Only 26 percent of CISOs value cyber threat intelligence
A new report by the Sans Institute shows a clear gap between the recognition of cyber threat intelligence and its actual influence on decisions. The study is based on responses from 401 cyber security experts worldwide - including, for the first time, a separate module for CISOs and CSOs.
The Sans Institute has published its «2026 Cyber Threat Intelligence (CTI) Survey Insights» report. It was written by Rebekah Brown and Andreas Sfakianakis, both instructors at Sans Institute. The study is based on responses from 401 qualified cyber security experts worldwide, collected between November 2025 and January 2026. For the first time, the report includes a separate module with the responses of 67 CISOs and CSOs - providing insight into both sides: those of the analysts who provide information and those of the executives who react to it.
Recognition without effect
The core message of the report is clear: CTI programs have proven their value in recent years, but the recognition is hardly reflected in concrete decisions. Rebekah Brown, Senior Researcher at the Sans Institute and co-author of the report, puts it succinctly: «This year, we have direct data from both sides. CTI programs have spent years proving their value. The data for 2026 shows that the next challenge is to translate that recognition into decisions, budgets and action.»
What managers really want
The survey data clearly shows which information security managers prioritize: Information on vulnerabilities actively targeted by attackers (79 percent) and specific TTPs - i.e. Tactics, Techniques and Procedures - from attackers (77 percent) ranked highest. Business-oriented information ranks last among the report types with 41 percent. However, the report attributes this less to a lack of demand than to a gap in the production of corresponding content.
Too few resources, too little measurement
One structural problem is evident throughout the report: most formal CTI teams still consist of fewer than four full-time employees, even though the list of use cases they are expected to cover is constantly growing. The biggest obstacles to effective CTI implementation were cited by 44 percent of respondents as a lack of time to implement new processes and a lack of funding. In addition, 57 percent of programs do not track maturity over time and 49 percent do not collect systematic feedback on effectiveness. If you cannot prove improvements, it is difficult to justify budgets with data.
AI in use - lack of legal basis
45% of organizations today use artificial intelligence in CTI programs, primarily for data aggregation and reporting. The so-called human-in-the-loop model remains predominant. At the same time, there is a lack of legal foundations in many places: more than half of organizations (55%) do not have legally audited CTI exchange processes - despite NIS2 and the Cyber Resilience Act imposing new obligations from 2026. The report sees this shortcoming not as an administrative oversight, but as a structural risk. In terms of use cases, security operations (71%) has regained the top spot - last held in 2022 - overtaking threat hunting. This indicates that information is increasingly being embedded in daily defense processes.
Further information about the Sans Institute
This article originally appeared on m-q.ch - https://www.m-q.ch/de/nur-26-prozent-der-cisos-schaetzen-cyber-threat-intelligence/
