Half of threat hunters say bad data is their biggest problem
SANS 2026 survey finds half of threat hunters cite bad data as their top barrier.
The SANS 2026 Threat Hunting Survey finds half of security professionals name data quality or quantity as their biggest barrier, with cloud logging and identity telemetry gaps cited most often. Only 37% of programs use a formally defined methodology, and 40% formally measure whether hunts work, down from 64% in 2024. Just 11% say hunting improved security by 50% or more over the past year, compared with 47% in 2022. A third still plan to add AI or machine learning, down from 48% in 2025, while most respondents report nation-state actors living off the land.
- Half of hunters cite data quality or quantity as the top barrier.
- A third name cloud infrastructure the hardest environment to hunt.
- Only 37% follow a formal methodology; ad hoc hunting is now slightly more common.
- Formal measurement of hunts fell to 40% from 64% in 2024.
- Plans to add AI or ML dropped to one third from 48% in 2025.
From the original article
2 min read at helpnetsecurity.com
Half of security professionals name data quality or quantity as their biggest barrier to effective threat hunting, according to the SANS 2026 Threat Hunting Survey. Teams with working playbooks describe the logs as their ceiling, and gaps in cloud logging and identity telemetry come up most often.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.