Threat hunting is becoming more experienced, but organizations are struggling to turn that expertise into measurable security outcomes, according to the SANS 2026 Threat Hunting Survey.
The survey of 500 cybersecurity practitioners and security leaders across North America, Europe, Latin America and Asia finds that data quality and quantity have overtaken staffing as the biggest obstacle to effective threat hunting. Half of respondents identify data as their primary barrier, compared with 45% who point to a shortage of skilled staff.
The finding marks a shift in the threat-hunting challenge. Eighty-two percent of respondents have at least two years of hunting experience, suggesting that the problem is increasingly less about building basic expertise and more about giving experienced teams usable telemetry.
“Data quality has overtaken skilled staff as the top barrier for the first time in this survey’s history. You can be the most capable hunter in the room and still come up empty if the telemetry you’re working with is incomplete, inconsistent, or scattered across a dozen tools that are difficult to access or difficult to process.”
— Josh Lemon, SANS Principal Instructor
Cloud environments present the biggest hunting challenge, with 32% identifying cloud infrastructure as the toughest environment to investigate. As organizations continue moving infrastructure to the cloud, fragmented or inconsistent telemetry could become a growing constraint on proactive detection.
The survey also highlights a measurement problem. Only 40% of threat-hunting programs formally measure outcomes, down from 64% in 2024. Without meaningful metrics, security leaders have less evidence to demonstrate whether hunting is reducing risk or justify continued investment.
At the same time, formal hunting methodologies are declining. Only 37% of organizations now have a defined methodology, compared with 46% in 2025 and 51% in 2024, while ad hoc approaches have risen to 39%.
Living-off-the-land techniques remain the dominant challenge, identified by 73% of respondents as the leading technique used by nation-state actors and by 63% for organized crime.
AI adoption is also becoming more measured. While 39% rank AI/ML incorporation among their top planned improvements, this is down from 48% in 2025, suggesting organizations may be evaluating AI against practical hunting workflows rather than treating it as a solution to underlying data problems.
Meanwhile, outsourcing continues to decline, falling to 18% from 30% in 2025, while 58% continue to keep threat hunting in-house.
The findings point to a fundamental shift: improving threat hunting may now depend less on adding people and more on improving the quality, accessibility and consistency of the data those people rely on.
