Threat hunting is shifting toward stealth, baselining and AI questions

TL;DR: Adversaries still favour living off the land, log deletion and other low-noise tradecraft, while defenders are increasingly constrained by data quality, staffing and process inconsistency rather than raw alert volume, according to Intel 471 research from the 2026 SANS Threat Hunting Survey. Structured hunting, not faster automation, remains the control that turns that asymmetry into measurable coverage.

Editorial analysis by NHI Mgmt Group, based on content published by Intel 471: “2026 SANS Threat Hunting Survey: Adversaries Prizing Stealth over Speed? Defenders Cooling on AI?”.

By the numbers:

• 72.7% of respondents who uncovered nation-state actors saw living-off-the-land activity, according to Intel 471.
• 46.6% of respondents who found nation-state actors saw them deleting traces and evidence, according to Intel 471.
• 50.2% of respondents said data quality or quantity was the top barrier, according to Intel 471.

Key questions

Q: What breaks when threat hunting lacks good baselines?

A: Without baselines, hunters cannot distinguish ordinary administrative activity from hostile use of legitimate tools.

Q: Why do living-off-the-land campaigns make detection harder?

A: Living-off-the-land campaigns make detection harder because attackers use tools that already exist in the environment, such as PowerShell, scheduled tasks, and command interpreters.

Q: How do security teams know whether threat hunting is actually working?

A: Threat hunting is working when teams can move from first suspicious connection to confirmed containment without long manual pivots.

Practitioner guidance

• Establish environment baselines for legitimate tool use Profile normal PowerShell, command-line, parent process and account interaction patterns so deviations are obvious before an incident starts.
• Normalise identity-rich telemetry across all hunt sources Standardise timestamps, host fields, gateway logs and caller identity fields so hunters can correlate activity across platforms without manual translation.
• Track hunt reuse and gap closure metrics Measure how often a hunt applies to new campaigns, how quickly new behaviours are added and whether existing logic already covers most observed activity.

Bottom line: Modern intrusions increasingly rely on legitimate tools, valid accounts and evidence removal, which makes stealth the dominant hunting problem.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →