SANS survey: Data overtakes staffing as top threat hunting barrier

For years, a threat hunting programme’s results depended largely on whether it had enough skilled people to run it. SANS Institute has released the SANS 2026 Threat Hunting Survey: The Evolution of Threat Hunting, authored by Josh Lemon, SANS Principal Instructor, and this year’s data shows staffing is no longer the top concern it once was. The survey finds the same structural friction that has defined threat hunting since its first iteration, this time rooted in the data that hunters depend on rather than the people running the hunts.

The survey collected responses from 500 cybersecurity practitioners and security leaders across North America, Europe, Latin America, and Asia. The survey has tracked how organisations approach proactive threat detection since 2021.

Eighty-two percent of respondents have been hunting for at least two years. Despite that experience, 50% now name data quality or quantity as their primary barrier to effective hunting, the first time in the survey’s history that data has outranked skilled staff (45%) as the top obstacle. Cloud infrastructure is where the data problem hits hardest with 32% calling it the toughest environment to hunt in, more than any other area, even as organisations keep moving more of their infrastructure there.

“Data quality has overtaken skilled staff as the top barrier for the first time in this survey’s history,” said Josh Lemon, SANS Principal Instructor. “You can be the most capable hunter in the room and still come up empty if the telemetry you’re working with is incomplete, inconsistent, or scattered across a dozen tools that are difficult to access or difficult to process. And with only 40% of programmes formally measuring whether their hunting actually works, most organisations have no real way of knowing whether that gap is costing them.”

Additional key findings from the survey include:

• Living-off-the-land techniques dominate: 73% of respondents identify these techniques as the top method used by nation-state actors, and 63% say the same for organised crime. Malware-free, behaviour-blending tradecraft is now the baseline hunters are expected to catch, no longer an exception to watch for.
• Defined methodologies are eroding: 37% of organisations now have a formally defined threat hunting methodology, down from 46% in 2025 and 51% in 2024, while ad hoc approaches have climbed back to 39%.
• Measurement is falling: Formal measurement of hunt outcomes has fallen to 40%, down from 64% in 2024, making it harder for programmes to defend their budgets and existence.
• AI plans are getting more grounded: 39% rank AI/ML incorporation among their top planned improvements, down from 48% in 2025, a sign that hunters are testing AI against their own workflows rather than assuming it will close that data gap for them.
• Outsourcing continues declining: Outsourcing fell to 18% from 30% in 2025, while organisations keeping hunting in-house held steady at 58% for a second consecutive year.

The full SANS 2026 Threat Hunting Survey: The Evolution of Threat Hunting is free to download today at sans.org/white-papers/sans-2026-threat-hunting-survey-evolution-threat-hunting. Josh Lemon will present an accompanying webcast on Wednesday, September 23^rd at 10:30 a.m. ET and a recording will be available after. Sign up for the webcast or view the recording at sans.org/webcasts/sans-2026-threat-hunting-survey.