Report Finds Data Now Tops Threat-Hunting Barriers
Formal result tracking was reported by 40%, as data limitations replaced staffing as the leading challenge in a 500-person survey.
- By Danielle Naidu
- Sep 28, 2026
SANS Institute recently released its 2026 Threat Hunting Survey, finding that problems with security data have displaced staffing as the most frequently cited obstacle to effective threat hunting.
Its sample comprised 500 cybersecurity practitioners and security leaders in North America, Europe, Latin America and Asia. Half chose the quality or amount of available data as their primary difficulty; 45% pointed to limited skilled staffing. Experience did not necessarily translate into evaluation: 82% had conducted threat hunts for at least two years, but 40% used formal measures to judge program results, compared with 64% in 2024.
For 32%, cloud infrastructure presented the greatest hunting difficulty. Formal methodologies were in place at 37% of organizations, a decline from 46% in 2025 and 51% in 2024. Ad hoc practices, by comparison, were reported by 39%.
The proportion listing AI or machine learning among its main planned enhancements fell from 48% in 2025 to 39%. Use of outside providers also declined, moving from 30% to 18%. Fifty-eight percent reported keeping their threat-hunting programs in-house, remaining unchanged for the second consecutive year.
About the Author
Danielle Naidu is assistant editor for Security Today, Campus Security Today, Occupational Health & Safety and Environmental Protection Online.