Sans 2026 Threat Hunting Survey Evolution Threat Hunting

The 2026 SANS Threat Hunting Survey is part of a multiyear longitudinal study that has tracked how organizations approach proactive threat detection since 2021. Each year, we survey practitioners and security leaders across industries and organization sizes to build an independent picture of how the threat-hunting community is evolving.

This year’s respondent base of 500 participants spans technology, banking and finance, government, healthcare, and a dozen other sectors, with operational reach across North America, Europe, Asia, and Latin America. This diversity is important because the benchmarks and frustrations captured in this report reflect real programs at real organizations, from teams still building their first playbook to those running automated, intelligence-driven hunts across multiple cloud environments. More than 80% of respondents have been hunting for at least two years, which means this data is shaped by accumulated experience rather than early experimentation.

SANS 2026 Threat Hunting Survey: The Evolution of Threat Hunting

Threat hunting is no longer just a niche skill—it’s a critical pillar of modern defense.

Josh leads global MDR at Uptycs, defending major international brands, while also serving as an independent DFIR expert advising legal, government, and commercial clients in Australia.

Bot or Not? Detecting AI-Driven Web Traffic Using Network Metadata Analysis

Evaluating the Impact of Log Configuration on Lateral Movement Detection Using Windows Event Logs

Assessing the Feasibility and Effectiveness of AI in CTI-Driven Threat Hunting

Network Artifacts of Trusted Service Abuse

Evaluating the Detection Effectiveness of Network Monitoring Tools Against Modern Command-and-Control Frameworks

Cyber Intelligence GraphRAGs for Behavioral Detection