SANS 2026 CTI Survey Finds Gap Between Executive Value and Decision Impact
Summary
SANS’s 2026 CTI survey finds 91% of surveyed CISOs value threat intelligence, but only 26% say it significantly influences decisions. Findings highlight resource constraints, rising AI adoption, and gaps in feedback and sharing governance.
Key points
- The survey collected responses from 401 qualified cybersecurity professionals globally between November 2025 and January 2026, with a separate module covering 67 security executives.
- Among surveyed CISOs, 91% rated CTI valuable or extremely valuable, but only 26% said it significantly influenced decisions; actively exploited vulnerabilities and adversary TTPs were leading information priorities.
- Security operations and network defense led CTI use cases at 71%, followed by incident response at 69%, threat hunting at 66%, and vulnerability management at 63%.
- AI was used in 45% of respondents’ CTI programs, with another 32% planning adoption. Summarization and report writing led reported applications, while respondents emphasized analyst oversight.
- Lack of time and funding each constrained effective CTI implementation for 44% of respondents. Organizational silos affected analyst effectiveness for 40%, and burnout for 38%.
- Only 51% reported gathering feedback on CTI effectiveness, while 55% lacked formal sharing processes approved by legal counsel.
- The report recommends decision-focused intelligence products, explicit workload boundaries, structured feedback and impact metrics, legally reviewed sharing processes, and stronger collaboration with incident responders.
Article Details
- Publisher
- SANS Institute
- Report Period
- Survey collection: November 2025–January 2026; publication: May 2026
- Scope
- Global survey of CTI practices, resourcing, executive decision support, AI adoption, measurement, and sharing governance.
- Sample Size
- 401 qualified cybersecurity professionals, excluding a separate module with 67 security executives, primarily CISOs and CSOs.
- Key Statistics
- Among the 67 security executives surveyed, 91% rated CTI valuable or extremely valuable, but only 26% said it significantly influences decisions.
- 45% of practitioner respondents reported using AI in their CTI programs; 32% planned adoption.
- 51% reported gathering feedback on CTI effectiveness; 17% did not and 32% were unsure.
- 55% reported no formal CTI sharing processes approved by their legal department.
- Lack of time to implement new processes and lack of funding were each cited by 44% as barriers to effective CTI implementation.
- Recommendations
- Design sustainable small-team workflows by automating low-value tasks, defining a clear product portfolio, and aligning stakeholder expectations with delivery capacity.
- Establish product-level metrics, structured stakeholder feedback, and a maturity tracking framework before budget discussions.
- Have legal counsel formalize what intelligence may be shared, with whom, and under what conditions.
- Build shared analytic culture through structured peer review, internal working sessions, and documented methodologies.
- Identify stakeholders' recurring decisions and tailor intelligence products to explicit recommendations and required actions.
People
Andreas SfakianakisCoauthor of the report and SANS Certified Instructor Candidate.John DoyleExpert contributor recommending self-service intelligence access and CTI-hosted training to help resource-constrained teams scale.Josh Darby MacLellanExpert contributor recommending stronger relationships between CTI and Incident Response to sustain access to internal incident data.Katie NickelsExpert contributor emphasizing continuous stakeholder engagement and feedback to make CTI relevant to decisions.Rebekah BrownCoauthor of the 2026 SANS CTI Survey report and SANS Certified Instructor.Sean O’ConnorExpert contributor emphasizing CTI integration with business impact, enterprise risk, and governance.
Industries
Education- Security awareness and user education: 59%Financial ServicesThe top four participating sectors are consistent with previous years: financial services, government and military, technology, and healthcare.Government/militaryThe top four participating sectors are consistent with previous years: financial services, government and military, technology, and healthcare.HealthcareThe top four participating sectors are consistent with previous years: financial services, government and military, technology, and healthcare.InsuranceManufacturing, insurance, telecommunications, education, and transportation also contributed meaningful participation, reflecting CTI’s reach into operational technology and critical infrastructure environments.ManufacturingManufacturing, insurance, telecommunications, education, and transportation also contributed meaningful participation, reflecting CTI’s reach into operational technology and critical infrastructure environments.TechnologyRespondents were required to be responsible for evaluating, purchasing, or managing security operations technology products and services.TelecommunicationsManufacturing, insurance, telecommunications, education, and transportation also contributed meaningful participation, reflecting CTI’s reach into operational technology and critical infrastructure environments.TransportationManufacturing, insurance, telecommunications, education, and transportation also contributed meaningful participation, reflecting CTI’s reach into operational technology and critical infrastructure environments.