SANS 2026 survey: cloud logs and identity telemetry are where hunting fails

SANS published its 2026 threat hunting survey: half of respondents cite poor or missing data as the biggest obstacle, concentrated in cloud logs and identity telemetry. A third name cloud infrastructure as the hardest environment to hunt in, only 37% of programs follow a formal methodology, and formal outcome measurement fell from 64% in 2024 to 40%.

• Half of respondents cite poor or missing data as the top hunting obstacle
• A third call cloud infrastructure the hardest environment to hunt in
• Only 37% of hunting programs follow a formally defined methodology
• Formal outcome measurement fell from 64% in 2024 to 40%