# Awesome Annual Security Reports [![Awesome](https://awesome.re/badge.svg)](https://awesome.re)
> A curated list of annual cyber security reports - Centralized cybersecurity information free from sales nuisance.

**Definition:** The state of being secure has a temporal dimension which security vendors utilize to stay relevant through annual reports. CIO, CISO, and security leaders are faced with the challenge of sifting the valuable information from marketing material. In addition to filtering for type of information leaders are challenged with staying abreast of new security vendors and partnerships. This list seeks to lower the barrier for access to this information while remaining agnostic to providers.

**Disclaimer:** The reports in this collection are limited to content which does not require a paid subscription, membership, or service contract. There are a variety of different business models and drivers that would cause information to be put behind a paywall, I would like to respect those companies and individuals. Consult the original authors for licensing of any report content.

**Limitations:** This is **not** a collection of project based information such as white papers, intelligence reports, technical specifications, or standards. I welcome all user submitted uploads or report requests, but we should draw a box around this _awesome_ list. All reports will be sourced from the original author when possible and uploaded to [Hybrid Analysis](https://www.hybrid-analysis.com/) for an additional level of confidence, result link will be included in the readme.md commit notes.

**Acknowledgement:** I would like to give recognition for other works that inspired this collection. [Richard Stiennon](https://it-harvest.com/about/) and his annual analysis of the cybersecurity industry is much more comprehensive than this repository. [Rick Howard](https://www.paloaltonetworks.com/blog/author/rick/) and his cyber cannon list of must read books is a tremendous resource, at both leadership and practitioner levels.

## Contents
- [Reports](#reports)
  - [Analysis](#analysis)
  - [Surveys](#surveys)
- [Resources](#resources)
  - [Research Consulting](#research-consulting)
  - [Working Groups](#working-groups)
- [Contributing](#contributing)
---
## Reports
Reports have been classified into two categories by the source of data.
1. **Analysis:** Reports generated from quantifying and qualifying intelligence from sensor networks or services.
2. **Survey:** Reports generated from observations and feedback from surveys or consulting engagements.

