The SANS 2024 CTI Survey: Managing the Evolving Threat Landscape, published by SANS Institute in May 2024, examines how cyber threat intelligence (CTI) teams manage their work, the tools and technologies supporting them, and the challenges and opportunities they face. The survey covers geopolitical and regulatory pressures, CTI team structure and staffing, intelligence requirements, collection and analysis processes, dissemination methods, and the growing use of AI in CTI programs.
Key findings:
- Only 36% of organizations measure the effectiveness of their CTI program, even though 83% say CTI has improved their security prevention, detection, and response
- Threat hunting is the top use case for cyber threat intelligence for the first time in the survey's history, cited by 75% of respondents
- Use of closed or dark web sources for intelligence collection nearly doubled, rising from 27% in 2023 to 48% in 2024
- Frequent use of structured analytic techniques dropped from 31% in 2023 to just 22% in 2024
- Organizations with some degree of in-house CTI capability rose from 83% last year to 93% this year
- 52% of organizations now have a dedicated CTI team, the highest share ever recorded in this survey
- Nearly one quarter of respondents already use AI in their CTI program, and another 38% plan to
- Auditor roles on CTI teams have nearly tripled since 2022, rising from under 1% of respondents to nearly 3%
- Reporting overtook other formats as the leading CTI dissemination method, growing from 62% in 2022 to 74% in 2024
- 78% of respondents said geopolitics plays a very or somewhat important role in shaping their intelligence requirements
- Lack of funding remains the top challenge cited by CTI teams, reported by 52% of respondents
Across the survey, CTI programs matured operationally. Dedicated teams, in-house capability, and proactive use cases like threat hunting all reached record highs, but measurement and structured analysis lagged behind. Teams are consuming more sources, including dark web feeds, and beginning to adopt AI, while still struggling to prove program effectiveness or secure adequate funding. The gap between growing CTI adoption and the ability to measure its impact stands out as the survey's central tension.
The survey drew responses from 811 professionals across 22 industries, most commonly from organizations with 100,000 or more employees, followed by organizations with fewer than 100 employees. Three quarters of respondents were headquartered in the United States, another 10% in the EU, and government, cybersecurity, technology, and banking and finance accounted for 56% of all responses, leading the survey for the eighth consecutive year.
