What the survey is and who answered
The report is titled "The Evolution of Threat Hunting" and was written by SANS Principal Instructor Josh Lemon. SANS published it alongside a September 23, 2026 announcement. The ESET page that surfaced the story is mostly promotional copy with few figures. The substance comes from SANS and from independent coverage.
- Sample: The survey collected responses from 500 cybersecurity practitioners and security leaders across North America, Europe, Latin America and Asia.
- History: It has tracked how organizations approach proactive threat detection since 2021.
- Experience: 82% of respondents have been involved in threat hunting for at least two years.
The sample is self-selected practitioners, and nothing in the material I reviewed says it represents all organizations. These are numbers about the people who answered, not about the whole industry.
Data has overtaken staffing as the top barrier
For the first time in the survey's history, data is the biggest problem. Data quality or quantity was named by 50%, ahead of skilled staff (45%) and budget (42%).
SANS quotes Lemon describing the problem. His point is that a capable hunter can still find nothing if the telemetry is incomplete, inconsistent, or spread across a dozen hard-to-use tools.
Intel 471's Scott Poley, who commented on the survey, blames poor data engineering. He gives time fields as an example of normalization trouble. Inconsistent fields make it hard to hunt across all the data. His fix is to keep data in tools that can normalize it properly, backed by an actual data strategy.
A separate commentary quoted by Help Net Security makes a related point. Defenders need to consider evidence retention windows, log integrity risks, and the challenge of collecting data at scale.
Cloud is the hardest place to hunt
SANS reports that 32% of respondents called cloud infrastructure the toughest environment to hunt in. That was more than any other environment, even as organizations keep moving more infrastructure there. The material I reviewed doesn't say which cloud platforms or workloads respondents had in mind. It would be a mistake to blame any one vendor.
Some secondary coverage goes further. A DEV Community post summarizing a FreeBuf article says the gaps concentrate in cloud logs and identity telemetry. That is a secondhand reading and I couldn't check it against the full report. It does match the broader point about fragmented telemetry. Treat it as commentary, not a SANS finding.
Living off the land is the baseline
According to SANS, 73% of respondents named living-off-the-land techniques as the top method used by nation-state actors. For organized crime the figure was 63%. SANS describes this as malware-free tradecraft that blends into normal activity and is now the baseline hunters are expected to catch.
This is where the survey touches Windows. Living off the land means attackers use tools already present in the environment, such as built-in admin utilities and legitimate credentials. That is general industry knowledge, not a SANS-specific claim. Help Net Security's summary puts the hunting implication this way: hunts have to target behavior, such as a legitimate tool doing something it shouldn't or data leaving by an unusual route.
These figures are respondents' perceptions of adversary methods. They are not measured incident rates.
Process and measurement are slipping
The weaker findings are about foundations.
| Metric | 2026 | Earlier figure |
|---|---|---|
| Formally defined hunting methodology | 37% | 46% (2025), 51% (2024) |
| Ad hoc approaches | 39% | Reported as climbing back |
| Formally measure hunt outcomes | 40% | 64% (2024) |
| Rank AI/ML among top planned improvements | 39% | 48% (2025) |
| Outsourced hunting | 18% | 30% (2025) |
| Hunting kept in-house | 58% | 58% (second year running) |
All figures in the table come from the SANS announcement.
Treat the explanations with care. SANS reads the AI drop as hunters testing AI against their own workflows rather than assuming it will close the data gap. Help Net Security reports a lower AI figure of "a third" in its own summary, which differs from SANS's 39%. I'd use SANS's number and note that the framing varies between outlets.
Help Net Security also reports that only 11% say hunting improved their security by 50% or more over the past year, compared with 47% in 2022. It adds that the survey cannot tell whether hunting is delivering less, whether respondents are grading themselves harder, or whether teams that stopped measuring stopped noticing results. That caution is worth keeping in mind with every number above.
Lemon points to staffing as the likely reason formal methodology is eroding, according to Help Net Security. Neither the SANS announcement nor the other coverage I reviewed offers a firmer explanation.
What admins can take from it
The survey doesn't prescribe a checklist, so the following is my own reading and not SANS guidance. The findings point to a few sensible priorities for Windows and Microsoft-centric environments:
- Audit telemetry first. Check whether endpoint, identity and cloud logs are complete, consistently formatted, retained long enough and reachable from one place.
- Hunt behavior, not just malware. If 73% of respondents see living-off-the-land as the top nation-state method, signature-only hunts will miss a lot.
- Write the method down. A documented, repeatable approach is the thing the survey says is slipping. One compliance-focused summary suggests frameworks such as PEAK or TaHiTI. That is a vendor suggestion, not part of the SANS findings.
- Decide how you'll measure success. With only 40% formally measuring outcomes, programs struggle to defend their budgets, as SANS notes.
- Treat AI as an experiment. Test it against your own workflows rather than assuming it fixes bad data.
Caveats
- This is survey data, not incident data, and the sample isn't shown to be representative.
- The survey doesn't show that AI is ineffective, that cloud is inherently less secure, or that outsourcing is worse than in-house hunting.
- ESET's page is vendor promotion. Its own copy says little beyond the topics covered.
- Access to the full report is unclear. SANS's announcement calls it free to download, while its report page shows a login prompt. Expect to sign in.
Bottom line
The survey's message is that hunting teams have the experience, but their data, process and measurement haven't kept up. For a Windows shop, that means log coverage, identity and cloud telemetry, and a written hunt method matter more than another tool.