### Analysis
|Provider|Report Name|Year|Data Type|
|:---|:---|:---|:---|
|[Accenture](https://www.accenture.com/us-en/insights/security/cyber-threat-intelligence-report-2021)|[Cyber Threat Intelligence Report](Annual%20Security%20Reports/2021/Accenture-Cyber-Threat-Intelligence-Report-2021.pdf)|2021|Attacks|
|[Accenture](https://www.accenture.com/us-en/insights/security/cyber-threat-intelligence-report-2021-vol-2)|[Cyber Threat Intelligence Report Volume 2](Annual%20Security%20Reports/2022/Accenture-Cyber-Threat-Intelligence-Report-Vol2-2022.pdf)|2022|Attacks|
|[Aon](https://insights.aon.com/2021-cyber-risk-report/home/)|[Cybersecurity Risk Report](Annual%20Security%20Reports/2020/Aon-Cyber-Security-Risk-Report-2020.pdf)|2020|Industry|
|[CheckPoint](https://pages.checkpoint.com/cyber-security-report-2022.html)|[Cybersecurity Report](Annual%20Security%20Reports/2023/CheckPoint-Cybersecurity-Report-2023.pdf)|2023|Attacks|
|[Cisco](https://learn-cloudsecurity.cisco.com/umbrella-resources/umbrella/2022-dns-discoveries#page=1)|[DNS Discoveries](Annual%20Security%20Reports/2022/Cisco-DNS-Discoveries-2022.pdf)|2022|Attacks|
|[Cofense](https://cofense.com/annualreport)|[Annual State of Email Security](Annual%20Security%20Reports/2023/Cofense-Annual-State-of-Email-Security-Report-2023.pdf)|2023|Attacks|
|[CrowdStrike](https://www.crowdstrike.com/resources/reports/overwatch-threat-hunting-report/)|[Threat Hunting Report](Annual%20Security%20Reports/2022/Crowdstrike-Threat-Hunting-Report-2022.pdf)|2021|Attacks|
|[CrowdStrike](https://www.crowdstrike.com/resources/reports/global-threat-report/)|[Global Threat Report](Annual%20Security%20Reports/2023/Crowdstrike-Global-Threat-Report-2023.pdf)|2023|Attacks|
|[DarkTrace](https://www.darktrace.com/en/request-resources/?pp=research-cybersecurity-insiders)|[Insider Threat Report](Annual%20Security%20Reports/2020/DarkTrace-Insider-Threat-Report-2020.pdf)|2020|Attacks|
|[DeepInstinct](https://www.deepinstinct.com/blog/2022-cyber-threat-landscape-report)|[Threat Landscape Report](Deep-Instinct-Cyber-Threat-Landscape-Report-2022.pdf)|2022|Attacks|
|[Flashpoint](https://www.riskbasedsecurity.com/download-year-end-vulnerability-report/)|[Year End Vulnerability QuickView Report](RiskBasedSecurity-Year-End-Vulnerability-QuickView-Report-2021.pdf)|2021|Attacks|
|[Flashpoint](https://www.riskbasedsecurity.com/download-year-end-data-breach-report)|[Year End Data Breach QuickView Report](RiskBasedSecurity-Year-End-Data-Breach-QuickView-Report-2021.pdf)|2021|Breaches|
|[IBM](https://www.ibm.com/security/data-breach/threat-intelligence/)|[X-Force Cloud Threat Landscape Report](Annual%20Security%20Reports/2022/IBM-X-Force-Cloud-Threat-Landscape-Report-2022.pdf)|2022|Attacks|
|[IBM](https://www.ibm.com/security/data-breach/threat-intelligence/)|[X-Force Threat Intelligence Index](Annual%20Security%20Reports/2023/IBM-X-Force-Threat-Intelligence-Index-2023.pdf)|2023|Attacks|
|[IBM](https://www.ibm.com/security/data-breach)|[Cost of a Data Breach Report](Annual%20Security%20Reports/2022/IBM-Cost-of-a-Data-Breach-Report-2022.pdf)|2022|Breaches|
|[Mandiant](https://www.mandiant.com/m-trends)|[MTrends Cyber Security Insights](Annual%20Security%20Reports/2023/Mandiant-MTrends-Cybersecurity-Insights-Report-2023.pdf)|2023|Attacks|
|[Microsoft](https://www.microsoft.com/en-us/security/business/microsoft-digital-defense-report-2022)|[Digital Defense Report](Annual%20Security%20Reports/2022/Microsoft-Digital-Defense-Report-2022.pdf)|2022|Attacks|
|[NCC Group](https://research.nccgroup.com/2022/01/10/2021-annual-research-report/)|[Annual Research Report](Annual%20Security%20Reports/2021/NCCGroup-Annual-Research-Report-2021.pdf)|2021|Industry|
|[PaloAlto](https://start.paloaltonetworks.com/unit-42-iot-threat-report)|[Unit 42 IoT Threat Report](Annual%20Security%20Reports/2021/PaloAlto-Unit-42-IoT-Threat-Report-2021.pdf)|2023|Attacks|
|[PaloAlto](https://start.paloaltonetworks.com/2023-unit42-ransomware-extortion-report)|[Unit 42 Ransomware Extortion Report](Annual%20Security%20Reports/2023/PaloAlto-Unit-42-Ransomeware-Extortion-Report-2023.pdf)|2021|Attacks|
|[Proofpoint](https://www.proofpoint.com/us/resources/threat-reports/state-of-phish)|[State of the Phish](Annual%20Security%20Reports/2023/Proofpoint-State-of-the-Phish-2023.pdf)|2023|Attacks|
