SANS 2025 Threat Hunting Survey: Advancements in Threat Hunting Amid AI and Cloud Challenges

The 2025 SANS Threat Hunting Survey marks a decade of tracking how organizations evolve their threat hunting capabilities. This year’s findings reinforce that threat hunting remains a critical function within security operations, with organizations prioritizing agility, methodology refinement, and...

By

March 13, 2025

Login to download

I consent to sharing my information with SANS and the sponsor(s) listed below for this paper. This information includes your name, title, organization, state, country, phone number and email address. Each organization will use your details in accordance with their respective privacy policies. You can review SANS' privacy policy below and the sponsors' privacy policies on their websites which are accessible by clicking on their logos below. By proceeding, you acknowledge and agree to these terms.

All papers are copyrighted. No re-posting of papers is permitted

Sponsored By

This content is provided free of charge through collaboration between SANS and its sponsor(s). If you prefer not to share your contact details with the sponsor(s), you have the option of waiting approximately 30 days after the original publication date. After 30 days, to download the content, you will be required to create a SANS account, but your information will not be shared with the sponsor(s).

Related Webcast

SANS 2025 Threat Hunting Survey Webcast: Chasing Shadows - Advancements in Threat Hunting Amidst AI and Cloud Challenges

On this webcast, SANS Principal Instructor Josh Lemon will delve into results from the SANS 2025 Threat Hunting Survey. The 2025 survey will analyze how businesses enhance their threat detection capabilities amid an evolving threat landscape, characterized by increasingly sophisticated and rapid...

Related Content

DFIR - Blog - Are Ransomware Victims Paying Less_340 x 340.jpg

Digital Forensics, Incident Response & Threat Hunting

Are Ransomware Victims Paying Less? Insights from the Latest Stay Ahead of Ransomware Live Stream

In this month's reboot of the SANS Stay Ahead of Ransomware live stream, we dove into one of the most pressing questions in cyber extortion today.

DFIR - Blog - FOR508 Evolves as Threat Hunting Shifts In-House_340 x 340.jpg

Digital Forensics, Incident Response & Threat Hunting

FOR508 Evolves as Threat Hunting Shifts In-House

The Spring 2025 FOR508 course refresh includes upgrades to materials on credential theft, enhanced threat hunting, and modern attacker techniques.

CLD_Blog_Building AWS Security from Day One_340 x 340.jpg

Cybersecurity and IT Essentials

Building AWS Security from Day One: Why SEC480 is the Training Your Team Needs

Cloud security isn’t theoretical—it’s real, hands-on, and directly tied to an organization’s ability to protect its assets.