Training
Featured Course View All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Group Purchasing
Group Purchasing

SANS 2026 Cyber Threat Intelligence: Key Findings

SANS Research: 2026 Cyber Threat Intelligence

New SANS survey data reveals why 91% of CISOs value CTI, yet only 26% say it significantly shapes their decisions, and what closes that gap.

Read the report
Stylized Background
Jump to:

SANS 2026 CTI Report

Cyber threat intelligence has arrived: embedded in security programs, staffed by dedicated teams, and recognized as essential by executives. The SANS 2026 CTI Survey asks the harder question: what is CTI essential to? Only 26% of CISOs say it significantly influences their decisions. CTI is no longer fighting for legitimacy; it is fighting for influence. 

Top Takeaways

91%

of CISOs value CTI, but only 26% say it significantly influences their decisions.

55%

of organizations lack legally reviewed CTI sharing rules.

44%

of teams cite lack of time or funding as the top CTI barriers.

#1

SecOps is now CTI's leading use case, outpacing threat hunting.

Survey Methodology and Respondent Profile

The 2026 SANS CTI Survey collected responses from 401 qualified cybersecurity professionals globally between November 2025 and January 2026, plus a dedicated module capturing 67 security executives, primarily CISOs and CSOs.

Region

The respondent base is practitioner-heavy, led by security analysts, CTI specialists, and security engineers, with North America and Europe representing the largest geographies and financial services, government and military, technology, and healthcare as the top sectors.

Vendor Neutrality

Sponsor support made this research possible, but sponsors had no role in survey design, data collection, or analysis.

More Key Findings from SANS 2026 CTI Report 

  • CTI has achieved broad institutional adoption, yet most teams remain under four full-time employees. 
  • 91% of CISOs rate CTI valuable or extremely valuable, but only 26% say it significantly influences their decisions. 
  • 45% of organizations are using AI in CTI today, mainly for summarization, reporting, and workflow automation. 
  • 55% of organizations lack legally reviewed CTI sharing processes, even as regulations like NIS2 impose new obligations. 
  • Lack of time (44%) and lack of funding (44%), not lack of expertise, are the top barriers to implementing CTI. 
  • For the first time since 2022, SecOps (71%) has overtaken threat hunting as the leading CTI use case.

Related Webcast: From Independence to Insights: How CTI Empowers Both Practitioners and Decision-Maker

Over the past few years, the cyber threat landscape has been defined by supply chain compromises, the targeting of cloud and SaaS environments, and the growing use of AI by both defenders and adversaries.

Watch Now
Stylized Microphone Teal Background

Meet the Co-Authors

Rebekah Brown

Rebekah Brown

Senior Researcher at Citizen Lab

Rebekah Brown has been instrumental in advancing cyber threat intelligence, serving as a network warfare analyst at the NSA, Operations Chief of a U.S. Marine Corps cyber unit, and training lead at U.S. Cyber Command.

Learn more
Andreas Sfakianakis

Andreas Sfakianakis

Cyber Threat Intelligence Expert at SAP

Andreas is a seasoned cyber threat intelligence professional with over 15 years in cybersecurity. He specializes in cyber threat analysis and building threat management programs.

Learn more

FAQs

91% of CISOs rate CTI as valuable or extremely valuable, but only 26% say it significantly influences their decisions, according to the 2026 SANS CTI Survey. The gap reflects a translation problem, not a credibility one.

45% of organizations are currently using AI in their CTI programs, primarily for data summarization, report writing, and workflow automation, with another 32% planning to adopt it. 

Lack of time to implement new processes (44%) and lack of funding (44%) are the top barriers to effective CTI, ranking well ahead of any analytic or technical skills gap.

No. 55% of organizations lack legally reviewed CTI sharing processes, even as regulations such as NIS2 and the Cyber Resilience Act impose new obligations. 

Security operations (SecOps) is the leading CTI use case at 71%, overtaking threat hunting for the first time since 2022.

Thank You To Our Sponsors

Explore Prior CTI Research from SANS

SANS has published the CTI Survey for several consecutive years, tracking how the discipline has matured from ad hoc reporting into a core, AI-assisted security function. Compare this year's findings against prior editions to see how collection sources, use cases, and executive engagement have shifted over time.

SANS 2026 Cyber Threat Intelligence: Key Findings | SANS Institute