Data Overtakes Skills as Top Threat Hunting Challenge, SANS Study Finds

Data has overtaken skills as the number one barrier for threat hunters, for the first time in the five years the SANS Institute has surveyed the industry.

The research organization polled 500 cybersecurity practitioners and leaders across North America, Europe, Latin America and Asia to compile the SANS 2026 Threat Hunting Survey: The Evolution of Threat Hunting.

Half (50%) of those respondents named data quality or quantity as their biggest hurdle to threat hunting, up from 41% last year and 34% in 2023.

“The direction of that trend suggests that the volume of data flowing into hunting programs is now creating as many problems as it solves, with normalization and standards lagging behind collection,” the report noted.

Read more on threat hunting: NCSC: Observability and Threat Hunting Must Improve

Skilled staff (45%) came a close second, down from 61% last year, which represents progress, the report claimed.

Skills shortages mean fewer hunts are run and those that do go ahead “lean more heavily on whoever happens to be available rather than whoever is best placed to construct the hypothesis,” it noted.

Formally defined threat hunting methodologies dropped from 51% in 2024 to 37% this year, with ad hoc approaches at 39%. This matters because a formalized approach is “what makes a hunting program repeatable and defensible,” SANS argued.

Budget constraints (42%), lack of data standards (39%), tool limitations (37%), and lack of defined processes (36%) were the other cited barriers.

SANS principal instructor and report author, Josh Lemon, underscored the importance of high-quality data to threat hunters.

“You can be the most capable hunter in the room and still come up empty if the telemetry you're working with is incomplete, inconsistent, or scattered across a dozen tools that are difficult to access or difficult to process,” he said.

“With only 40% of programs formally measuring whether their hunting actually works, most organizations have no real way of knowing whether that gap is costing them.”

Ransomware Remains Top Threat for Hunting Teams

The programs themselves are more experienced than ever, with over 80% of respondents claiming to have been hunting for at least two years.

Ransomware (55%), business email compromise (43%), nation states (26%) and insiders (26%) are what they find most often, with living-off-the-land techniques by far the most common.

“If you are still writing hunts around known bad hashes or IP addresses, you are hunting for threat actors who stopped behaving that way years ago,” the report argued.

However, despite their challenges, threat hunters are not taking to AI and machine learning in their droves. Only 39% ranked AI/ML incorporation among their top planned improvements, down from 48% last year.

In fact, intent to use these tools has fallen for two years in a row. This is because teams are “moving from aspiration to the harder work of actual implementation,” SANS claimed.

“The teams describing agentic hunting frameworks in their free-text responses are the early signals of where this goes next,” it concluded.

“For now, the practical gap most worth closing is the measurement one: If your program cannot demonstrate what it finds and what that prevents, the investment case for everything else in this report becomes much harder to make.”