SANS 2026 Threat Hunting Survey: The Evolution of Threat Hunting

Independent research from the SANS Institute, written by SANS Principal Instructor Josh Lemon. 500 security professionals on how their threat hunting programs run, what they find and what still holds them back.

Download Resource

Report Summary

For the first time in the survey’s history, data has overtaken skilled staff as the top barrier to threat hunting. Half of respondents (50%) now rank data quality or quantity as their primary barrier.

What’s inside

Why data quality now outranks staffing as the barrier to threat hunting success, and what fixing the data first looks like

Living-off-the-land techniques lead outright for nation-state and organized crime actors

Cloud remains the hardest environment to hunt in

Why ad hoc methods are creeping back and formal measurement keeps slipping

Where AI fits now that interest has moved from aspiration to grounded evaluation

About the research

This year’s respondents are an experienced group. 82% have been threat hunting for at least two years, so the findings come from established programs rather than early experiments. The report describes a community that is “consolidating rather than racing forward,” with the same friction points from earlier editions still in place around data, methodology and measurement. It closes with three practical takeaways for threat hunting teams.

500 qualified responses

Part of a SANS longitudinal study running since 2021

Respondents across North America, Europe, Asia and Latin America

Written by Josh Lemon, SANS Principal Instructor

"You tend to find less when you are not looking for it."

SANS 2026 Threat Hunting Survey

What the data shows

40%

formally measure the success of their threat hunting, down from 64% in 2024.

37%

have a formally defined methodology, down from 46% in 2025, while ad hoc approaches sit at 39%.

70% / 11%

70% report improved security posture. Only 11% report a large (50%+) gain, down from 47% in 2022.

32%

identify cloud infrastructure as the hardest environment to hunt in, more than any other area.

Download Resource

Share this resource

Consent Preferences