SANS 2026 Threat Hunting Survey: The Evolution of Threat Hunting

32% of cybersecurity practitioners and security leaders call cloud infrastructure the toughest environment to threat hunt in.

39% of organizations use ad hoc approaches to threat hunting.

39% of cybersecurity practitioners and security leaders rank AI/ML incorporation among their top planned improvements, down from 48% in 2025.

37% of organizations have a formally defined threat hunting methodology, down from 46% in 2025 and 51% in 2024.

50% of cybersecurity practitioners and security leaders name data quality or quantity as their primary barrier to effective threat hunting.

45% of cybersecurity practitioners and security leaders name lack of skilled staff as their primary barrier to effective threat hunting.

Organizations' threat hunting programs formally measure hunt outcomes at a rate of 40%, down from 64% in 2024.

73% of cybersecurity practitioners and security leaders identify living-off-the-land techniques as the top method used by nation-state actors.

63% of cybersecurity practitioners and security leaders identify living-off-the-land techniques as the top method used by organized crime.

Outsourcing of threat hunting falls to 18%, down from 30% in 2025.

58% of organizations keep threat hunting in-house, unchanged for a second consecutive year.