Threat Hunters' Biggest Enemy Is Now Bad Data, Not Lack of Skills

For the first time in five years of tracking, the SANS Institute's 2026 Threat Hunting Survey has found that data quality and quantity, not staff skills, is the number one obstacle for security teams hunting threats. Half of the 500 practitioners surveyed globally named this as their biggest challenge, up sharply from 41% last year and 34% in 2023, suggesting that the sheer volume of data flowing into security tools is now outpacing organisations' ability to standardise and make sense of it.

Skilled staff shortages came a close second at 45%, though this is down from 61% the previous year, a sign of some improvement. However, the survey also found that formally defined threat hunting methodologies dropped from 51% to 37% this year, with many teams instead relying on ad hoc approaches. SANS warns this matters because a structured methodology is what makes threat hunting repeatable and defensible over time, rather than dependent on whichever staff member happens to be available.

Report author Josh Lemon noted that even highly capable hunters can be let down by incomplete or inconsistent data scattered across multiple tools. Concerningly, only 40% of programs formally measure whether their hunting efforts are actually effective. The most commonly detected threats were ransomware, business email compromise, nation-state activity and insider threats, with attackers increasingly using legitimate tools already present in the network to avoid detection.