|[Proofpoint](https://go.proofpoint.com/Human-Factor-Report-2022-TY.html)|[Human Factor Report](Annual%20Security%20Reports/2023/Proofpoint-Human-Factor-Report-2023.pdf)|2023|Attacks|
|[Proofpoint](https://www.proofpoint.com/us/resources/threat-reports/cost-of-insider-threats)|[Cost of Insider Threats Global Report](Annual%20Security%20Reports/2022/Proofpoint-Ponemon-Cost-of-Insider-Threats-Global-Report-2022.pdf)|2022|Industry|
|[PwC](https://www.pwc.com/us/en/services/consulting/cybersecurity-risk-regulatory/library/cyber-threats-year-in-retrospect.html)|[Cyber Threat Retrospect](Annual%20Security%20Reports/2022/PwC-Cyber-Threats-Retrospect-2022.pdf)|2022|Industry|
|[Rapid7](https://www.rapid7.com/research/report/2021-industry-cyber-exposure-report/)|[Industry Cyber Exposure Report](Annual%20Security%20Reports/2021/Rapid7-Industry-Cyber-Exposure-Report-2021.pdf)|2021|Attacks|
|[RedCanary](https://redcanary.com/threat-detection-report/)|[Threat Detection Report](Annual%20Security%20Reports/2022/RedCanary-Threat-Detection-Report-2022.pdf)|2022|Attacks|
|[Secureworks](https://www.secureworks.com/resources/rp-state-of-the-threat-2022)|[State of the Threat](Annual%20Security%20Reports/2022/Secureworks-State-of-the-Threat-Report-2022.pdf)|2022|Attacks|
|[Snyk](https://go.snyk.io/IaC-Report-2021.html)|[Infrastructure as Code Report](Annual%20Security%20Reports/2021/Snyk-Infrastructure-as-Code-Report-2021.pdf)|2021|Industry|
|[SonicWall](https://www.sonicwall.com/2023-cyber-threat-report/)|[Cyber Threat Report](Annual%20Security%20Reports/2023/SonicWall-Cyber-Threat-Report-2023.pdf)|2022|Attacks|
|[Sophos](https://www.sophos.com/en-us/labs/security-threat-report)|[Threat Report](Annual%20Security%20Reports/2023/Sophos-Threat-Report-2023.pdf)|2023|Attacks|
|[Synopsys](https://www.synopsys.com/software-integrity/resources/analyst-reports/open-source-security-risk-analysis.html)|[Open Source Risk Analysis Report](Annual%20Security%20Reports/2023/Synopsys-Open-Source-Risk-Analysis-Report-2023.pdf)|2023|Attacks|
|[Synopsys](https://www.synopsys.com/software-integrity/resources/analyst-reports/software-vulnerability-trends.html)|[Software Vulnerability Snapshot](Annual%20Security%20Reports/2022/Synopsys-Software-Vulnerability-Snapshot-2022.pdf)|2022|Attacks|
|[Tenable](https://www.tenable.com/cyber-exposure/2021-threat-landscape-retrospective)|[Threat Landscape Retrospective](Annual%20Security%20Reports/2021/Tenable-Threat-Landscape-Retrospective-2021.pdf)|2021|Attacks|
|[Trellix](https://www.trellix.com/en-us/threat-center/threat-reports/jan-2022.html)|[Advanced Threat Research Report](Annual%20Security%20Reports/2022/Trelllix-Advanced-Threat-Research-Report-2022.pdf)|2022|Attacks|
|[TrendMicro](https://www.trendmicro.com/vinfo/us/security/research-and-analysis/threat-reports/roundup/attacks-from-all-angles-2021-midyear-security-roundup)|[Attacks From All Angles](Annual%20Security%20Reports/2021/TrendMicro-Attacks-From-All-Angles-2021.pdf)|2021|Attacks|
|[TrendMicro](https://www.trendmicro.com/vinfo/us/security/research-and-analysis/threat-reports/roundup/defending-the-expanding-attack-surface-trend-micro-2022-midyear-cybersecurity-report)|[Defending The Expanding Attack Surface](Annual%20Security%20Reports/2022/TrendMicro-Defending-The-Expanding-Attack-Surface-2022.pdf)|2022|Attacks|
|[Veracode](https://www.veracode.com/state-of-software-security-report)|[State of Software Security v12](Annual%20Security%20Reports/2021/Veracode-State-of-Software-Security-V12-2021.pdf)|2022|Attacks|
|[Verizon](https://www.verizon.com/business/resources/reports/cyber-espionage-report/)|[Cyber Espionage Report](Annual%20Security%20Reports/2020/Verizon-Cyber-Espionage-Report-2020.pdf)|2020|Attacks|
|[Verizon](https://www.verizon.com/business/resources/reports/dbir/)|[Data Breach Investigations Report](Annual%20Security%20Reports/2023/Verizon-Data-Breach-Investigations-Report-2023.pdf)|2023|Breaches|
|[WhiteSource](https://www.whitesourcesoftware.com/resources/research-reports/the-state-of-open-source-vulnerabilities/)|[State of Open Source Vulnerabilities](Annual%20Security%20Reports/2021/WhiteSource-State-of-Open-Source-Vulnerabilities-2021.pdf)|2021|Attacks|

