New research from the SANS Institute
SANS 2026 Threat Hunting Survey: The Evolution of Threat Hunting
Independent research from the SANS Institute, written by SANS Principal Instructor Josh Lemon. 500 security professionals on how their threat hunting programs run, what they find and what still holds them back.
For the first time in the survey's history, data has overtaken skilled staff as the top barrier to threat hunting. Half of respondents (50%) now rank data quality or quantity as their primary barrier.
What's inside
Why data quality now outranks staffing as the barrier to threat hunting success, and what fixing the data first looks like
Living-off-the-land techniques lead outright for nation-state and organized crime actors
Cloud remains the hardest environment to hunt in
Why ad hoc methods are creeping back and formal measurement keeps slipping
Where AI fits now that interest has moved from aspiration to grounded evaluation
We'll send the report to your work email. Unsubscribe anytime.
About the research
This year's respondents are an experienced group. 82% have been threat hunting for at least two years, so the findings come from established programs rather than early experiments. The report describes a community that is "consolidating rather than racing forward," with the same friction points from earlier editions still in place around data, methodology and measurement. It closes with three practical takeaways for threat hunting teams.
500 qualified responses
Part of a SANS longitudinal study running since 2021
Respondents across North America, Europe, Asia and Latin America
Written by Josh Lemon, SANS Principal Instructor
You tend to find less when you are not looking for it.
SANS 2026 Threat Hunting Survey
What the data shows
40%
formally measure the success of their threat hunting, down from 64% in 2024.
37%
have a formally defined methodology, down from 46% in 2025, while ad hoc approaches sit at 39%.
70% / 11%
70% report improved security posture. Only 11% report a large (50%+) gain, down from 47% in 2022.
32%
identify cloud infrastructure as the hardest environment to hunt in, more than any other area.
.png)