A curated list of annual cyber security reports - Centralized annual cybersecurity analysis and industry surveys
Definition: The cybersecurity landscape is constantly evolving, making it hard for CIOs, CISOs, and security leaders to keep up. They're flooded with annual reports from research consultancies, industry working groups, non-profits, and government agencies, and sifting through marketing material to find actionable insights is a major challenge. This list aims to cut through the noise by providing a vendor-neutral resource for the latest security trends, tools, and partnerships. It curates information from trusted sources, making it easier for security leaders to make informed decisions.
Disclaimer: The reports in this collection are limited to content which does not require a paid subscription, membership, or service contract. There are a variety of different business models and drivers that would cause information to be put behind a paywall, I would like to respect those companies and individuals. Consult the original authors for licensing of any report content.
Limitations: This is not a collection of project based information such as white papers, intelligence reports, technical specifications, or standards. I welcome all user submitted uploads or report requests, but we should draw a box around this awesome list. All reports will be sourced from the original author when possible and uploaded to Hybrid Analysis for an additional level of confidence, result link will be included in the readme.md commit notes.
Acknowledgement: I would like to give recognition for other works that inspired this collection. Richard Stiennon and his annual analysis of the cybersecurity industry is significantly more comprehensive than this repository and deserves recognition. Additionally, Rick Howard's cyber cannon list of must-read books is an invaluable resource, catering to both leadership and practitioner levels within the field.
Reports have been classified into two categories by the source of data:
- Analysis: Reports generated from quantifying and qualifying intelligence from sensor networks or services.
- Survey: Reports generated from observations and feedback from surveys or consulting engagements.
The reports listed below are the most recent iteration, while past versions are stored in their corresponding yearly folders. After three years, if a source has not updated a report it will no longer be featured in the ReadMe.md file but will still be accessible within the repository directory corresponding to its respective year.
Reports will be classified by a header that describes their primary content or emphasis. While each report may discuss multiple topics, this categorization will help organize them. Under this header they will be sorted alphabetically.
- BKA - Bundeslagebild Cybercrime 2023 (2023) - This report provides an overview of cybercrime trends in Germany, offering insights into attack patterns, perpetrator profiles, and law enforcement responses.
- Blackpoint - Annual Threat Report (2024) - The Annual Threat Report analyzes current cyber threats, attack techniques, and emerging trends, providing actionable intelligence for organizations to enhance their security posture.
- CheckPoint - Cybersecurity Report (2024) - This comprehensive report examines global cybersecurity trends, offering insights into attack vectors, threat actor tactics, and strategies for improving organizational cyber resilience.
- Cisco - Talos Year In Review (2023) - The Talos Year In Review provides a comprehensive analysis of cyber threats and attack trends observed by Cisco's threat intelligence team throughout the year.
- Cofense - Annual State of Email Security (2024) - This report focuses on email-based threats, phishing trends, and strategies for improving organizational email security posture.
- CrowdStrike - Threat Hunting Report (2023) - The Threat Hunting Report provides insights into advanced persistent threats, adversary tactics, and proactive threat hunting methodologies.
- CrowdStrike - Global Threat Report (2024) - This comprehensive report analyzes global cyber threats, offering insights into adversary tactics, emerging attack trends, and strategies for improving cyber defense.
- DeepInstinct - Threat Landscape Report (2023) - The Threat Landscape Report examines evolving cyber threats, offering insights into attack techniques, malware trends, and strategies for enhancing organizational cybersecurity.
- DNSFilter - Annual Security Report (2024) - This report focuses on DNS-based threats and security trends, providing insights into domain-based attacks and strategies for improving network security.
- Dragos - ICS/OT Cybersecurity Year In Review Report (2023) - The ICS/OT Cybersecurity Year In Review Report examines threats and trends specific to industrial control systems and operational technology environments.
- Duo - Trusted Access Report (2024) - This report analyzes trends in authentication and access management, offering insights into multi-factor authentication adoption and secure access strategies.
