SANS Report: Data Overload, Not Skills Gaps, Is Now the Top Threat Hunting Bottleneck — How SOC Leaders Should Respond

For years, the security industry's default diagnosis for underperforming SOCs was the "skills gap" — we simply didn't have enough qualified analysts. New research from the SANS Institute, reported by Infosecurity Magazine, flips that narrative on its head: data — its volume, quality, accessibility, and context — is now the top challenge facing threat hunters and defensive monitoring teams, surpassing talent shortages.

After 15+ years running SOC operations and leading threat hunts across ransomware, nation-state, and supply-chain incidents, I can tell you this finding matches what we see in the field every day. Most mature organizations don't lack smart people. They lack usable telemetry. Hunters are drowning in unstructured logs, fighting schema inconsistencies across dozens of sources, burning query time on data that wasn't parsed correctly at ingest, and discovering mid-investigation that the one log source they needed was never onboarded — or was silently dropped months ago.

Why This Matters for Defenders

This is not an academic observation. It has direct operational consequences:

• Longer mean time to detect (MTTD). If a hunter spends 40% of their time wrangling data instead of analyzing it, detection latency grows — and in ransomware intrusions, the gap between initial access and encryption is often measured in hours.
• Hunts that fail silently. A hypothesis-driven hunt against incomplete telemetry produces a false negative that looks like a clean result. That is more dangerous than no hunt at all, because it builds false confidence.
• Wasted detection engineering effort. Rules tuned against poorly normalized data either flood the queue with noise or never fire. Both outcomes erode analyst trust in the detection stack.
• Misallocated budget. Organizations keep hiring for skills while underinvesting in the data pipeline, log management, and detection content lifecycle that would multiply the effectiveness of the analysts they already have.

The Technical Reality Behind the Finding

The SANS report reflects several compounding trends we observe across client environments in 2025 and into 2026:

1. Telemetry sprawl. The average enterprise now ingests from EDR, identity providers (Entra ID, Okta), SaaS platforms, cloud control planes (AWS CloudTrail, Azure Activity Logs, GCP Audit Logs), network sensors, DNS, proxy, email security, and OT/IoT devices. Each source has its own schema, timestamp conventions, and field fidelity. Without a normalization layer (e.g., OCSF, ECS, or ASIM in Microsoft Sentinel), cross-source correlation — the essence of hunting — becomes manual and error-prone.

2. Data quality failures at ingest. Misconfigured forwarders, dropped Syslog packets, clock skew between sources, truncated command-line logging (process command lines cut at 8,192 characters is a classic), and agents that silently stop reporting. Hunt teams discover these gaps at the worst possible time: during an active investigation.

3. Retention vs. cost pressure. Hot storage costs push organizations to short retention windows, but threat actor dwell times for sophisticated intrusions regularly exceed 90 days. Hunters need historical depth to establish "first seen" and scope lateral movement.

4. Context starvation. Raw events without asset criticality, identity role, vulnerability state, and threat intel enrichment force analysts to pivot manually across five consoles per alert. That is a data architecture problem, not a skills problem.

Executive Takeaways

If the SANS finding describes your environment — and for most organizations it does — here is where to direct investment and attention:

1. Treat your detection data pipeline as a first-class security product. Assign ownership (typically detection engineering or a dedicated data engineer embedded in the SOC), define SLAs for source onboarding and health, and instrument the pipeline itself. Alert on log source silence: if your domain controllers stop forwarding Event ID 4624/4688 or your EDR check-in count drops, that is a Sev-2 operational incident, not an afterthought.

2. Adopt a normalization standard and enforce it at ingest. Whether you use ASIM (Sentinel), ECS (Elastic), or OCSF, normalized schemas let hunters write one query that works across sources. This single move routinely cuts hunt query development time by half and makes detection content portable.

3. Audit telemetry coverage against MITRE ATT&CK, not against a log-source checklist. Map which data components (process execution, command lines, DNS, authentication, network flows, cloud control plane) you actually have with the fidelity required to detect your priority techniques. A source that logs exists is not the same as a source that logs usefully — verify field-level completeness (full command lines, parent process, hashes, logon IDs).

4. Fix enrichment before you hire more hunters. Automate the attachment of asset owner, business criticality, user risk tier, and current vulnerability state to alerts at ingest time. Every enrichment pivot you automate returns minutes per alert to your analysts — multiplied across thousands of alerts, this is the equivalent of adding headcount you don't have to recruit.

5. Align retention strategy with adversary dwell time, not storage budget. Define tiered retention (hot for 30–90 days, warm/cold for 12+ months) so hunters can retrospect on new intelligence. When a new TTP is published, you should be able to sweep a year of history — not just the last two weeks.

6. Measure the problem so you can fund the fix. Track analyst time spent on data wrangling versus analysis, the percentage of hunts that fail due to missing telemetry, and detection content disabled due to data quality noise. These metrics turn an anecdotal complaint into a business case for pipeline investment — and they resonate with CISOs and boards far better than another request for "more analysts."

The Bottom Line

The SANS report gives SOC leaders evidence for what practitioners have known for years: the constraint on modern threat hunting is the data supply chain, not the humans. Organizations that treat telemetry quality, normalization, enrichment, and retention as engineered capabilities — with owners, SLAs, and metrics — will out-detect peers who keep throwing headcount at a data problem.

If your team suspects its hunts are producing false confidence from incomplete telemetry, that's exactly the kind of gap a structured SOC assessment will surface.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub