Outsourced threat hunting falls to 18%, SANS survey finds
Data quality has overtaken staffing as the biggest barrier to threat hunting for the first time, and fewer organizations are handing the work to an outside provider
- 82% of respondents have been threat hunting for at least two years.
- 73% say living-off-the-land techniques are nation-state attackers’ top method; 63% say the same of organized crime.
- Ad hoc hunting approaches have risen back to 39%.
- 39% rank AI and machine learning among their top planned improvements, down from 48% in 2025.
Before buying more hunting capacity, in-house or outsourced, audit the telemetry: which cloud, identity and endpoint logs are collected, how long they are kept and whether analysts can query them in one place. Write down a hunting method and agree what counts as a result, so each hunt produces findings, detections or documented gaps. Anyone using an outside provider should ask for that same outcome reporting at renewal. Prioritize hunts for living-off-the-land activity, which blends into normal administration.
“You can be the most capable hunter in the room and still come up empty if the telemetry you’re working with is incomplete, inconsistent, or scattered across a dozen tools that are difficult to access or difficult to process.”Josh Lemon, principal instructor, SANS Institute
The SANS Institute’s 2026 Threat Hunting Survey, released on 23 September, found that 18% of organizations outsource threat hunting, down from 30% in 2025. The share running it in-house held at 58% for a second year.
The survey, written by SANS principal instructor Josh Lemon, drew responses from 500 practitioners and security leaders in North America, Europe, Latin America and Asia. It gives no UK breakout. SANS, which sells cybersecurity training and certification, has run the survey since 2021, and the release does not say whether it was sponsored.
Half (50%) now name data quality or quantity as their main barrier, ahead of a shortage of skilled staff (45%) for the first time. Cloud is the hardest place to hunt, named by 32%. Discipline is slipping as well: 37% have a formally defined hunting method, down from 46% in 2025 and 51% in 2024, and 40% formally measure what their hunts achieve, down from 64% in 2024.
Sources
- SANS Institute, “Half of Threat Hunters Now Call Data Their Biggest Barrier, Overtaking Staffing for the First Time, New SANS Institute Survey Finds”, press release, 23 September 2026. https://www.globenewswire.com/news-release/2026/09/23/3367526/0/en/half-of-threat-hunters-now-call-data-their-biggest-barrier-overtaking-staffing-for-the-first-time-new-sans-institute-survey-finds.html
- Infosecurity Magazine, “Data Overtakes Skills as Top Threat Hunting Challenge, SANS Study Finds”, 24 September 2026. https://www.infosecurity-magazine.com/news/data-top-bottleneck-barrier-threat/
