Data displaces skills as threat hunting barrier

Data quality and quantity have overtaken shortages of skilled staff as the biggest obstacle facing threat hunters, marking the first time the issue has ranked first in the SANS Institute’s five-year tracking of the discipline.

The SANS 2026 Threat Hunting Survey, released this week, found that 50 per cent of 500 cybersecurity practitioners and security leaders identified data quality or quantity as their primary barrier to effective threat hunting. Skilled staffing, which had previously dominated the rankings, was cited by 45 per cent.

The findings point to a shift in the operational problems confronting security teams as threat hunting becomes more established. Eighty-two per cent of respondents said they had been hunting threats for at least two years, yet SANS found that accumulated experience has not resolved problems caused by incomplete, inconsistent or fragmented telemetry.

Cloud infrastructure emerged as the hardest environment in which to hunt, cited by 32 per cent of respondents. The result reflects the difficulty of bringing together security signals from distributed cloud services, identities, workloads and tools while maintaining sufficient visibility to identify suspicious behaviour.

Josh Lemon, a SANS principal instructor and author of the survey, said the change in ranking showed that capable analysts could still be constrained by the information available to them. He said incomplete or inconsistent telemetry, or data scattered across tools that are difficult to access or process, could leave even experienced hunters unable to reach useful findings.

The trend has developed steadily. Concern over data quality or quantity was cited by 34 per cent of respondents in 2023 and 44 per cent in 2024. SANS said the 2026 figure suggested that the growing volume of information entering hunting programmes was creating problems of its own as normalisation and common standards failed to keep pace with collection.

Last year’s survey had still placed skilled staffing at the centre of the problem, with 61 per cent of respondents identifying shortages of personnel as their main barrier. The reversal represents more than a change in ranking: the proportion pointing to data has risen while staffing pressure has eased relative to other constraints.

SANS said the challenge is not simply collecting more telemetry, but ensuring that information is usable for investigation. Threat hunters depend on complete, accessible and consistent records to test hypotheses, trace attacker activity and distinguish malicious behaviour from legitimate operations across environments.

The survey also found a decline in formal measurement of threat-hunting effectiveness. Only 40 per cent of programmes now formally measure hunt outcomes, down from 64 per cent in 2024. SANS said the fall made it harder for organisations to determine whether hunting gaps were affecting security performance or to demonstrate the value of programmes when budgets came under scrutiny.

Formalised hunting methodologies have also lost ground. Thirty-seven per cent of organisations reported having a formally defined methodology, compared with 46 per cent in 2025 and 51 per cent in 2024. At the same time, ad hoc approaches rose to 39 per cent, indicating that a sizeable share of teams continue to rely on less structured methods despite greater experience.

Threat hunters are also confronting adversaries that increasingly avoid conventional malware. Seventy-three per cent of respondents identified living-off-the-land techniques as the leading method used by nation-state actors, while 63 per cent said the same of organised crime groups. Such techniques exploit legitimate operating-system tools and trusted utilities, making malicious activity harder to distinguish from normal behaviour.

Artificial intelligence and machine learning remain part of organisations’ plans, although enthusiasm has moderated. Thirty-nine per cent of respondents ranked AI or machine-learning integration among their leading planned improvements, down from 48 per cent in 2025. SANS interpreted the change as evidence that teams are testing where AI can assist established workflows rather than assuming it will solve underlying data problems.