The 2026 SANS SOC Survey: A Decade of Evolution in Cyber Defense

Independent research from the SANS Institute. 444 security practitioners, a first-ever module of 69 CISOs and senior executives, and ten years of trend data, authored by SANS Senior Instructor Christopher Crowley.

Download Resource

White tapered dashes forming waves across the section background

Report Summary

79% of SOCs now use AI or ML.
Only 36% have built it into a defined workflow. The distance between those two numbers runs through this year's survey.

What's inside:

The adoption-integration gap in the survey's own numbers, with 79% of SOCs using AI but only 36% running it inside a defined workflow.

Why the staffing challenge is a management problem, with only 32% of practitioners saying management pays close attention to hiring and retention.

What actually retains SOC analysts, and why meaningful work has outranked compensation for the third year running.

Why data strategy, not budget, predicts technology satisfaction, shown in a 2.76 versus 2.14 satisfaction gap.

New this year, a dedicated module of 69 CISOs and senior executives, and the 27-point gap between how leaders and practitioners describe the same SOC.

The full report also covers SOC capabilities, architecture, OT and IoT coverage, threat intelligence, threat hunting, tooling, metrics, and the cyber leaders' perspective.

A decade of SANS SOC research

10th

annual edition

444

qualified practitioners

CISOs and senior executives (new cyber leaders' module)

Authored by Christopher Crowley

SANS Senior Instructor

"The biggest AI risk in the SOC is not a bad tool. It is an analyst who trusts one."

2026 SANS SOC Survey

For ten years, the SANS SOC Survey has tracked how security operations actually works, not how it is supposed to. This year's report names three tensions that run through the data. AI has been adopted faster than it has been integrated. The factors that retain skilled people are well understood and still not acted on. And strategic intent keeps running ahead of execution. The full report works through each one with the survey's numbers.

79% / 36%.

AI is in the SOC. Structured, governed AI is not.

32%

of practitioners say management pays close attention to SOC hiring and retention.

Meaningful work (26%)

is the top retention driver three years running. Compensation ranks fourth.

24%

of cyber leaders name lack of enterprise-wide visibility as their single biggest barrier.

The full report also covers SOC capabilities, architecture, OT and IoT coverage, threat intelligence, threat hunting, tooling, metrics, and the cyber leaders' perspective.

Download Resource

Share this resource

Consent Preferences