Half of threat hunters say bad data is their biggest problem
Half of security professionals name data quality or quantity as their biggest barrier to effective threat hunting, according to the SANS 2026 Threat Hunting Survey. Teams with working playbooks describe the logs as their ceiling, and gaps in cloud logging and identity telemetry come up most often.
Gaps in the logs hurt most against the attackers respondents see most often, the ones who blend in with legitimate activity. Catching them means spotting behavior that looks wrong, which requires a solid picture of what normal looks like. Build that picture from patchy or inconsistent logs, and the hunt flags noise while the intrusion slips by.
Taz Wake, a SANS instructor, has watched attackers work to cover their tracks, which makes gaps in collection costlier. “Defenders need to consider evidence retention windows, log integrity risks, and the challenge of data collection at scale,” Wake wrote in commentary for the survey.
Attackers now look like administrators
Most respondents said they see nation-state actors living off the land. The technique also tops the list for organized crime and runs a close second for ransomware gangs.
A hunt built around known bad hashes or IP addresses will not catch someone using the same tools as the IT department. Hunts have to target behavior, such as a legitimate tool doing something it shouldn’t or data leaving by an unusual route. Each of those checks depends on telemetry the team may not have.
Cloud systems are where the gap is widest. A third of respondents named cloud infrastructure the hardest environment to hunt in, ahead of every other environment. That share has eased only a little since last year, while companies keep putting more of their systems there.
Hunts are drifting back to improvising
Only 37% of programs now follow a formally defined hunting methodology. Ad hoc hunting is now slightly more common. Josh Lemon, the survey’s author, points to staffing as the likely reason. A short-handed team runs whatever hunt its free analyst can handle that week.
A hunt that lives in one analyst’s head leaves the company with that analyst. Published frameworks such as PEAK and TaHiTI give teams a repeatable structure without starting from scratch.
Fewer teams are keeping score
Just 40% of programs formally measure whether their hunts work, down from 64% in 2024. Reported results have shrunk too. Only 11% say hunting improved their security by 50% or more over the past year, compared with 47% in 2022.
The two numbers may be linked. The survey cannot tell whether hunting is delivering less, whether respondents are grading themselves harder, or whether teams that stopped measuring stopped noticing results. Lemon leans toward the last: “You tend to find less when you are not looking for it.”
If you take one thing away from the numbers, make it this: the uncertainty is the risk. A team that can’t show what its hunts found has little to bring to a budget meeting.
AI isn’t the fix yet
A third of respondents listed adding AI or machine learning to their hunting tools as a planned improvement, down from 48% in 2025. The drop could mean teams have moved from planning to implementation, or that they have taken a harder look at what the tools deliver day to day. The survey cannot say which. Early free-text answers describe agentic hunting frameworks that keep analysts making the calls.
Download eBook: Identity-First Threat Intelligence
