SANS published its 2026 threat hunting survey, and the headline finding is not about attacker tooling. Half of the practitioners surveyed said that poor data quality or missing data is the biggest obstacle to hunting effectively. Teams with mature programs put it more bluntly: log quality sets the ceiling on hunting capability, and the gaps concentrate in cloud logs and identity telemetry.
Why identity telemetry is the weak point
Most of the threat activity that respondents described involves living off the land. Nation-state groups use it most, and ransomware affiliates use it heavily as well. These operators use the same administrative tools that IT departments use every day, which removes the value of matching on known malicious hashes or addresses. Detection has to rest on behavior, such as a legitimate tool performing an unusual action or data leaving through an unexpected path.
Every behavioral detection depends on telemetry that a team may never have collected. Where identity events are incomplete, the baseline of normal authentication is thin, and hunt queries produce alerts that analysts learn to ignore. The survey author, Josh Lemon, and SANS instructor Taz Wake both point at the same gap: defenders need to think about evidence retention windows, log integrity, and the practical difficulty of collecting at scale.
Cloud is the hardest environment
A third of respondents named cloud infrastructure as the most difficult environment in which to hunt, ahead of every other scenario. That share has fallen only slightly year over year while more workloads continue to move to cloud platforms, so the absolute gap is not closing.
Process and measurement have also weakened. Only 37 percent of hunting programs follow a formally defined methodology, and ad hoc hunting is slightly more common. Only 40 percent measure outcomes formally, down from 64 percent in 2024. Eleven percent said hunting improved their security posture by 50 percent or more in the past year, compared with 47 percent in 2022.
Interest in adding AI or machine learning to hunting tooling fell from 48 percent in 2025 to about a third, and early feedback indicates that agentic hunting frameworks still need an analyst to drive decisions.
Where to spend effort
The survey points at three practical moves. Fix identity and cloud logging first, because every behavioral detection inherits their quality. Adopt a published framework such as PEAK or TaHiTI so the method survives staff turnover. And measure outcomes honestly, since a program that cannot show what it found will struggle to justify its budget.
Uncertainty about your own coverage is itself a risk, and the survey suggests it is a common condition.
References
- FreeBuf, "Threat hunting data problems are the biggest obstacle, with cloud logs and identity telemetry gaps most prominent", 25 September 2026: https://m.freebuf.com/news/503321.html
- SANS 2026 Threat Hunting Survey, as summarized by FreeBuf, September 2026.
Top comments (0)