<\/p>\n\n\n\n
Threat hunting is facing a growing data challenge, according to the latest SANS survey, which finds that data quality or quantity has overtaken skilled staff as the biggest barrier to effective threat hunting.<\/p>\n\n\n\n
SANS Institute<\/a> has released the SANS 2026 Threat Hunting Survey: The Evolution of Threat Hunting, authored by Josh Lemon, SANS Principal Instructor. The survey shows that staffing is no longer the primary concern for threat hunting programs.<\/p>\n\n\n\n Instead, the findings point to persistent challenges around the data that security teams rely on to identify potential threats.<\/p>\n\n\n\n The survey collected responses from 500 cybersecurity<\/a> practitioners and security leaders across North America, Europe, Latin America, and Asia. It has tracked how organisations approach proactive threat detection since 2021.<\/p>\n\n\n\n This year, 82% of respondents said they have been involved in threat hunting for at least two years. However, 50% identified data quality or quantity as their primary barrier to effective hunting.<\/p>\n\n\n\n That marks the first time in the survey’s history that data has ranked above skilled staff, which was cited by 45% of respondents.<\/p>\n\n\n\n Cloud infrastructure is also creating challenges for security teams. Some 32% of respondents identified it as the toughest environment to hunt in, more than any other area. This comes as organisations continue to move more of their infrastructure to the cloud.<\/p>\n\n\n\n “Data quality has overtaken skilled staff as the top barrier for the first time in this survey’s history,” said Josh Lemon, SANS Principal Instructor.<\/p>\n\n\n\n “You can be the most capable hunter in the room and still come up empty if the telemetry you’re working with is incomplete, inconsistent, or scattered across a dozen tools that are difficult to access or difficult to process,” Lemon added.<\/p>\n\n\n\n He also pointed to a measurement gap across many programmes. Only 40% of programmes formally measure whether their hunting is effective, making it difficult for organisations to determine the impact of data gaps.<\/p>\n\n\n\n The survey also highlights the continued importance of techniques that can operate without traditional malware. Some 73% of respondents identified living-off-the-land techniques as the top method used by nation-state actors, while 63% said the same for organised crime.<\/p>\n\n\n\n At the same time, formally defined threat hunting methodologies are becoming less common. Only 37% of organisations now have a formally defined methodology, compared with 46% in 2025 and 51% in 2024.<\/p>\n\n\n\n Ad hoc approaches have increased to 39%.<\/p>\n\n\n\n Measurement is also declining. Formal measurement of hunt outcomes has fallen to 40%, down from 64% in 2024. This could make it harder for organisations to demonstrate the value of their hunting programmes and support their budgets.<\/p>\n\n\n\n Plans around AI and machine learning have also become more measured. Some 39% of respondents ranked AI and ML incorporation among their top planned improvements, down from 48% in 2025.<\/p>\n\n\n\n The findings indicate that organisations are assessing AI against their existing workflows rather than relying on it to address underlying data challenges.<\/p>\n\n\n\n Meanwhile, outsourcing continues to decline. The share of organisations outsourcing threat hunting fell to 18%, compared with 30% in 2025. Organisations keeping hunting in-house remained at 58% for the second consecutive year.<\/p>\n\n\n\n The full SANS 2026 Threat Hunting Survey: The Evolution of Threat Hunting is available to download from SANS Institute<\/a>.<\/p>\n\n\n\n Josh Lemon was scheduled to present an accompanying webcast on September 23 at 10:30 a.m. ET, with a recording available afterward. The webcast information is available through SANS webcast page<\/a>.<\/p>\n\n\n\n The survey findings show that as threat hunting programmes gain experience, access to usable and measurable security data remains a significant challenge for organisations.<\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" Threat hunting is facing a growing data challenge, according to […]<\/p>\n","protected":false},"author":58,"featured_media":107813,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1595,9621],"tags":[314],"contributor":[9732],"class_list":["post-107811","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-emerging-technologies","tag-cybersecurity-2","contributor-news-desk"],"featured_image_src":"https:\/\/techxmedia.com\/en\/wp-content\/uploads\/2026\/10\/Josh-Lemon-SANS.jpg.jpeg","author_info":{"display_name":"Lubna","author_link":"https:\/\/techxmedia.com\/en\/author\/lubna\/"},"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t