SANS 2026 Threat Hunting Survey: data quality overtakes staffing as top barrier

In two minutes

• Data quality or quantity is now the most-cited barrier to threat hunting at 50%, ahead of skilled staff at 45%, for the first time in the survey's history.
• Formally defined hunting methodology fell to 37% from 46% in 2025, and ad hoc approaches rose to 39%. The author links this to staffing pressure.
• Only 40% of programs formally measure hunt effectiveness, down from 64% in 2024. The author warns this makes the case for staff and tooling harder to make.
• Living off the land is the leading technique across nation-state, organized crime and ransomware activity. The author says this points to behavior-based hunts over indicator-based ones.
• Cloud is the hardest environment to hunt in (32%), and portable devices rose in importance from 1% to 9%, with 23% calling them hardest, second only to cloud.
• In-house hunting held at 58% and outsourcing fell to 18% from 30%. Interest in AI/ML as a planned improvement fell to 39%, with early mention of agentic hunting frameworks.
• The respondents are experienced: more than 80% have hunted for at least two years. Ransomware is the most commonly found actor type at 55%.

Key numbers

• 500: qualified survey responses from security professionals (p. 22).
• 50% vs 45%: data quality or quantity vs skilled staff as top barrier to success (p. 18).
• 37% (46% in 2025): respondents with a formally defined hunting methodology (p. 13).
• 40% (64% in 2024): respondents who formally measure hunt effectiveness (p. 17).
• 73%: nation-state hunts that find living-off-the-land techniques (p. 10).
• 55%: respondents who usually uncover ransomware actors when hunting (p. 9).
• 32%: respondents naming cloud infrastructure the hardest environment to hunt in (p. 8).
• 18% (30% in 2025): respondents who outsource threat hunting (p. 15).

What to do with it

• Prioritize data normalization and telemetry coverage, especially cloud and identity logs, before adding more hunts (key takeaway 01, p. 3; p. 7).
• Anchor hunts in a repeatable framework such as PEAK or TaHiTI to stop drift toward ad hoc methods (p. 13).
• Build hunt hypotheses around behavior, such as what legitimate tools should not be doing and where data should not be going, rather than known hashes or IPs (p. 10).
• Set up formal measurement of hunt outcomes. The document names metrics and SLA-based approaches (76%) and staff feedback (39%) as what measuring teams use (p. 17).
• Review evidence retention windows and log integrity, given that 47% of nation-state hunts found deleted traces (p. 10, p. 12).
• Add portable devices to the tooling roadmap now, given their jump in importance and difficulty (p. 8).

Read the full document if

• you need benchmarks for hunt cadence, methodology, outsourcing and investment plans to compare against your own program.
• you are building the case for hunting staff or telemetry budget and want year-over-year trends from 2021 onward.
• you are deciding how to write hunt hypotheses against living-off-the-land activity.

What it relies on

The document rests on its own survey: 500 qualified responses, with the top industries being technology, banking and finance, government and cybersecurity, across the US, Canada, Europe and Asia (p. 22). It compares against earlier editions of a study running since 2021 (p. 4), and adds free-text responses and one expert comment. The author, Josh Lemon, is a SANS Principal Instructor (p. 2). The text names a sponsor page but the sponsor's name is not in the extracted text (p. 23); the file is hosted on Menlo Security's site. The 2026 threat actor question was restructured, so the author says some year-over-year drops are not like for like (p. 9). A few figures differ between pages, for example commercial intelligence providers at 47% in text and 46% in figure 5 (p. 11).

Our read

A short, readable benchmark of how hunting programs run and where they stall. It is most useful for the multi-year trend lines on methodology, measurement and barriers. Treat the actor and source comparisons with care, since the author says the 2026 question was restructured. The commentary mixes survey results with the author's own interpretation.