Half of threat hunters in the SANS 2026 survey name bad data as their biggest barrier
Half of respondents to the SANS 2026 Threat Hunting Survey named data quality or quantity as their top hunting barrier. The most cited gaps are cloud and identity logs, the telemetry needed to catch intruders who use administrators' own tools.
The Watch · Security desk
What happened
- Most respondents see nation-state actors living off the land, and the technique tops the list for organized crime and runs a close second for ransomware gangs.
- A third of respondents named cloud infrastructure the hardest environment to hunt in, ahead of every other environment, a share that has eased only a little since last year.
- Only 37% of hunting programs follow a formally defined methodology, and ad hoc hunting is now slightly more common.
- Just 40% of programs formally measure whether their hunts work, down from 64% in 2024.
- A third of respondents plan to add AI or machine learning to their hunting tools, down from 48% who said so in 2025.
Why it matters
- What it limits constraint Behavioral hunts are what catch an intruder using admin tools, and each one fails wherever the team lacks the telemetry, most often in cloud and identity systems.
- Who's exposed exposure Living off the land leads or runs second for every actor class respondents track, so gaps in cloud and identity logs weaken hunts across the whole caseload.
- What it costs cost Raising the ceiling means paying for log collection at scale, longer retention and log integrity controls, the items Wake lists for defenders.
- What it limits constraint Programs that stopped measuring have little evidence of results to bring to the budget meeting where that logging spend gets decided.
Next story · Security · Sep 22
CLOSEDQUORUM puts its next action to a vote of four commercial LLM providersConfirmed7 publishers
A hunt keyed to known bad hashes or IP addresses will not catch an operator using the same tools as the IT department [10]. It has to target behavior, such as a legitimate tool doing something it should not or data leaving by an unusual route [11]. Those checks depend on a picture of normal activity [12]. According to the survey write-up, a picture built from patchy or inconsistent logs makes the hunt flag noise while the intrusion slips by [12].
Taz Wake, a SANS instructor, has watched attackers work to cover their tracks. That raises the cost of every gap in collection [13]. "Defenders need to consider evidence retention windows, log integrity risks, and the challenge of data collection at scale," Wake wrote in commentary for the survey [7].
Teams that already have working playbooks describe the logs as their ceiling [2]. Staffing is the other limit in the numbers. Josh Lemon, the survey's author, points to it as the likely reason for the drift toward ad hoc hunting [4]. A short-handed team runs whatever hunt its free analyst can handle that week [5]. The published write-up does not report the sample size or what share of respondents named staffing or skills as their top barrier. On that record, it cannot show whether telemetry limits hunting more than people do.
A hunt that lives in one analyst's head leaves the company with that analyst [14]. Published frameworks such as PEAK and TaHiTI give teams a repeatable structure without starting from scratch [9].
Reported results fell as measurement did. Just 11% of respondents said hunting improved their security by 50% or more over the past year, against 47% in 2022, a drop of 36 points [17][20]. The survey cannot tell whether hunting is delivering less, whether respondents are grading themselves harder, or whether teams that stopped measuring stopped noticing results [19]. Lemon leans toward the last [18]. "You tend to find less when you are not looking for it," he said [18].
The fall in AI plans could mean teams have moved from planning to implementation, or that they have looked harder at what the tools deliver day to day, according to the write-up [22]. Early free-text answers describe agentic hunting frameworks that keep analysts making the calls [8].
What to watch
- Whether the full SANS report gives the sample size and the share naming staffing or skills as the top barrier, which would test data against people directly.
- Whether cloud's share as the hardest environment to hunt in falls in the next survey as more systems move there.
- Whether the free-text accounts of agentic hunting frameworks show up as measured results in next year's numbers.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption38
- Hype gap+5
- Incentives40
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Half of security professionals name data quality or quantity as their biggest barrier to effective threat hunting, according to the SANS 2026 Threat Hunting Survey.
- [2]
Teams with working playbooks describe the logs as their ceiling, and gaps in cloud logging and identity telemetry come up most often.
- [3]
Most respondents said they see nation-state actors living off the land. The technique also tops the list for organized crime and runs a close second for ransomware gangs.
- [4]
Only 37% of programs now follow a formally defined hunting methodology. Ad hoc hunting is now slightly more common.
- [5]
Josh Lemon, the survey's author, points to staffing as the likely reason for the drift to ad hoc hunting. A short-handed team runs whatever hunt its free analyst can handle that week.
- [6]
Just 40% of programs formally measure whether their hunts work, down from 64% in 2024.
- [7]
Defenders need to consider evidence retention windows, log integrity risks, and the challenge of data collection at scale.
- [8]
Early free-text answers describe agentic hunting frameworks that keep analysts making the calls.
- [9]
Published frameworks such as PEAK and TaHiTI give teams a repeatable structure without starting from scratch.
- [10]
A hunt built around known bad hashes or IP addresses will not catch someone using the same tools as the IT department.
- [11]
Hunts have to target behavior, such as a legitimate tool doing something it shouldn't or data leaving by an unusual route. Each of those checks depends on telemetry the team may not have.
- [12]
Gaps in the logs hurt most against attackers who blend in with legitimate activity. Catching them requires a solid picture of what normal looks like; built from patchy or inconsistent logs, the hunt flags noise while the intrusion slips by.
- [13]
Taz Wake, a SANS instructor, has watched attackers work to cover their tracks, which makes gaps in collection costlier.
- [14]
A hunt that lives in one analyst's head leaves the company with that analyst.
- [15]
A team that can't show what its hunts found has little to bring to a budget meeting.
- [16]
A third of respondents named cloud infrastructure the hardest environment to hunt in, ahead of every other environment. That share has eased only a little since last year.
- [17]
Only 11% say hunting improved their security by 50% or more over the past year, compared with 47% in 2022.
- [18]
You tend to find less when you are not looking for it.
- [19]
The survey cannot tell whether hunting is delivering less, whether respondents are grading themselves harder, or whether teams that stopped measuring stopped noticing results.
- [20]
The share reporting hunting improved security by 50% or more fell 36 percentage points between 2022 and the 2026 survey.
- [21]
A third of respondents listed adding AI or machine learning to their hunting tools as a planned improvement, down from 48% in 2025.
- [22]
The drop in AI plans could mean teams have moved from planning to implementation, or that they have taken a harder look at what the tools deliver day to day. The survey cannot say which.
Sources
2 independent publishers whose own reporting we read for this story.
- helpnetsecurity.comHalf of threat hunters say bad data is their biggest problem
1 article · September 24, 2026
- infosecurity-magazine.comData Overtakes Skills as Top Threat Hunting Challenge, SANS Study Finds
1 article · September 24, 2026
Topics and entities
Topics
- Living off the land
- Threat hunting
- Security Telemetry
Entities
- PEAK Threat Hunting Framework
- SANS Threat Hunting Survey
- SANS Institute