Loading story…
The SANS 2026 Threat Hunting Survey found that 50% of 500 cybersecurity practitioners and leaders identify inadequate data quality and quantity as their primary threat-hunting obstacle, overtaking skills shortages. Gaps in cloud logging and identity telemetry are particularly damaging because ransomware operators, nation-state actors, organized crime groups, and business email compromise actors increasingly blend into normal administration through living-off-the-land techniques. Ransomware was the threat most frequently uncovered by hunting teams, followed by BEC, nation-state activity, and insider threats.
Threat-hunting program maturity also appears to be declining: only 37% of respondents use a formal hunting methodology, and just 40% formally measure hunt effectiveness, down from 64% in 2024. Organizations also reported weaker security improvements from hunting and reduced near-term plans to deploy AI or machine learning. CISOs should prioritize complete, standardized cloud and identity telemetry, establish repeatable hunting processes, and measure detection and remediation outcomes before expanding advanced analytics investments.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Only 40% of threat-hunting programs formally measured hunt effectiveness, compared with 64% in 2024. Planned AI or machine-learning adoption declined from 48% in the prior year to about one-third of respondents, while early responses described agentic hunting frameworks that retain analyst decision-making authority.
Ransomware was the threat most commonly found by threat-hunting teams, cited by 55% of respondents, followed by business email compromise, nation-state activity, and insider threats. Respondents identified living-off-the-land techniques as especially prevalent and warned that static hash- and IP-based hunting is insufficient against attackers using legitimate tools.
The survey found that 37% of programs used a formally defined threat-hunting methodology, down from 51% in 2024, while 39% used ad hoc approaches. SANS said formal methodologies help make hunting programs repeatable and defensible.
SANS surveyed 500 cybersecurity practitioners and leaders and reported that data quality and quantity were the leading threat-hunting barrier, cited by 50% of respondents. The survey also identified gaps in cloud logging, identity telemetry, data normalization, and standards as obstacles to effective hunting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourceinfosecurity-magazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two practitioner write-ups highlighted that **security telemetry is both essential and frequently misleading** when it is incomplete, poorly scoped, or misinterpreted. A SANS ISC guest diary describing hands-on operation of a *DShield* internet-exposed honeypot reported collecting **~8 million logs from ~14,000 unique IPs** over several months, emphasizing that most activity is automated “noise” and that meaningful conclusions depend on collecting the *right* data and applying a disciplined methodology to correlate events and preserve investigative breadcrumbs. A separate Detection Engineering Weekly issue reinforced the theme that **“there is no detection without telemetry,”** while cautioning that detection outcomes are constrained by what logs actually capture and how trustworthy/observable that telemetry is. The newsletter also contained unrelated promotional material (e.g., hiring links and a webinar pitch), but its substantive security content aligned with the same core message: detection engineering must account for telemetry coverage and quality, because missing or deceptive logs can cause false confidence, missed detections, or incorrect incident narratives.
Jul 3, 2026
Security professionals are increasingly adopting structured frameworks and advanced techniques to proactively hunt for threats before they materialize into attacks. One approach emphasizes detecting phishing infrastructure ahead of time by leveraging query-based methods to identify attacker assets, brand impersonation, and supplier spoofing, enabling defenders to disrupt campaigns before phishing emails reach their targets. These techniques, validated by threat analysts, are designed to shift organizations from a reactive to a proactive security posture, reducing the risk of successful phishing incidents. Complementing these technical methods, new frameworks and templates are being introduced to standardize and document the threat hunting process. The PEAK Threat Hunting Framework, for example, provides a structured lifecycle—Prepare, Execute, Act with Knowledge—ensuring that threat hunts are repeatable, collaborative, and well-documented. Such frameworks help security teams maintain consistency, share insights, and improve the overall effectiveness of their threat hunting operations, making it easier to respond to evolving cyber threats.
Jul 12, 2026
Security professionals are increasingly leveraging advanced techniques and data-driven strategies to improve vulnerability management and threat hunting. One approach emphasizes using vulnerability data not just for compliance, but as actionable intelligence to guide detection and response efforts. By integrating asset context and business criticality with vulnerability information, organizations can prioritize threats, uncover ongoing compromises, and refine their security posture. This shift transforms traditional vulnerability scans from static checklists into dynamic tools for adversary detection and risk reduction. Complementing this, technical guides and research highlight the importance of identifying and tracking adversary infrastructure, such as Cobalt Strike command-and-control servers, using specialized queries and hunting recipes. Comprehensive pentest data further reveals persistent issues like weak configurations, unpatched software, and poor password policies, underscoring the need for continuous improvement in vulnerability management. Foundational resources, such as the CVE database, remain critical for maintaining a shared understanding of vulnerabilities and supporting effective remediation and compliance efforts.
Jul 12, 2026