SANS 2026 Threat Hunting Report: Key Findings

SANS Research: Threat Hunting

How a decade of data reveals a more experienced threat hunting community still held back by data quality, staffing, and cloud visibility gaps.

Read the Report

Jump to:

Key Stats
Methodology
Key Findings
Webcast
Archive
FAQs

More Experience, Same Old Gaps

The SANS 2026 Threat Hunting Survey found that organizations are more experienced than ever yet still held back by the same structural gaps as every prior year. Data quality has overtaken skilled staffing as the top barrier for the first time, while formal methodology and effectiveness measurement both continue to decline.

Top Takeways

50%

now cite data quality as their top barrier, overtaking staffing

82%

have been threat hunting for at least two years

73%

of nation-state attacks still rely on living-off-the-land tactics

37%

have a formally defined methodology, down from 46%

Survey Methodology and Respondent Profile 

Published by SANS Institute in September 2026, this report's benchmarks and frustrations reflect real programs at real organizations, from teams still building their first playbook to those running automated, intelligence-driven hunts across multiple cloud environments.

Verticals & Region

This year’s respondent base of 500 participants spans technology, banking and finance, government, healthcare, and a dozen other sectors, with operational reach across North America, Europe, Asia, and Latin America.

Vendor Neutrality

Dropzone AI, ESET, Google, Intel471, Menlo Security, and Wiz sponsored the research; sponsors fund SANS surveys but do not produce the findings.

Meet the Author

Josh Lemon

Chief Digital Forensics and Incident Response Investigator at SoteriaSec

Josh leads global MDR at Uptycs, defending major international brands, while also serving as an independent DFIR expert advising legal, government, and commercial clients in Australia.

Thank You To Our Sponsors

Key Findings from the SANS 2026 Threat Hunting Report

82% of organizations have been threat hunting for at least two years, reflecting accumulated operational experience.
50% now cite data quality or quantity as their primary barrier, overtaking skilled staffing as the top challenge for the first time.
Formally defined methodologies declined to 37%, down from 46% in 2025, as ad hoc approaches crept back to 39%.
Outsourcing dropped to 18%, down from 30% in 2025, while in-house programs held steady at 58%. 73% of nation-state attacks still rely on living-off-the-land techniques, the dominant tactic across every threat actor category.
Only 40% of organizations formally measure hunt effectiveness, down from 64% in 2024, and 32% identify cloud infrastructure as the hardest environment to hunt in.

Watch the 2026 Threat Hunting Webcast

A decade in, the data shows a community more experienced than ever, yet still held back by data quality, staffing, and cloud visibility gaps. Watch the webcast for a full walkthrough of what changed this year and what to do about it.

Watch Now

White Microphone on Computer Screen Background

Explore the SANS Threat Hunting Report Archive

Explore previous editions of the SANS Threat Hunting Report to see how methodologies, staffing, and adversary tactics have evolved year over year.

Frequently Asked Questions

50% of security professionals cite data quality or quantity as their primary barrier, overtaking skilled staffing shortages for the first time, according to the SANS 2026 Threat Hunting Survey.

Only 18% of organizations fully outsource their threat hunting in 2026, down from 30% in 2025, while 58% keep hunting in-house.

No. Just 37% of organizations have a formally defined threat hunting methodology in 2026, down from 46% in 2025, as ad hoc approaches creep back to 39%.

Yes. 73% of nation-state attacks use living-off-the-land techniques, the most common tactic across every threat actor category tracked in the survey.

Only 40% of organizations formally measure hunt effectiveness in 2026, down from 64% in 2024, making it harder to demonstrate value to leadership.

32% of organizations identify cloud infrastructure as the hardest environment to hunt in, more than any other area, as cloud adoption keeps outpacing hunting capability.

SEC536: Adversarial AI - Penetration Testing AI Systems

SANS 2026 Threat Hunting Report: Key Findings

More Experience, Same Old Gaps

Top Takeways