New data reveals widespread AI adoption, shift toward threat hunting, and strategic use of intelligence reports across global cybersecurity teams
2025 CTI Survey
Bethesda, MD, May 20, 2025 (GLOBE NEWSWIRE) — Cyber threat intelligence programs are undergoing a major transformation, according to new SANS survey data, and on Wednesday, May 21, 2025, the organization will present its annual CTI Survey findings during a live webcast at 10:30 AM EDT (14:30 UTC), spotlighting how organizations are adapting to mounting pressure from adversaries and operational complexity. The webcast translates survey findings into practical recommendations, helping organizations strengthen their threat intelligence capabilities, improve threat detection, and support decision-making with real-world data.
The webcast, SANS 2025 CTI Survey: Navigating Uncertainty in Today’s Threat Landscape, will detail how top-performing CTI teams are leveraging threat hunting, MITRE ATT&CK, and AI to improve decision-making and preempt attacks. Survey results also show increased emphasis on strategic reporting to influence security priorities at the executive level.
“Threat hunting’s rise as the top use case shows that mature organizations are no longer waiting for alerts,” said Rebekah Brown, Certified Instructor Candidate at SANS Institute. “Instead, they’re using intelligence to guide proactive threat detection. MITRE ATT&CK is the lingua franca for today’s cyber defense teams and is used primarily for threat hunting.”
Threat hunting was cited by 84% of respondents as the most common CTI use case, reaffirming a clear shift toward proactive defense. Meanwhile, 68% of organizations now produce threat landscape reports, a leading CTI deliverable that reflects intelligence’s growing role in strategic planning.
“Threat intelligence has moved out of the SOC and into the boardroom. Threat landscape reports are a primary way that CTI influences an organization’s strategy,” said Andreas Sfakianakis, Certified Instructor at SANS Institute.
The survey also reveals that 72% of organizations either currently use or plan to integrate AI into their CTI programs, marking a shift from experimentation to operational integration. Respondents continue to rely heavily on external intelligence sources, though few fully incorporate internal business context.
Attendees of tomorrow’s webcast will gain early access to exclusive data, practical guidance to refine their CTI programs, and receive CPE credits. Registered participants will gain access to a complimentary white paper summarizing the full findings.
Register for the webcast here: https://www.sans.org/webcasts/sans-2025-cti-survey-navigating-uncertainty-in-today-s-threat-landscape/
Attachment
- 2025 CTI Survey
CONTACT: Jenn Elston SANS Institute 301-654-7267 press@sans.org
