2025 SANS Cyber Threat Intelligence Survey Findings

The 2025 SANS Cyber Threat Intelligence (CTI) Survey presents key findings from a comprehensive analysis of the current state of CTI practices across various industries. The survey indicates a maturation in the field, with an increasing number of organizations establishing dedicated CTI teams and integrating artificial intelligence into their processes. A significant 70.2% of respondents noted that the evolving digital landscape is a driving factor for changes in CTI methodologies. The report highlights that 77% of organizations utilize CTI for threat hunting, while 86% adopt the MITRE ATT&CK framework. Furthermore, it reveals that 90% of CTI teams prioritize external intelligence sources over internal data. The survey also documents the challenges faced by CTI professionals, including limited resources and the complexities of the threat landscape. Overall, the findings underscore the growing importance of formalized CTI processes and the need for effective communication of intelligence within organizations.