SANS 2026 Threat Hunting Survey: The Evolution of Threat Hunting

Threat hunting has moved well past experimentation. In the SANS 2026 Threat Hunting Survey, more than 80% of 500 security professionals report hunting for at least two years, and their responses show where experienced programs still hit a ceiling.

Written by SANS Principal Instructor Josh Lemon and sponsored by Menlo Security, the survey examines how organizations hunt, measure, staff, and invest, and what adversary behavior means for how hunts are built.

What You Will Learn

• Why data quality or quantity (50%) has overtaken skilled staff (45%) as the top barrier to success for the first time
• How living-off-the-land techniques lead across threat actor types, cited by 73% of respondents for nation-state attacks, and why that favors behavior-based hunt hypotheses
• Why cloud infrastructure remains the hardest environment to hunt, cited by 32% of respondents
• How formal measurement of hunt outcomes has fallen to 40% from 64% in 2024, and what that means for demonstrating value to leadership
• Where programs plan to invest in staffing and tooling over the next 24 months

Whether your team is building its first playbook or running automated, intelligence-driven hunts across multiple cloud environments, the report offers benchmarks drawn from real programs at real organizations.

Download Your Free Copy of the SANS 2026 Threat Hunting Survey: The Evolution of Threat Hunting

‍