### Surveys
|Provider|Report Name|Year|Data Type|
|:---|:---|:---|:---|
|[Accenture](https://www.accenture.com/us-en/insights/security/invest-cyber-resilience)|[State of Cybersecurity Report](Annual%20Security%20Reports/2021/Accenture-State-of-Cybersecurity-2021.pdf)|2021|Industry|
|[Checkmarx](https://checkmarx.com/resources/reports/2021-state-of-devsecops-report)|[State of DevSecOps Report](Annual%20Security%20Reports/2021/Checkmarx-State-of-Devsecops-Report-2021.pdf)|2021|Industry|
|[Checkmarx](https://checkmarx.com/resources/appsec-training-for-developers/global-secure-coding-education-survey)|[Global Secure Coding Education Survey](Annual%20Security%20Reports/2021/Checkmarx-Global-Secure-Coding-Education-Survey-2021.pdf)|2021|Industry|
|[Cisco](https://www.cisco.com/c/en/us/products/security/security-outcomes-study.html)|[Security Outcomes Study Volume 1](Annual%20Security%20Reports/2021/Cisco-Security-Outcomes-Study-Vol1-2021.pdf)|2021|Industry|
|[Cisco](https://www.cisco.com/c/en/us/products/security/security-outcomes-study-vol-2.html)|[Security Outcomes Study Volume 2](Annual%20Security%20Reports/2021/Cisco-Security-Outcomes-Study-Vol2-2021.pdf)|2021|Industry|
|[Cisco](https://www.cisco.com/c/en/us/products/security/security-outcomes-study-vol-3.html)|[Security Outcomes Study Volume 3](Annual%20Security%20Reports/2022/Cisco-Security-Outcomes-Study-Vol3-2022.pdf)|2022|Industry|
|[Cisco](https://www.cisco.com/c/en/us/about/trust-center/data-privacy-benchmark-study.html)|[Data Privacy Benchmark Study](Annual%20Security%20Reports/2023/Cisco-Data-Privacy-Benchmark-Study-2023.pdf)|2023|Breaches|
|[Cobalt](https://www.cobalt.io/state-of-pentesting-2022)|[State of Pentesting](Annual%20Security%20Reports/2022/Cobalt-State-of-Pentesting-2022.pdf)|2022|Industry|
|[CoreSecurity](https://www.coresecurity.com/resources/guides/2020-pen-testing-survey-report-1)|[Penetration Testing Report](Annual%20Security%20Reports/2020/CoreSecurity-Penetration-Testing-Report-2020.pdf)|2020|Industry|
|[CrowdStrike](https://www.crowdstrike.com/resources/reports/global-security-attitude-survey-2021/)|[Global Security Attitude Survey](Annual%20Security%20Reports/2021/Crowdstrike-Global-Security-Attitude-Survey-2021.pdf)|2021|Attacks|
|[Deloitte](https://www2.deloitte.com/us/en/pages/advisory/articles/future-of-cyber-survey.html)|[Future of Cyber Survey](Annual%20Security%20Reports/2021/Deloitte-Future-of-Cyber-Survey-2021.pdf)|2021|Industry|
|[Fidelis](https://fidelissecurity.com/resource/report/2022-aws-cloud-security-report/)|[AWS Cloud Security Report](Annual%20Security%20Reports/2022/Fidelis-AWS-Cloud-Security-Report-2022.pdf)|2022|Industry|
|[FireEye](https://www.fireeye.com/offers/rpt-cyber-trendscape.html)|[Cyber Trendscape Report](Annual%20Security%20Reports/2020/FireEye-Cyber-Trendscape-Report-2020.pdf)|2020|Industry|
|[Fortinet](https://www.fortinet.com/blog/industry-trends/cloud-security-2021-latest-trends-and-insights)|[Cloud Security Report](Annual%20Security%20Reports/2021/Fortinet-Cloud-Security-Report-2021.pdf)|2021|Industry|
|[Fortra](https://www.fortra.com/services/consulting/cybersecurity/penetration-testing)|[Penetration Testing Report](Annual%20Security%20Reports/2022/Fortra-Pentesting-Report-2022.pdf)|2022|Industry|
|[ISC2](https://www.isc2.org/Landing/cloud-security-report)|[Cloud Security Report](Annual%20Security%20Reports/2022/ISC2-Cloud-Security-Report-2022.pdf)|2022|Industry|
|[ISC2](https://www.isc2.org/landing/Cyberthreat-Defense-Report)|[Cyberthreat Defense Report](Annual%20Security%20Reports/2022/ISC2-Cyberthreat-Defense-Report-2022.pdf)|2022|Industry|
|[KnowBe4](https://www.knowbe4.com/organizational-cyber-security-culture-research-report)|[Cybersecurity Culture Report](Annual%20Security%20Reports/2022/KnowBe4-Cybersecurity-Culture-Report-2022.pdf)|2022|Industry|
|[Norton](https://www.nortonlifelock.com/us/en/newsroom/press-kits/2022-norton-cyber-safety-insights-report-special-release-online-creeping/)|[Cyber Safety Insights Report](Annual%20Security%20Reports/2022/Norton-Cyber-Safety-Insights-Report-2022.pdf)|2022|Industry|
|[PaloAlto](https://www.paloaltonetworks.com/state-of-cloud-native-security)|[State of Cloud Native Security Report](Annual%20Security%20Reports/2023/PaloAlto-State-of-Cloud-Native-Security-2023.pdf)|2023|Industry|
|[Proofpoint](https://go.proofpoint.com/Voice-of-the-CISO-Report.html)|[Voice of the CISO Report](Annual%20Security%20Reports/2023/Proofpoint-Voice-of-the-CISO-Report-2023.pdf)|2023|Industry|
|[PwC](https://www.pwc.com/us/en/services/consulting/cybersecurity-risk-regulatory/library/global-digital-trust-insights.html)|[Global Digital Trust Insights](Annual%20Security%20Reports/2023/PwC-Global-Digital-Trust-Insights-2023.pdf)|2023|Industry|
|[RecordedFuture](https://go.recordedfuture.com/sans-cyber-threat-intelligence-survey-2020)|[SANS Cyber Threat Intelligence Survey](Annual%20Security%20Reports/2020/RecordedFuture-SANS-Cyber-Threat-Intelligence-Survey-2020.pdf)|2020|Industry|
|[Snyk](https://go.snyk.io/2021-state-of-cnas-report)|[State of Cloud Native Application Security](Annual%20Security%20Reports/2021/Snyk-Infrastructure-as-Code-Report-2021.pdf)|2021|Industry|
|[Sonatype](https://resources.fugue.co/state-of-cloud-security-2021-report)|[The State of Cloud Security Report](Annual%20Security%20Reports/2021/Sonatype-State-of-Cloud-Security-2021.pdf)|2021|Industry|
|[Sonatype](https://www.sonatype.com/resources/state-of-the-software-supply-chain-2021)|[The State of Software Supply Chain Report](Annual%20Security%20Reports/2021/Sonatype-State%20of-the-Software-Supplychain-2021.pdf)|2021|Industry|
|[Sophos](https://secure2.sophos.com/en-us/content/state-of-cloud-security)|[State of Cloud Security Report](Annual%20Security%20Reports/2020/Sophos-State-of-Cloud-Security-2020.pdf)|2020|Industry|
|[Splunk](https://www.splunk.com/en_us/campaigns/state-of-security.html)|[State of Security](Annual%20Security%20Reports/2022/Splunk-State-of-Security-2022.pdf)|2022|Industry|
|[Synopsys](https://www.synopsys.com/software-integrity/resources/analyst-reports/devsecops-practices-open-source-management.html)|[DevSecOps Practices and Open Source Management](Annual%20Security%20Reports/2020/Synopsys-DevSecOps-Practices-and-Open-Source-Management-2020.pdf)|2020|Industry|
|[USTelecom](https://www.ustelecom.org/research/2021-cybersecurity-survey-critical-infrastructure-small-and-medium-sized-businesses/)|[Cybersecurity Survey](Annual%20Security%20Reports/2021/USTelecom-Cyber-Survey-2021.pdf)|2021|Attacks|

