2026 SANS Threat Hunting Survey: Adversaries Prizing Stealth over Speed? Defenders Cooling on AI?

A prominent narrative this year has been that AI-driven autonomous cyberattacks are here, and that their speed and scale are leaving defenders in the dust. But the results of the 2026 SANS Threat Hunting Survey suggest attackers are prioritizing access and operational security, while interest from threat hunters in AI-assisted hunting may be cooling.

Top adversary techniques

Living-off-the-land techniques — using legitimate admin tools to blend into normal system activity — are now the "default adversary posture" across threat profiles, according to SANS. Among respondents who uncovered each type of actor, 72.7% saw nation-state actors living off the land, compared with 63.4% for ransomware groups and 63.2% for organized crime. Targeted exfiltration was close behind (64.8% for nation-states), and for ransomware groups it edged ahead at 65.4%, supporting their respective espionage and data extortion goals.

Attackers are managing their wins carefully too. Nearly half (46.6%) of respondents who found nation-state actors saw them deleting traces and evidence, an expected finding given their goal of extending dwell time. But ransomware (39.5%) and organized crime (30.6%) groups were also seen actively deleting evidence. SANS says this likely means financially motivated groups are investing in anti-forensic capability earlier in the intrusion, buying time before a ransom demand. Intel 471 has seen this too: we recently updated our hunt package "Wevtutil Cleared Log" after ransomware and data extortion newcomer Settra was observed clearing Windows Event Logs after encrypting files. Log clearing is widespread anti-forensic tradecraft, often paired with shadow-copy deletion to inhibit restoration.

SANS' findings are broadly consistent with our threat hunt team's analysis of Q2 2026, which found Exfiltration Over C2 Channel (T1041) was the most-observed MITRE ATT&CK technique, with living-off-the-land execution, valid account and credential abuse, and supply chain compromise dominating the landscape. As our threat hunters noted, these techniques show a clear preference for "high-return, low-noise tradecraft, leveraging native tools and legitimate credentials to maintain access while avoiding the detection risks inherent in overly complex or novel exploit chains." These behaviors often appear benign in isolation but can be surfaced by synthesizing relationships across telemetry, such as unusual process lineages, atypical account interactions and sequences that deviate from operational baselines.

Defenders are fighting the clock

While stealth seemed to trump speed for adversaries, the survey identified temporal gaps that attackers can exploit. As SANS noted, these techniques won't be found by signature matching, but with hunts that "start with questions about what legitimate tools should not be doing, where data should not be going, and what system activity is statistically unusual." Behavioral hunts are inherently more time-consuming.

Hunt teams meanwhile face adversaries that are "not waiting for monthly hunt cycles to find them." Nearly half of respondents run three to ten hunts a month, and 31% say a typical hunt takes nine to 24 hours, roughly two to three working days. "A program running six or more hunts per month, each lasting two to three days, is asking a lot of people who almost certainly have other responsibilities alongside their hunting work," SANS noted.

The UK's National Cyber Security Centre recently described a structural asymmetry that means defenders can’t deploy AI the way attackers do. Attackers mostly face technical obstacles, like exploiting a vulnerability or avoiding detection, while defenders face organizational ones, needing buy-in to secure budgets, patch systems and change configurations. Offensive tasks with clear goals suit automation; defensive actions carry business risk and need someone accountable for them. These challenges were reflected in survey findings. Data quality or quantity was the top barrier at 50.2%, followed by skilled staff (45%) and budget constraints (42%).

Teams are also struggling with process consistency, with many reporting that hunting works in pockets but isn't repeatable across teams, with outcomes often depending on the analyst running the hunt. Maturity self-assessments clustered toward the middle this year, while those rating themselves "very mature" (hypothesis-based hunting) halved, from 18.5% in 2025 to 9%. These trends suggest the community broadly knows what mature threat hunting looks like but struggles with the fundamentals: data strategy, methodology and measurement.

