{"id":378946,"date":"2026-09-25T00:56:00","date_gmt":"2026-09-25T07:56:00","guid":{"rendered":"https:\/\/cms-articles.softonic.io\/en\/?p=378946"},"modified":"2026-09-25T00:56:11","modified_gmt":"2026-09-25T07:56:11","slug":"sans-2026-threat-hunting-survey-is-out-bad-telemetry-tops-the-list","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/sans-2026-threat-hunting-survey-is-out-bad-telemetry-tops-the-list\/","title":{"rendered":"SANS 2026 Threat Hunting Survey is out: bad telemetry tops the list"},"content":{"rendered":"

SANS Institute\u2019s 2026 Threat Hunting Survey lands on a pretty blunt point: for threat hunters, the biggest problem right now isn\u2019t hiring or budget. It\u2019s the data.<\/p>\n

\r\n
\r\n
\r\n
\r\n \"Wireshark\"\r\n <\/div>\r\n
\r\n Wireshark<\/span>\r\n Download<\/a>\r\n <\/div>\r\n
\r\n <\/path><\/path><\/text><\/svg>\r\n <\/div>\r\n <\/div>\r\n
\r\n <\/span>\r\n <\/div>\r\n
\r\n \r\n <\/div>\r\n <\/a>\r\n <\/div>\r\n<\/div>\n\n\n\n

In the survey, bad or missing telemetry<\/strong> is now the top obstacle for 50% of security professionals. That puts it ahead of staff shortages at 45% and budget limits at 42%. The reason isn\u2019t hard to see. Threat hunters need reliable behavioral data to separate routine admin work from actual abuse, especially when attackers are leaning on living-off-the-land techniques. Nation-state groups are using those methods heavily too, and SANS points to broader research that puts that figure at 73%.<\/p>\n\n

The report says hunts are getting dragged down by logs that are incomplete<\/strong>. That puts it ahead of staff shortages at 45% and budget limits at 42%. Cloud environments are still the toughest place to investigate. About a third of respondents singled them out, largely because logging and identity visibility are still split across too many places.<\/p>\n\n

There\u2019s also less structure than you\u2019d want. Only 37% of threat hunting programs use a formal methodology<\/strong>. Just 40% measure effectiveness, down from 64% in 2024. And only 11% said hunting improved security by 50% or more over the past year. In 2022, that number was 47%, according to SANS.<\/p>\n\n

For teams that run threat hunts on a regular basis, the 2026 SANS Threat Hunting Survey is well worth the time. Its main argument is simple: better hunting starts with better data<\/strong>, not just a bigger headcount.<\/p>\n\n

You can download the survey from SANS Institute.<\/p>","protected":false},"excerpt":{"rendered":"

SANS Institute\u2019s 2026 Threat Hunting Survey lands on a pretty blunt point: for threat hunters, the biggest problem right now isn\u2019t hiring or budget. It\u2019s the data. In the survey, bad or missing telemetry is now the top obstacle for 50% of security professionals. That puts it ahead of staff shortages at 45% and budget … Continue reading “SANS 2026 Threat Hunting Survey is out: bad telemetry tops the list”<\/span><\/a><\/p>\n","protected":false},"author":9349,"featured_media":378945,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wpcf-pageviews":0},"categories":[1015],"tags":[],"usertag":[],"vertical":[],"content-category":[],"class_list":["post-378946","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/378946","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/users\/9349"}],"replies":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/comments?post=378946"}],"version-history":[{"count":1,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/378946\/revisions"}],"predecessor-version":[{"id":378947,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/378946\/revisions\/378947"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media\/378945"}],"wp:attachment":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media?parent=378946"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/categories?post=378946"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/tags?post=378946"},{"taxonomy":"usertag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/usertag?post=378946"},{"taxonomy":"vertical","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/vertical?post=378946"},{"taxonomy":"content-category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/content-category?post=378946"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}