DATA quality and quantity have become the leading obstacle for threat-hunting teams, according to the SANS Institute’s 2026 Threat Hunting Survey. The study questioned 500 cybersecurity practitioners and leaders across North America, Europe, Latin America and Asia. Half of respondents (50%) identified data as their biggest challenge, up from 41% in 2025 and 34% in 2023. SANS said the growing volume of telemetry is creating difficulties because normalisation and standards have not kept pace with collection.
Skills shortages ranked second at 45%, down from 61% last year, while budget constraints (42%), a lack of data standards (39%), tool limitations (37%) and undefined processes (36%) were also reported barriers. The proportion of organisations using formally defined hunting methodologies fell from 51% in 2024 to 37% in 2026, while 39% used ad hoc approaches. SANS principal instructor Josh Lemon warned that incomplete, inconsistent or fragmented telemetry can undermine even highly capable hunters. Only 40% of programmes formally measure whether their hunts are effective.
More than 80% of respondents had been threat hunting for at least two years. Ransomware was the threat most frequently identified by hunting teams (55%), followed by business email compromise (43%), nation-state activity (26%) and insider threats (26%); living-off-the-land techniques were the most common method. Planned improvements involving artificial intelligence and machine learning fell to 39%, from 48% in 2025. SANS attributed the decline to teams moving from ambition to the practical challenges of implementation.