrier to effective hunting. This is the first time in the survey’s history that data has outranked skilled staff (45%) as the top obstacle, notes SANS. Cloud infrastructure is where the data problem hits hardest with 32% calling it the toughest environment to hunt in, more than any other area, even as organizations keep moving more of their infrastructure there.

“Data quality has overtaken skilled staff as the top barrier for the first time in this survey’s history,” said Josh Lemon, SANS Principal Instructor. “You can be the most capable hunter in the room and still come up empty if the telemetry you’re working with is incomplete, inconsistent, or scattered across a dozen tools that are difficult to access or difficult to process. And with only 40% of programs formally measuring whether their hunting actually works, most organizations have no real way of knowing whether that gap is costing them.”

Additional key findings SANS 2026 Threat Hunting Survey:

• Living-off-the-land techniques dominate: 73% of respondents identify these techniques as the top method used by nation-state actors, and 63% say the same for organized crime. Malware-free, behavior-blending tradecraft is now the baseline hunters are expected to catch, no longer an exception to watch for.
• Defined methodologies are eroding: 37% of organizations now have a formally defined threat hunting methodology, down from 46% in 2025 and 51% in 2024, while ad hoc approaches have climbed back to 39%.
• Measurement is falling: Formal measurement of hunt outcomes has fallen to 40%, down from 64% in 2024, making it harder for programs to defend their budgets and existence.
• AI plans are getting more grounded: 39% rank AI/ML incorporation among their top planned improvements, down from 48% in 2025, a sign that hunters are testing AI against their own workflows rather than assuming it will close that data gap for them.
• Outsourcing continues declining: Outsourcing fell to 18% from 30% in 2025, while organizations keeping hunting in-house held steady at 58% for a second consecutive year.

Source: SANS 2026 Threat Hunting Survey: The Evolution of Threat Hunting

Disclaimer: This article is based on SANS Institute’s 2026 Threat Hunting Survey: The Evolution of Threat Hunting report and has been edited for length and readability. Readers are advised to refer to the full research report for methodology and complete findings.