Data Quality Surpassed Staffing as Top Hunting Barrier
The 2026 SANS Institute survey highlights shifting security challenges as organizations struggle to measure hunt outcomes.
Updated on Sept. 23, 2026 in Cybersecurity
Live Poll
Do you believe data issues currently pose a greater risk to cybersecurity than staffing shortages?
The SANS Institute released its 2026 Threat Hunting Survey, revealing that data quality has replaced skilled staffing as the primary barrier for security teams. The survey, which gathered insights from 500 cybersecurity practitioners, highlights how infrastructure transitions are complicating efforts to identify threats.
Why it matters
The transition to cloud-based infrastructure has made threat hunting more difficult, while organizations increasingly struggle to formally track the effectiveness of their internal detection efforts. These findings mark a pivot in security operations as firms favor in-house teams over outsourcing.
Only 37% of organizations currently utilize a formally defined threat hunting methodology, while 58% keep activities in-house. Despite this commitment, formal measurement of hunt success fell to 40%, down from 64% in 2024.
The players
SANS Institute
A global research and education organization that develops cybersecurity training, certifications, and threat analysis reports.
The details
The survey used an online instrument to track how teams identify adversaries, specifically focusing on proactive approaches rather than waiting for automated alerts. Respondents noted that nation-state actors frequently employ living-off-the-land techniques—a method where attackers use legitimate system tools already present in the environment to perform malicious tasks—to evade detection. The shift toward cloud infrastructure was cited by 32% of participants as the most significant hurdle for maintaining visibility during these hunts.
Timeline
2021: The survey began tracking proactive threat detection approaches.
2024: Formal measurement of hunt outcomes reached 64 percent.
2025: Outsourcing of threat hunting activities stood at 30 percent.
September 23, 2026: The SANS Institute released the 2026 Threat Hunting Survey.
The Tech Race
The 2026 survey highlights a fundamental pivot in the security industry away from relying on external outsourcing, which has dropped to 18%. Organizations are now racing to incorporate AI and ML tools to combat visibility gaps in cloud environments, with 39% citing these as top improvements.
Security teams should anticipate an internal focus shift as 58% of organizations now keep hunting in-house, prioritizing data refinement over hiring. Practitioners working in cloud environments face the highest technical barriers, as these architectures currently lack the visibility required for mature detection.
The takeaway
The industry's struggle to measure threat hunting effectiveness suggests that organizational maturity is currently lagging behind the complexity of modern threats. Watch for the 2027 survey results to see if the planned integration of AI and ML tools successfully reduces the impact of data quality issues.
Further reading
For broader trends in enterprise defense strategies, see our coverage on Cybersecurity.
More information
Access the complete findings by following the link to download threat hunting survey report.
Live Poll
Do you believe data issues currently pose a greater risk to cybersecurity than staffing shortages?