- Expel - Annual Threat Report (2024) - The Annual Threat Report provides an overview of cyber threats and attack trends observed by Expel's security operations team throughout the year.
- Flashpoint - Global Threat Intelligence Report (2024) - This report offers a comprehensive analysis of global cyber threats, providing insights into threat actor motivations, tactics, and emerging attack trends.
- Flashpoint - Midyear Cyber Threat Index (2024) - The Midyear Cyber Threat Index provides a snapshot of current cyber threat trends, offering insights into evolving attack patterns and threat actor activities.
- Fortinet - Global Threat Landscape Report (2023) - This report analyzes global cyber threats and attack trends, offering insights into emerging vulnerabilities, malware variants, and strategies for improving organizational cybersecurity.
- Horizon3.ai - Proactive Cybersecurity Unleashed (2023) - This report focuses on proactive cybersecurity strategies, offering insights into threat hunting, vulnerability assessment, and offensive security techniques.
- Huntress - Huntress SMB Threat Report (2023) - The SMB Threat Report examines cyber threats specifically targeting small and medium-sized businesses, offering insights into attack trends and mitigation strategies.
- IBM - X-Force Cloud Threat Landscape Report (2023) - This report focuses on threats specific to cloud environments, offering insights into cloud security challenges and strategies for securing cloud infrastructure.
- IBM - X-Force Threat Intelligence Index (2024) - The X-Force Threat Intelligence Index provides a comprehensive analysis of global cyber threats, offering insights into attack trends, threat actor tactics, and industry-specific vulnerabilities.
- Mandiant - MTrends Special Report (2024) - The MTrends Special Report offers insights into advanced persistent threats, emerging attack techniques, and strategies for improving organizational cyber defense.
- Microsoft - Digital Defense Report (2023) - This comprehensive report analyzes global cybersecurity trends, offering insights into threat actor tactics, emerging vulnerabilities, and strategies for improving digital defense.
- NCC Group - Threat Monitor Report (2023) - The Threat Monitor Report provides an analysis of current cyber threats, offering insights into attack trends, vulnerabilities, and strategies for improving organizational cybersecurity.
- PaloAlto - Unit 42 Attack Surface Threat Report (2023) - This report examines attack surface vulnerabilities and emerging threats, offering insights into strategies for reducing organizational attack surfaces.
- Proofpoint - State of the Phish (2024) - The State of the Phish report analyzes phishing trends, social engineering tactics, and strategies for improving organizational resilience against email-based threats.
- Proofpoint - Human Factor Report (2023) - This report focuses on the human element in cybersecurity, examining social engineering tactics, insider threats, and strategies for improving security awareness.
- Rapid7 - Mid-Year Threat Review (2023) - The Mid-Year Threat Review provides a snapshot of current cyber threats and attack trends, offering insights into emerging vulnerabilities and mitigation strategies.
- Rapid7 - Attack Intelligence Report (2024) - This report analyzes attack patterns and techniques, offering insights into adversary tactics and strategies for improving organizational cyber defense.
- RedCanary - Threat Detection Report (2024) - The Threat Detection Report examines current attack techniques and detection strategies, offering insights into improving organizational threat detection capabilities.
- Secureworks - State of the Threat (2023) - This report provides an overview of the current threat landscape, offering insights into emerging attack trends, threat actor motivations, and strategies for improving cyber defense.
- Slashnext - State of Phishing 2023 (2023) - The State of Phishing report analyzes current phishing trends, techniques, and mitigation strategies, offering insights into protecting against email-based threats.
- SonicWall - Cyber Threat Report (2024) - This comprehensive report examines global cyber threats, offering insights into malware trends, attack vectors, and strategies for improving organizational cybersecurity.
- Sophos - Threat Report (2024) - The Threat Report provides an analysis of current cyber threats and attack trends, offering insights into emerging vulnerabilities and strategies for improving cyber defense.
- Synopsys - Open Source Risk Analysis Report (2024) - This report examines security risks associated with open-source software components, offering insights into vulnerability trends and mitigation strategies.