## Resources
Annual reports are composed by a combination of paid and non-profit research both internal and external to the organization. Examples of paid and government sponsored research are listed as research consulting. Examples of sponsored and non-profit research include professional societies and standards organizations which are listed as working groups. Both of these research resource types rely on sponsorship that’s often commercial.

### Research Consulting
- [Forrester Research](https://www.forrester.com/) is an advisory company that offers paid research, consulting, and event services specialized in market research for information technology.
- [Gartner](https://www.gartner.com/) is a technology research and consulting firm which offers private paid consulting as well as executive programs and conferences.
- [MITRE Corporation](https://www.mitre.org/) is an American not-for-profit organization which conducts research and development supporting various U.S. government agencies.
- [Ponemon Institute](https://www.ponemon.org/) is considered the pre-eminent research center dedicated to privacy, data protection and information security policy.
- [SANS Institute](https://www.sans.org/) is a private U.S. for-profit company which conducts research for consumers of their cybersecurity training and certifications.
- [(ISC)²](https://www.isc2.org/) is a non-profit organization which conducts research for consumers of their cybersecurity training and certifications.

### Working Groups
- [ISACA](https://www.isaca.org/) is an international professional association focused on IT governance, which conducts research for and on behalf of the members.
- [OWASP](https://owasp.org/) is a professional community that produces research concerning web application security, made freely available to the online community.
- [ISO](https://www.iso.org/) is an international organizational body composed of representatives which conduct closed research for creation of standards.

## Contributing
[Please refer to the guidelines at CONTRIBUTING.md for details](CONTRIBUTING.md).