SANS expected interest in AI-assisted threat hunting would rise this year, but instead intent to invest in AI fell to 39.2%, from 48% in 2025 and 47% in 2024. The top planned improvement was to add more investigative staff, at 43.5%. "Threat hunting remains stubbornly dependent on human judgment for now," SANS concluded.

Q&A with Scott Poley, Senior Threat Hunt Manager at Intel 471

If adversaries have a structural speed advantage but are still winning through patience and tradecraft, is the industry's instinct to counter with faster, more automated tooling solving the wrong problem? The question of AI ran through many discussions on the 2026 SANS Threat Hunting Survey expert panel, where Scott Poley represented Intel 471. Scott shared his views on why baselining is critical for behavioral hunts, why data quality has become the top barrier, whether AI is quietly eroding structured hunting, and key metrics teams can track to prove their value when AI promises to do the work for them.

Living off the land dominates across every threat actor profile. What needs to be in place before behavioral hunting is even possible, and what does baselining cost a team that hasn't done it before?

Scott: This question comes up a lot when I'm asked what makes an effective threat hunter. You can bring a seasoned threat hunter into a new environment, and if they're not familiar with it, they're not as effective as they can be. They'll still bring value, but a lot of that value comes from knowing what the environment looks like and what's common in it.

We even talk about profiling hunts, where you're not just looking for bad, you're looking at behaviors in general. Where is PowerShell being executed? What are its parent processes? What do command-line arguments look like? That gives you a sense of the hygiene of the environment. You learn how it's expected to run, compared with how adversaries have been seen operating in reporting.

That profiling makes you stronger at finding rare anomalies. You can find threats just by doing it. It also means you build more effective hunts, and you respond to the results in a more timely way. Without baselining, hunting feels like the needle-in-the-haystack approach. When you do proper baselining, you remove the concept of the needle. It's an anvil sitting in the haystack, and it stands out.

For the first time in the survey's history, data quality has overtaken skilled staff as the top barrier, at 50.2%. SANS suggests normalization and standards are lagging behind collection. Why now, and where does hunting fit?

Scott: I think data quantity leads to some of this. A lot of products and sources describe the same activity with completely different fields, data types and levels of context. Most organizations aren't short on security tools anymore. Many have more than one tool covering the same telemetry.

Time fields are a good example when we talk about data normalization. Every source may format time differently. Then there's how and where IP addresses get stored in fields to determine source versus destination. That makes it very hard to hunt across all the data, because it creates so many caveats. I'd sum this up as poor data engineering. The data needs to sit in tools that can normalize it properly, with the right care and planning up front to make sure there's an actual data strategy.

We used to solve the data problem with really experienced people who could do more with less. Now less experienced people are able to be more effective because there is more data to utilize, but there are so many data sources that aren't easily interpretable, at such volume. Also it's much harder to find where you're missing data. If you look at your data ingest and see a billion logs coming in, how are you going to know you're missing the few thousand you really need from specific sources?

That's where threat hunting becomes hugely valuable. There's a lot of overlap between the skills of an incident responder and a threat hunter. I look at threat hunting as doing the incident without the incident. When you're in an incident and hit a blind spot, that's when you think, "Why were we not doing this?" By then you can't fix it. You have to deal with the problem as it is.

Another example is misconfigured gateways — API gateways, single sign-on proxies — that sit between a user and the application or cloud service. These misconfigurations can create a blind spot bigger than the organization realizes. Depending on configuration, a gateway can forward the real user's identity to the application logs, or it can log only its own identity for every request that passes through it. When application-side logs just show traffic coming from the gateway, that traffic is decoupled from the identity a hunter needs to correlate against. This is exactly why hunting is beneficial: it helps identify these issues through the threat hunt development process.

Formally defined methodologies declined again this year, to 36.5%, while ad hoc hunting crept back up to 38.8%. What's driving that?

