Final Week to Get an iPad mini, Surface Go 2, or Take $300 Off with OnDemand Training!


Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.

Threat Hunters Strike Back: Results of SANS Survey Released

Hunting still maturing and mostly ad-hoc, but those who hunt report improvements in security and response

  • Bethesda, MD
  • April 17, 2017

Threat hunting is becoming an integral part of defensive activities in larger enterprises or those that have been heavily targeted in the past, according to a new SANS Survey. Yet, findings also show that threat hunting is still an immature practice that relies mostly on human intuition to conduct the searches.

SANS defines threat hunting as a focused and iterative approach to search out, identify and understand adversaries that have entered the defender's networks. Hunting should be proactive, yet 43% of respondents say their hunts are triggered by an event or a hunch, and 5% of respondents don't know what triggers their hunts. The remainder are either monitoring continuously (which SANS recommends) or on a regular schedule, such as once a week.

"Threat Hunting is new to most organizations and demonstrates that it has had a positive effect on reducing attacker dwell time for those organizations that conduct hunts regularly," says the survey's author, Rob Lee, SANS fellow and curriculum lead author for the SANS Incident Response and Forensics training courses.

In the survey, 60% of those who hunt for threats reported measurable improvements in their InfoSec programs based on their hunting efforts, and 91% report improvements in speed and accuracy of response.

Staffing and skills remain problematic for organizations trying to fill threat hunting positions, with only 31% of organizations designating a program for threat hunting with assigned staff. Log analysis, knowledge of the network, threat analysis, incident response and forensics are all sought-after skills for developing threat hunting programs.

Skills--and tools--also need to mature to improve data search, connect the dots between information sources, investigate and conduct the searches, according to responses.

"The survey benefits our industry by showing that most organizations are new to hunting efforts," Lee concludes. "It is also a gut check for those organizations not yet starting to incorporate hunting into their security operations."

Results will be discussed at the SANS Threat Hunting and Incident Response Summit, April 18-19 in New Orleans. Link here:

Following the summit, full results of the survey will be shared during a two-part webcast aired live Wednesday, April 26 and Thursday, April 27 at 1 PM EDT. The webcasts, hosted by SANS, are sponsored by Anomali, DomainTools, Malwarebytes, Rapid7, Sqrrl and ThreatConnect. Register to attend the webcasts at and

Those who attend the webcasts receive early access to the associated whitepaper, which will be posted and available at after the live webcasts.


Hunting for threats: Results of SANS Survey released 4/26 and 4/27 | and

Ready, aim, fire: SANS Threat Hunting Survey results revealed 4/26 and 27 | and

Continuous threat hunting improves security and response; SANS survey released 4/26 and 27 | and

About SANS Institute

The SANS Institute was established in 1989 as a cooperative research and education organization. SANS is the most trusted and, by far, the largest provider of cyber security training and certification to professionals at governments and commercial institutions world-wide. Renowned SANS instructors teach over 60 different courses at more than 200 live cyber security training events as well as online. GIAC, an affiliate of the SANS Institute, validates a practitioner’s qualifications via over 35 hands-on, technical certifications in cyber security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master's degrees in cyber security. SANS offers a myriad of free resources to the InfoSec community including consensus projects, research reports, and newsletters; it also operates the Internet's early warning system–the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to help the entire information security community. (