The 2025 SANS Detection & Response Survey offers a comprehensive look at how security teams are adapting to rising operational demands, increasingly complex hybrid environments, and a rapidly evolving threat landscape. With insights from hundreds of practitioners across banking, finance, technology, government, and healthcare, the report reveals where modern SOCs are succeeding and where critical gaps remain.

This year’s findings uncover several pressing challenges, including escalating alert fatigue, cloud visibility issues, persistent skills shortages, and growing pressure to automate detection and response. As SANS notes in the report, “false positives remain the leading operational burden,” reflecting a dramatic rise in noise that hinders analysts’ ability to respond effectively.

Cloud environments continue to strain security programs as well. According to the survey, “cloud complexity outpaces expertise,” and teams struggle to maintain cohesion across multicloud and SaaS ecosystems. The data also highlights widespread resource limitations: “teams are being asked to deliver more capability with less investment,” underscoring the gap between expectations and available funding.

Inside the report, you’ll find data-driven analysis on:

• The rising volume and impact of false positives

• Cloud detection challenges across CSP, SaaS, and multicloud environments

• The growing importance of automation, AI/ML, and proactive threat hunting

• Staffing and skill gaps affecting detection and response readiness

• The tools and techniques organizations rely on most, and how effective they truly are

• How teams benchmark detection coverage, measure performance, and plan future investments

Whether you lead a SOC, manage detection engineering, or are responsible for evaluating detection and response technologies, this report provides timely insight into the obstacles and opportunities shaping cyber defense.