Data Volume Surpasses Skill Shortages as Primary Threat Hunting Barrier

Data quality and quantity have overtaken human skill shortages as the primary obstacle facing cybersecurity threat hunters, according to the SANS 2026 Threat Hunting Survey.

The research, conducted by the SANS Institute, polled 500 cybersecurity practitioners and leaders across North America, Europe, Latin America, and Asia. For the first time in five years of surveying, 50% of respondents identified data issues as their biggest hurdle, an increase from 41% last year and 34% in 2023.

The Shift from Skills to Data

While technical expertise remains a significant concern, the survey suggests that the sheer volume of data being collected is creating new complexities. Skill shortages, which were previously the leading barrier, fell to 45% of respondents, a notable decrease from 61% in the prior year.

The report noted that the growing volume of data flowing into hunting programmes is creating as many problems as it solves, as data normalisation and standards currently lag behind collection capabilities. This imbalance can leave even capable hunters with incomplete or inconsistent telemetry that is difficult to process across disparate security tools.

Declining Formal Methodologies

The survey also revealed a decline in the use of formalised threat hunting methodologies. The percentage of programmes using defined approaches dropped from 51% in 2024 to 37% this year, while 39% of organisations reported relying on ad hoc methods.

SANS argued that a formalised approach is essential for making a hunting programme repeatable and defensible. Other significant barriers cited by practitioners included budget constraints (42%), a lack of data standards (39%), and tool limitations (37%).

Ransomware and the Role of AI

Regarding the threats identified during hunts, ransomware remains the most common finding at 55%. This is followed by business email compromise (43%), nation-state actors (26%), and insider threats (26%).

Despite the ongoing evolution of cyberattacks, the survey indicated a cooling interest in the immediate incorporation of artificial intelligence (AI) and machine learning (ML) into hunting workflows. Only 39% of respondents ranked AI/ML incorporation among their top planned improvements, down from 48% the previous year.

SANS suggests this trend reflects a shift from the aspirational phase of AI to the more difficult practicalities of actual implementation. The report concluded that the most critical gap for organisations to address is measurement, noting that only 40% of programmes currently formally measure whether their hunting activities are effective.