- Thales - Data Threat Report (2024) - The Data Threat Report analyzes current trends in data security, offering insights into emerging threats, compliance challenges, and strategies for protecting sensitive information.
- Trellix - Advanced Threat Research Report (2023) - This report provides in-depth analysis of advanced cyber threats, offering insights into emerging attack techniques, malware trends, and strategies for improving organizational cyber resilience.
- TrendMicro - Annual Cybersecurity Threat Report (2023) - The Annual Cybersecurity Threat Report offers a comprehensive analysis of global cyber threats, examining attack trends, emerging vulnerabilities, and strategies for enhancing organizational security posture.
- Veracode - State of Software Security (2024) - This report examines trends in application security, offering insights into common vulnerabilities, secure development practices, and strategies for improving software security throughout the development lifecycle.
- WatchGuard - Threat Report (2024) - The Threat Report provides an analysis of current cyber threats and attack trends, offering insights into network security challenges and strategies for improving organizational cybersecurity.
- Guidepoint - GRIT Ransomware Annual Report (2023) - The GRIT Ransomware Annual Report offers a comprehensive analysis of ransomware trends, attack techniques, and mitigation strategies, providing valuable insights for organizations to enhance their ransomware resilience.
- PaloAlto - Unit 42 Ransomware Extortion Report (2023) - This report examines current ransomware and extortion trends, offering insights into attacker tactics, ransom demands, and strategies for improving organizational resilience against ransomware attacks.
- Veeam - Ransomware Trends Report Executive Summary (2023) - The Ransomware Trends Report provides an overview of current ransomware attack patterns, data recovery challenges, and strategies for improving organizational ransomware preparedness and resilience.
- Zscaler - ThreatLabz State of Ransomware Report (2024) - This report offers a comprehensive analysis of global ransomware trends, examining attack techniques, ransom demands, and strategies for preventing and mitigating ransomware attacks.
- Beyond Trust - Microsoft Vulnerability Report (2023) - This report analyzes vulnerabilities in Microsoft products, offering insights into security trends and potential areas of concern for organizations relying on Microsoft technologies.
- Flexera - Annual Vulnerability Review (2023) - The Annual Vulnerability Review provides a comprehensive analysis of global software vulnerabilities, offering insights into trends, severity, and impact across various software products and vendors.
- Nucleus - State of Vulnerability Management (2023) - This report examines the current state of vulnerability management practices, highlighting challenges, trends, and best practices in identifying and addressing security vulnerabilities.
- Qualys - TruRisk Threat Research Report (2023) - The TruRisk Threat Research Report provides an in-depth analysis of vulnerabilities and threats, offering insights into risk assessment and prioritization strategies.
- Synopsys - Software Vulnerability Snapshot (2023) - This report offers a snapshot of software vulnerability trends, highlighting common weaknesses, emerging threats, and strategies for improving software security.
- IBM - Cost of a Data Breach Report (2023) - The Cost of a Data Breach Report provides an in-depth analysis of the financial impact of data breaches, offering insights into breach causes, mitigation strategies, and the long-term consequences of security incidents.
- Verizon - Data Breach Investigations Report (2024) - This comprehensive report analyzes global data breaches, offering insights into attack patterns, threat actor motivations, and strategies for improving organizational data security and incident response.
- DataGrail - Privacy Trends 2024 (2024) - DataGrail's report examines the current state of privacy, including emerging regulations, challenges, and best practices across different sectors.
- ISACA- Privacy in Practice (2024) - This report analyzes trends in privacy staffing, budgets, awareness training, breaches, and privacy by design, offering insights to help organizations improve their privacy programs.
- NCC Group - Annual Research Report (2023) - The Annual Research Report provides insights into cutting-edge cybersecurity research, emerging threats, and innovative defense strategies across various industries and technologies.
- Aon - Intangible Versus Tangible Risks Comparison (2024) - This report compares intangible and tangible risks, providing insights into the evolving landscape of corporate risk management and the increasing importance of intangible assets.
- Zscaler - ThreatLabz AI Security Report (2024) - This report examines the intersection of artificial intelligence and cybersecurity, offering insights into AI-powered threats, defensive applications of AI, and strategies for securing AI systems and models.
