Half of the security professionals surveyed named data quality or quantity as the biggest barrier for threat hunters. SANS Institute reported that 50% now name data as their primary barrier, "the first time in the survey's history that data has outranked skilled staff (45%) as the top obstacle."
The survey drew responses from 500 cybersecurity practitioners and security leaders across North America, Europe, Latin America, and Asia, and SANS has run it since 2021. Experience was not the issue: 82% of respondents said they have been hunting for at least two years. Teams with working playbooks described their logs as the ceiling on what they can find, and the gaps show up most in cloud logging and identity telemetry.
Why clean logs decide what a hunt can catch
Taz Wake, a SANS instructor, wrote in commentary for the survey that attackers work to cover their tracks, which makes gaps in collection costlier. He said defenders need to consider evidence retention windows, log integrity risks, and the challenge of data collection at scale. For a small business, that comes down to a few practical questions: are logs kept long enough to investigate an incident found weeks later, can anyone confirm the logs have not been altered, and is anything being dropped as data volume grows. A hunt built on patchy or inconsistent logs tends to flag noise while a real intrusion moves quietly through the environment.
How today's attackers hide, and what to hunt for
The attackers respondents see most often blend in with normal activity. SANS Institute reported that "73% of respondents identify these techniques as the top method used by nation-state actors, and 63% say the same for organized crime." The technique is living off the land: using the tools already on a system, the same binaries an administrator would use. A hunt built around known bad file hashes or IP addresses will not catch someone running the same software as the IT department. Hunts have to target behavior, such as a legitimate tool doing something it should not, or data leaving by an unusual route. Each of those checks depends on telemetry the team may not be collecting.
Getting cloud systems into the hunt
Cloud infrastructure is where the gap is widest. SANS reported that 32% of respondents, about a third, named cloud infrastructure the hardest environment to hunt in, more than any other area, even as organizations keep moving more of their systems there. That share has eased only a little since last year. Cloud systems and identity providers are worth looking at separately from on-premises logging. A program may want to confirm its cloud data is being collected as fully as its endpoint and network data.
A repeatable method that survives staff changes
SANS reported that 37% of organizations now follow a formally defined threat hunting methodology, down from 46% in 2025 and 51% in 2024, while ad hoc approaches have climbed back to 39%. Josh Lemon, the survey's author and a SANS Principal Instructor, points to staffing as the likely reason: a short-handed team runs whatever hunt its free analyst can handle that week. A hunt that lives in one analyst's head leaves the company when that analyst does. Published frameworks such as PEAK and TaHiTI give a team a repeatable structure without building one from scratch.
Measuring hunts so you can defend the budget
Measuring whether hunts work can make it easier for a program to defend its budget and existence. Only 40% of programs formally measure whether their hunts work, down from 64% in 2024. Reported results have shrunk as well: 11% say hunting improved their security by 50% or more over the past year, compared with 47% in 2022. The survey cannot tell whether hunting is delivering less, whether respondents are grading themselves harder, or whether teams that stopped measuring also stopped noticing results. Lemon leans toward the last: "You tend to find less when you are not looking for it." A team that cannot show what its hunts found has little to bring to a budget meeting.
Where AI helps today
SANS reported that 39% of respondents rank adding AI or machine learning to their hunting tools among their top planned improvements, down from 48% in 2025. The drop could mean teams have moved from planning to implementation, or that they have taken a harder look at what the tools deliver day to day. The survey cannot say which. Early free-text answers describe agentic hunting frameworks that keep analysts making the calls.
What to do now
- Confirm cloud and identity logging is switched on and actually captured. Those were the gaps respondents named most, and they are where behavior-based detection starts.
- Check how long logs are kept and whether they can be trusted. Wake wrote that defenders need to consider evidence retention windows, log integrity risks, and the challenge of data collection at scale.
- Make logs easy to search in one place. Lemon said a hunter can come up empty when telemetry is "incomplete, inconsistent, or scattered across a dozen tools."
- Adopt a published framework such as PEAK or TaHiTI so the method survives a staff change instead of living in one person's head.
- Record what each hunt finds. With only 40% of programs formally measuring whether their hunts work, a record of results can make it easier to defend the work at budget time.
FAQ
What is the biggest barrier to effective threat hunting in the SANS 2026 survey?
Data quality or quantity. Half of respondents named it the biggest barrier, and SANS Institute said it is the first time data has outranked skilled staff, at 45%, as the top obstacle.
Which environment do threat hunters find hardest to work in?
Cloud infrastructure. 32% of respondents, about a third, named it the hardest environment to hunt in, more than any other area, a share that has eased only a little since last year.
How many threat hunting programs use a formal methodology?
37%, down from 46% in 2025 and 51% in 2024, while ad hoc approaches have climbed back to 39%. Short staffing is the likely reason, according to the survey's author.