SANS survey: poor data hampers threat hunting efforts
A SANS 2026 survey found that half of security professionals consider data quality or volume the main obstacle to effective threat hunting. Respondents most often cited missing cloud logs and identity telemetry, which makes it harder to detect attackers who mimic legitimate activity. The survey also found that only 37% of programs use a formal hunting methodology and 40% measure hunt effectiveness, down from 64% in 2024.
The SANS 2026 survey indicates that half of security practitioners see data quality or volume as the chief obstacle to threat hunting. Missing cloud logs and identity telemetry are common gaps, especially problematic against intruders who imitate normal administrative activity.
Only 37% of programs use a formal hunting method, and 40% assess hunt effectiveness, down from 64% in 2024. Just 11% report security gains of 50% or more, versus 47% in 2022. A third plan AI/ML additions, down from 48% in 2025.
If threat hunting remains hampered by poor telemetry and inconsistent measurement, organizations may struggle to detect stealthy intrusions, potentially affecting customers, employees, and critical services. Security teams could face harder budget justifications when they cannot demonstrate outcomes. Smaller or understaffed defenders may be especially exposed. The broader public may bear indirect costs through data breaches or service disruptions, though the survey alone cannot prove direct societal harm.