SANS 2025 CTI Survey Webcast & Forum: Navigating Uncertainty in Today’s Threat Landscape

The SANS 2025 CTI Survey: Navigating Uncertainty in Today's Threat Landscape, published by SANS Institute in May 2025, examines how cyber threat intelligence (CTI) teams are structured, resourced, and operating amid a more complex and fast-changing threat environment. The survey drew 489 responses from CTI professionals across industries including cybersecurity services, government, banking and finance, and technology, spanning organizations from fewer than 1,000 to more than 50,000 employees.

Key findings:

• Lack of funding hit a new high as a barrier to CTI programs, cited by 62% of respondents, up from 52% in 2024 and 40% in 2023
• Executive (C-suite and board) contribution to CTI intelligence requirements jumped from 33% in 2023 to 52% in 2025
• CTI teams heavily favor external intelligence: 90% collect external data sources compared to 64% that use internal sources
• 86% of CTI teams use the MITRE ATT&CK framework, and threat hunting is the top use case, cited by 77% to 84% of respondents depending on the measure
• Written reports are now the leading method for communicating intelligence, used by 80% of teams, up from 62% in 2022
• 55% of organizations measure the effectiveness of their CTI program, and among those, 84% gather feedback directly through meetings
• More than one-third of organizations now use artificial intelligence in some part of their CTI process, most commonly in data collection and analysis scoring
• 52% of organizations report having a dedicated CTI team, a 10 percentage point increase compared to 2018
• 93% of organizations maintain some form of in-house CTI capability, ranging from a single analyst to a dedicated team
• 70.2% say their CTI processes have evolved in direct response to an increasingly complex digital landscape
• Only 13% of respondents identified limited communication skills as a barrier to CTI, despite reporting becoming the dominant delivery method
• 62% of organizations have between 0.5 and 4 full-time equivalents dedicated to CTI, with 2 to 4 FTEs the most common staffing level

The survey points to a CTI discipline that is maturing in process and framework adoption faster than it is maturing in resourcing. Teams are converging on shared standards like MITRE ATT&CK and formal reporting, and executives are more engaged in shaping intelligence requirements than in prior years, yet funding constraints are worsening rather than easing. The heavy reliance on external data sources over internal ones also suggests CTI teams have room to capture more organization-specific context, a gap the survey's authors flag as a near-term opportunity. The survey was conducted by SANS Institute and reflects responses from CTI analysts, threat researchers, security operations staff, and security managers or directors, with the largest respondent segments coming from cybersecurity service providers and organizations with 1,000 or fewer employees.