Scott: Staffing pressure absolutely contributes. But one thing we're watching is whether AI is unintentionally making ad hoc hunting easier to sustain. I've spoken to a lot of practitioners through talks and training where the default response now is to run the report through AI. The AI gives them a perfectly reasonable hunt for what's described in the report, but they skip the extra steps they'd take with a proper methodology.

The craft is understanding the behavior behind the activity. What other arguments could accomplish the same thing? What other tools can perform the same actions? That's what may be getting missed, and that's where methodology really matters. Because AI lets you answer things faster, structured approaches can fall away.

That said, people who use AI as a companion, as part of the team rather than just a tool, can achieve more with it. It can fortify your methodology. When you want to explore an idea, use it to question your logic or your hypothesis.

Ultimately, you don't want a methodology so bureaucratic that you can't do the work. It shouldn't be handcuffs; it should enable you. A good methodology takes a lot of work up front, but if you're doing it for the right reasons, you earn a lot of time back because your approach is so effective.

Only 40.1% of programs formally measure hunting outcomes, down from 63.7% in 2024. How do you show the value of threat hunting when so many AI-driven tools promise to automate it?

Scott: Something that gets lost when people lean on AI is that its coverage is incomplete, even though it looks complete. Ask an LLM for all the numbers that add up to 21. It'll give you some, but it won't give you all of them.

Our job isn't just to address the actor or the specific nuance in the report we're working from. It's thinking about the permutations of that attack: how could it be changed slightly and still achieve the same thing? That's where methodology becomes really strong. When we go through reporting, we check our library of hunts and ask what we already have, what needs updating and what needs to be net-new. About 80 to 90% of the behaviors we see in reports are already generically covered by what we've built.

That gives us metrics. Did we have pre-existing coverage, and how long before public disclosure did we already have that hunt? What's the reuse rate, meaning how often does a hunt apply to new actors, campaigns and incidents as they emerge? What's the gap closure time, or how quickly can we address a new behavior when it appears? And what's the enhancement rate? Maybe we had a good hunt but learned something new, so we're not starting from scratch. Those measurements show the maturity of a hunting program, and the value of addressing risk rather than just one particular threat. AI can help with a lot of this, but you always have to ask: how do you know you're getting the complete answer?

How Intel 471 can help
None of this means AI has no role. "Agentic AI may be a better fit around the hunt: pivoting off new intelligence, and following up on the results of a hunt," says Poley.

The distinction that matters is where judgment is required and where AI removes friction. Judgment covers building the hypothesis, recognizing what "statistically unusual" looks like in a specific environment, and deciding whether a no-finding is a true negative or a visibility gap. Agentic and generative AI can remove friction around the hunt: triage, pulling the right context, routing environment-specific evidence to detection engineering or incident response, and generating reports.

Many of the gaps the SANS survey identified are foundational, such as data quality, process inconsistency, playbooks that aren't followed, and measurement. The Hunt library on the Verity471 platform helps teams close them. Cyber Threat Hunt provides 800+ MITRE-mapped, analyst-validated behavioral hunt packages, each tied to a specific technique with the hypothesis and query logic already worked out. Users decide which behaviors are worth hunting in their environment. Filtering and tagging help them find the right package, while CTI context and analyst notes explain the difference between normal and suspicious use of legitimate tools. The Hunt Management Module ensures hunts are assigned, tracked and reported consistently regardless of which analyst is running them, with coverage captured automatically.

The same principle sits behind MCP471, which brings Verity471 intelligence into customers' own AI environments, and Agent471, our native AI analyst on Verity471. Every hunt package is still written and validated by an analyst. Agent471 accelerates what happens around the hunt, helping analysts pivot from new intelligence to the right hunt package faster and turning a closed hunt's findings into a structured handoff. Scott's "21" example is the point: AI will give you some of the answers. Validated content and a sound methodology are how you get coverage.