- Accenture - State of Cybersecurity Resilience (2023) - This report provides insights into the state of cybersecurity resilience across various industries, highlighting key trends and challenges faced by organizations.
- Astrix - State of Non Human Identity (2024) - This report highlights growing concerns over non-human identities as attack vectors, limited automation and visibility into API and third-party connections, and an increasing investment in NHI security.
- ArmorCode - State of Application Security (2023) - The report examines the current landscape of application security, including emerging threats, best practices, and industry-wide trends.
- Checkmarx - Future of Application Security (2024) - The Future of Application Security survey reveals how key stakeholders are responding to the challenges in Application Security from a broad range of industries globally.
- Checkmarx - State of Software Supply Chain Security (2024) - The State of Software Supply Chain Security survey provides insights into current trends in supply chain threats across industries such as banking and finance, insurance, software, technology, engineering, manufacturing, industrial, and public sector.
- Cobalt - State of Pentesting (2024) - This report offers an overview of the current state of penetration testing, including trends, challenges, and best practices across various industries.
- Deloitte - Future of Cyber Survey (2023) - Deloitte's survey explores the future of cybersecurity, providing insights into emerging trends, technologies, and strategies across different sectors.
- Fortinet - Cloud Security Report (2024) - This report examines the state of cloud security, highlighting key challenges, trends, and best practices for organizations across various industries.
- Fortra - Penetration Testing Report (2023) - Fortra's report provides insights into the current landscape of penetration testing, including common vulnerabilities and industry-specific challenges.
- HackerOne - Hacker Powered Security Report (2023) - This annual report explores the state of hacker-powered security, including trends in bug bounty programs and vulnerability disclosure across industries.
- Immuta - State of Data Security Report (2024) - Immuta's report examines the current state of data security, including challenges, trends, and best practices across various industries.
- ISC2 - Cloud Security Report (2024) - This report provides insights into cloud security challenges, trends, and strategies across different sectors.
- ISC2 - Cyberthreat Defense Report (2024) - ISC2's report examines the current state of cyberthreat defense, including emerging threats and defense strategies across various industries.
- KnowBe4 - Cybersecurity Culture Report (2024) - This report explores the state of cybersecurity culture in organizations, highlighting trends and best practices across different sectors.
- Norton - Cyber Safety Insights Report (2023) - Norton's report provides insights into consumer cyber safety trends and challenges across various industries.
- PaloAlto - State of Cloud Native Security Report (2023) - This report examines the current state of cloud-native security, including trends, challenges, and best practices across different sectors.
- Proofpoint - Data Loss Landscape (2024) - Proofpoint's report provides an overview of the data loss landscape, including trends and challenges faced by organizations across various industries.
- Proofpoint - Voice of the CISO Report (2024) - This report offers insights into the perspectives and challenges faced by Chief Information Security Officers across different sectors.
- PwC - Global Digital Trust Insights (2024) - PwC's report examines global trends in digital trust and cybersecurity across various industries.
- SANS - SANS Cyber Threat Intelligence Survey (2023) - This survey provides insights into the current state of cyber threat intelligence across different sectors.
- Snyk - State of Open Source Security (2023) - Snyk's report examines the current state of open source security, including trends and challenges across various industries.
- Sonatype - The State of Cloud Security Report (2023) - This report provides insights into the state of cloud security and software supply chain management across different sectors.
- Sophos - State of Cloud Security Report (2023) - Sophos' report examines the current state of cybersecurity, including trends and challenges faced by organizations across various industries.
- Splunk - State of Security (2023) - This report provides an overview of the current state of security, including trends and challenges across different sectors.
- Synopsys - SANS 2023 DevSecOps Survey (2023) - The SANS survey examines the current state of DevSecOps practices across various industries.
- Synopsys - Global State of DevSecOps 2023 (2023) - This report provides insights into the global state of DevSecOps practices and trends across different sectors.
