other

SANS Threat Hunting Survey

Annual SANS report on how organizations staff, structure, tool and measure threat hunting programs, based on a poll of security practitioners.

Known aliases

2026 SANS Threat Hunting Survey
SANS 2026 Threat Hunting Survey
The Evolution of Threat Hunting

Relationships

No evidence-backed relationships are recorded.

Current clusters

security2 publishers

Threat hunters put data quality ahead of staffing for the first time in five SANS surveys

Data quality or quantity now leads the barrier list in the SANS threat hunting survey, the first time in five years it has outranked staffing, and the report says collection has outrun normalization.

Publishers:helpnetsecurity.cominfosecurity-magazine.com

Reality

Evidence62
Adoption38
Hype gap+5
Incentives40
Confidence60

security1 publisher

72.7% of SANS hunters who caught nation-state intruders saw them abuse native admin tools

SANS's 2026 hunting survey found 72.7% of hunters who caught nation-state actors saw them living off the land, against 63.4% for ransomware crews. Hunters rank data quality as their top barrier, so detecting misused admin tools starts with the telemetry those hunts depend on.

Publishers:intel471.com

Reality

Evidence50
Adoption45
Hype gap+10
Incentives60
Confidence50