Data Overtakes Skills as Top Threat Hunting Challenge, SANS Study Find

Data has overtaken skills as the number one barrier for threat hunters, for the first time in the five years the SANS Institute has surveyed the industry.

The research organization polled 500 cybersecurity practitioners and leaders across North America, Europe, Latin America and Asia to compile the SANS 2026 Threat Hunting Survey: The Evolution of Threat Hunting.

Half (50%) of those respondents named data quality or quantity as their biggest hurdle to threat hunting, up from 41% last year and 34% in 2023.

“The direction of that trend suggests that the volume of data flowing into hunting programs is now creating as many problems as it solves, with normalization and standards lagging behind collection,” the report noted.

Skilled staff (45%) came a close second, down from 61% last year, which represents progress, the report claimed.

Skills shortages mean fewer hunts are run and those that do go ahead “lean more heavily on whoever happens to be available rather than whoever is best placed to construct the hypothesis,” it noted.

Formally defined threat hunting methodologies dropped from 51% in 2024 to 37% this year, with ad hoc approaches at 39%. This matters because a formalized approach is “what makes a hunting program repeatable and defensible,” SANS argued.

Budget constraints (42%), lack of data standards (39%), tool limitations (37%), and lack of defined processes (36%) were the other cited barriers.

SANS principal instructor and report author, Josh Lemon, underscored the importance of high-quality data to threat hunters.

“You can be the most capable hunter in the room and still come up empty if the telemetry you're working with is incomplete, inconsistent, or scattered across a dozen tools that are difficult to access or difficult to process,” he said.

“With only 40% of programs formally measuring whether their hunting actually works, most organizations have no real way of knowing whether that gap is costing them.”

Ransomware Remains Top Threat for Hunting Teams

The programs themselves are more experienced than ever, with over 80% of respondents claiming to have been hunting for at least two years.

Ransomware (55%), business email compromise (43%), nation states (26%) and insiders (26%) are what they find most often, with living-off-the-land techniques by far the most common.

“If you are still writing hunts around known bad hashes or IP addresses, you are hunting for threat actors who stopped behaving that way years ago,” the report argued.

However, despite their challenges, threat hunters are not taking to AI and machine learning in their droves. Only 39% ranked AI/ML incorporation among their top planned improvements, down from 48% last year.

In fact, intent to use these tools has fallen for two years in a row. This is because teams are “moving from aspiration to the harder work of actual implementation,” SANS claimed.

“The teams describing agentic hunting frameworks in their free-text responses are the early signals of where this goes ,” it concluded .

“For now, the practical gap most worth closing is the measurement one: If your program cannot demonstrate what it finds and what that prevents, the investment case for everything else in this report becomes much harder to make.”

#RSAC Interview: SANS Institute’s Rob Lee Discusses the State of Technical Skills in Cybersecurity Interview 9 June 2022

#RSAC Interview: SANS Institute’s Rob Lee Discusses the State of Technical Skills in Cybersecurity

Five Continents, Five Voices: Siddhesh Patel, Americas Interview 3 December 2019

Five Continents, Five Voices: Siddhesh Patel, Americas

How AI is the Future of Cybersecurity -Gen 1 December 2017

How AI is the Future of Cybersecurity

Staffing Is Top SOC Challenge Even as AI Proliferates, Says SANS News 17 June 2026

Staffing Is Top SOC Challenge Even as AI Proliferates, Says SANS

#BSidesBelfast: Threat Hunting Requires Curiosity and Culture News 31 October 2019

#BSidesBelfast: Threat Hunting Requires Curiosity and Culture

What’s Hot on Infosecurity Magazine?

ShinyHunters Claims FBI Hack Via PeopleSoft Zero Day

ShinyHunters Claim Hack of Rival Ransomware Gang Clop

Network Segmentation Failures Are Expanding the Corporate Attack Surface

Experts Alarmed Over Gyazo’s Breach of 490 Million Metadata Records

North Korean Attackers Hit 30,000 Devices and Steal $10.7m

Ransomware Attacks Reach Record High for 2026

Major Cyber Vendors Turn to New UK Testing Program as MITRE Evaluations Face Changes

ShinyHunters Claim Hack of Rival Ransomware Gang Clop

AI Agent Carries Out Multi-Stage Data Theft Attack

Experts Alarmed Over Gyazo’s Breach of 490 Million Metadata Records

CRA Reporting Rules Take Effect: How to Ensure Your Organization is Ready

New Exvicy ClickFix Framework Built on Rival ErrTraffic's Code

AI-Driven Cloud Threats and Defenses: Securing AI-Powered Environments

Your Security Awareness Programme Isn't Failing, It's Just Not Relevant

From APIs to Agents: How to Secure AI at Enterprise Scale

Frontier AI: How Cyber Defenders Can Harness the Defender’s Window

Human Risk in Cybersecurity: Protecting Your Organization Beyond Technology

Same Front Door, New Visitors: Securing Humans and AI Agents at the Browser

How Faster Cyber-Attacks Are Reshaping Enterprise Cybersecurity Strategies

Researchers Claim First Fully Agentic Ransomware: JadePuffer

AI is Already Powering Cyber-Attacks. Can it Power Cyber Defense?

Google Cloud's New CISO Chris Betz on Integrating AI in Cyber Defenses

How World Cup Password Trends Can Increase Active Directory Risk

New CISA Guide Helps Agencies Adopt SASE For Zero Trust