# Anvilogic 8.0 is generally available

[Learn more](/content/learn/anvilogic-8-0-automate-the-soc/index.html)

## The State of Detection Engineering Report 2026

The State of Detection Engineering Report 2026, a SANS Institute survey report developed in partnership with Anvilogic, outlines how security professionals are **building, staffing, and maturing** their detection engineering programs, and how gaps in skills, tooling, and AI adoption make it difficult to keep pace with an accelerating threat landscape.

This year’s report offers **insights from over 300 security practitioners across 10+ industries** for a comprehensive view of a profession at an inflection point.

## We surveyed 307 security practitioners across 10+ industries, from SOC analysts and detection engineers to CISOs and security leaders.

## Detection Engineering Today

Explore top takeaways from this year’s report:

- **80%** of practitioners are barely keeping pace with or falling behind the evolving threat landscape; **only 18% report staying ahead.**
- **66%** of false positives originate from vendor-provided rules, a finding that’s **held steady from 64% in 2025.**
- **43%** of organizations name cloud-native environments their **#1 detection coverage gap**- more than 2.5x any other environment.
- **83%** of practitioners use AI tools today, while only **42% trust them for core work** like tuning detections.
- **13%** of detection engineers report high proficiency in software engineering, the field’s **biggest foundational skills gap.**
- **45 point gap** between measurement and action; **59% of teams track false positive rates**, but only 14% prioritize reducing them.

## What's Behind the Numbers

How well are teams keeping up with threats?

Only 1 in 5 practitioners is staying ahead of threats. The other 80% are treading water or falling behind — despite high confidence in their own processes.

The pace problem isn't about effort. Teams that fall behind don't just miss detections — they cede ground while their organizations assume coverage exists. High process confidence and actual threat coverage are not the same thing.

## Where Detection-as-Code adoption stalls

- **0.0%** use version control for rules
- **0.0%** CI/CD pipeline integration
- **0.0%** have peer review in place
- **0.0%** cite time & resource constraints; #1 barrier to DaC adoption
- **0.0%** lack of in-house skills; #2 barrier only 13% high software eng skills

What practitioners actually trust AI to do

## Built For the Gap

The data points to structural blockers, not effort problems. Teams know where they need to go. What's missing is the infrastructure to get there.

Anvilogic unifies detection engineering, investigation, and response across SIEMs and data lakes, so teams can stop treading water and start staying ahead.

## Detection Engineering Has a Structural Problem. We Built the Solution.