- USTelecom - Cybersecurity Culture (2023) - USTelecom's report examines the state of cybersecurity culture in the telecommunications industry and related sectors.
- Verizon - Mobile Security Index (2024) - This report provides insights into mobile security trends and challenges across various industries.
- World Economic Forum - Global Cybersecurity Outlook (2024) - The World Economic Forum's report offers a global perspective on cybersecurity trends and challenges across different sectors.
- Cyberreason - Ransomware The True Cost to Business (2024) - This report examines the true cost of ransomware attacks on businesses across different sectors.
- Fortinet - Global Ransomware Report (2023) - Fortinet's report provides a global overview of ransomware trends and impacts across various industries.
- Spycloud - Ransomware Defense Report (2023) - This report examines ransomware defense strategies and trends across different sectors.
- Forrester - The State Of Vulnerability Risk Management (2023) - Forrester's report provides insights into vulnerability risk management practices and trends across various industries.
- Mend - State of Supply Chain Threats (2023) - This report examines the current state of supply chain threats and vulnerabilities across different sectors.
- HiddenLayer - AI Threat Report (2024) - HiddenLayer's report provides insights into the AI threat landscape across various industries.
- Snyk - AI Generated Code Security Report (2023) - This report examines the security implications of AI-generated code across different sectors.
- Cisco - Data Privacy Benchmark Study (2024) - Cisco's benchmark study provides insights into data privacy trends, challenges, and breaches across various industries.
Annual reports are composed by a combination of paid and non-profit research both internal and external to the organization. Examples of paid and government sponsored research are listed as research consulting. Examples of sponsored and non-profit research include professional societies and standards organizations which are listed as working groups. Both of these research resource types rely on sponsorship that is often commercial.
- Forrester Research - an advisory company that offers paid research, consulting, and event services specialized in market research for information technology.
- Gartner - a technology research and consulting firm which offers private paid consulting as well as executive programs and conferences.
- MITRE Corporation - an American not-for-profit organization which conducts research and development supporting various U.S. government agencies.
- The Rand Corporation - an American not-for-profit organization which conducts research and analysis on various aspects of cybersecurity and cyber policy focused on national security.
- Ponemon Institute - considered the pre-eminent research center dedicated to privacy, data protection and information security policy.
- SANS Institute - a private U.S. for-profit company which conducts research for consumers of their cybersecurity training and certifications.
- The International Information System Security Certification Consortium (ISC)² - an American not-for-profit organization which conducts research for consumers of their cybersecurity training and certifications.
- The Information Security Forum (ISF) - a global, independent organization dedicated to benchmarking and sharing best practices in information security.
- International Data Corporation (IDC) - a global provider of market intelligence and advisory services.
- The Cyber Threat Alliance (CTA) - an industry-driven group of cybersecurity organizations that share threat intelligence and conduct collaborative research to combat cyber threats.
- The Information Systems Audit and Control Association (ISACA) - an international professional association focused on IT governance, which conducts research for and on behalf of the members.
- The Forum of Incident Response and Security Teams (FIRST) - provides platforms, means and tools for incident responders to always find the right partner and to collaborate efficiently.
- The Open Web Application Security Project (OWASP) - a professional community that produces research concerning web application security, made freely available to the online community.
- The International Organization for Standardization (ISO) - an international organizational body composed of representatives which conduct closed research for creation of standards.
- Cybersecurity and Infrastructure Security Agency (CISA) - a U.S. government agency responsible for enhancing the security and resilience of the nation's critical infrastructure.
- Europol - European Cybercrime Centre (EC3) - a strategic alliance focused on combating cybercrime within the European Union.
- The Cybersecurity Forum Initiative (CSFI) - an American non-profit organization that promotes cybersecurity awareness and research.
- The Center for Internet Security (CIS) - a American non-profit organization that provides cybersecurity solutions and best practices.
- The Center for Strategic and International Studies (CSIS) - Technology Policy Program - a think tank with a Technology Policy Program that conducts research and provides insights into technology and cybersecurity policies.
Please refer to the guidelines at CONTRIBUTING.md for details.