For most of its history, threat hunting’s central problem has been finding enough qualified people to do it. That has changed.
The SANS 2026 Threat Hunting Survey, authored by SANS Principal Instructor Josh Lemon and based on responses from 500 cybersecurity practitioners and security leaders across North America, Europe, Latin America, and Asia, finds that data quality or quantity is now the top barrier to effective threat hunting, cited by 50 per cent of respondents. Skilled staffing, long the dominant concern, has dropped to second place at 45 per cent.
It is the first time in the survey’s five-year history that data has outranked people as the primary obstacle.
Cloud infrastructure is where the problem bites hardest. Thirty-two percent of respondents called it the most difficult environment to hunt in, more than any other category, even as organisations continue shifting workloads there.
“Data quality has overtaken skilled staff as the top barrier for the first time in this survey’s history. You can be the most capable hunter in the room and still come up empty if the telemetry you’re working with is incomplete, inconsistent, or scattered across a dozen tools that are difficult to access or difficult to process. And with only 40 per cent of programs formally measuring whether their hunting actually works, most organizations have no real way of knowing whether that gap is costing them,” Josh Lemon, SANS Principal Instructor said in a statement.
Several other findings point to programs that are becoming less structured over time. The share of organisations with a formally defined threat hunting methodology has fallen to 37 per cent, down from 46 per cent in 2025 and 51 per cent in 2024, while ad hoc approaches have climbed back to 39 per cent. Formal measurement of hunt outcomes has dropped sharply, to 40 per cent from 64 per cent in 2024.
On the threat side, living-off-the-land techniques have become the baseline rather than the exception. Seventy-three percent of respondents identified them as the top method used by nation-state actors, and 63 per cent said the same for organised crime.
AI adoption is tempering. The share of respondents ranking AI and machine learning incorporation among their top planned improvements fell to 39 per cent from 48 per cent in 2025, which the survey reads as practitioners testing AI against their own workflows rather than expecting it to solve the data problem automatically.
Outsourcing continued to decline, falling to 18 per cent from 30 per cent in 2025. The share keeping threat hunting entirely in-house held at 58 per cent for a second consecutive year.
Eighty-two percent of survey respondents said they have been running threat hunting programs for at least two years, which makes the erosion in methodology and measurement harder to attribute to inexperience alone.
