Introduction

Every year, major organizations publish reports that track trends in cybersecurity. While this might be part of an overall marketing strategy, they do provide valuable insights into the current state of the field, and often include thoughts and voices from outside of the organization.

At the time of this article’s writing, the latest reports cover the years 2023 and 2024. This article is not an analysis of the yearly report, but is simply a general reference. I will provide a brief overview of their overall purpose and use, and links to the latest releases.

Verizon Data Breach Investigation Report (DBIR)

The DBIR began in 2008 and is widely considered a cornerstone of cybersecurity research and trends. looks at breaches that have occurred over the past year. It has developed overtime into a very polished document that looks more like a magazine than an official report. It provides quality analysis, plenty of numbers and percentages, and very colorful graphs. An interesting read, and a useful tool during budget request season.

It is not a quick read overall, but each section is a short article, so it can be taken in small doses. As the report itself suggests it might be best to start with §Appendix A: How to read this report.

The report is available for free, without requiring any sign-up or contact info. Past reports are available by searching the Verizon website’s resources page.

IBM Cost of a Data Breach Report

Clearly part of their marketing campaign, the report which was first released in 2006 is a yearly analysis of research conducted by the Ponemon Institute. Its focus is on the financial impact of data breaches. It provides plenty of metrics with totals, percentages, and graphs.

The report tends to emphasize the importance of adopting technology, and of course, IBM just so happens to have a nice solution for sale. Nevertheless, it is an interesting read, especially for managers and execs interested in soliciting a superior security stack.

IBM requires sign-up to download the report.

ENISA Threat Landscape Report

The European Union Agency for Cybersecurity (ENISA), established in 2004, provides a yearly comprehensive overview of the agency's achievements, activities, and strategic goals. It also provides details on internals such as controls, and budget. This report reads and feels more like a report than the previous entries, and is a little wordier, but it still offers plenty of great stats and metrics. It also contains some slightly more in-depth technical analysis regarding things like specific protocols and CVEs.

The report is free to download without sign-up or contact info. They also offer more specific threat landscape reports.

Cisco Annual Reports

Until 2018, Cisco provided an annual report known as the “Cisco Annual Cybersecurity Report”. Since then, they have ceased its publication and have begun providing other reports with more granularized focus:

Cisco Talos Year in Review
Cisco Cybersecurity Readiness Index
Cisco Data Privacy Benchmark study
Duo Trusted Access Report
State of AI Security Report

These reports provide good insights but are also obvious marketing materials, and are by far the most colorfully formatted, with a lot of graphics to go along with their stats and metrics. Each report has its own fancifully designed page with overviews of each, and are free to download without sign-up or contact info.

Check Point’s The State of Security Report

The report was first published in 2013. Unfortunately, I do not have access to this report, so I cannot provide much insight. Copi informs me that it offers “actionable intelligence to navigate the rapidly changing threat landscape,” but I cannot provide anything more specific.

The report is only available with a valid business email address (it will not accept public email providers).

Microsoft Digital Defense Report

Microsoft’s annual report began in 2020, and it provides insights into trends, threats and defense strategies. It is another very well formatted report, if a lot wordier than most of the others. It has plenty of graphics, but is less focused on metrics and stats. It is primarily a collection of articles on various topics. This is a long read, but well worth it.

The report’s download page provides a nicely formatted and navigable summary, and it is available for free without sign-up or contact info.

The Cybersecurity Advisory Committee (CSAC) Annual Report

This report is provided by CISA, and provides insights into the agency’s activities, findings and recommendations. It consists of two parts: The Annual Report and the Recommendations (which may vary year-to-year). The Report provides an overview of activities, such as meeting dates and purposes, where the Recommendations provides insights from various subcommittees such as Secure by Design, and Strategic Communications. Note that not all subcommittees publish yearly Recommendations. These reports have limited use to the average defender, but are interesting reads, and helpful for staying informed on the activities of this important government agency.

The report and recommendations are free to download without sign-up or contact info. Historical reports and recommendations are also available.

National Institute of Standards and Technology (NIST) Cybersecurity and Privacy Annual Report

The annual report from NIST, also referred to as SP 800-229, highlight’s the agency’s research activities and accomplishments in the fields of cybersecurity and privacy. As useful as all of the resources in this article are, this is perhaps one of the most important because of how closely organizations adopt NIST’s frameworks and standards in their own security programs and strategies. Despite looking like a website from the 90s, it is a valuable resource for staying informed. It also offers links to other resources.

The report is free to download without sign-up or contact info.

Mandiant

The report which began in 2010 when Mandiant was still independent, has continued to provide insights into cybersecurity trends, especially related to tactics, techniques and procedures (TTPs). This is another of the most important resources in this article, as it provides a lot of useful metrics, stats and graphs, with analysis and detailed specifics related to attackers and their TTPs, actively exploited CVEs, with especially good insight into APT activity.

The report is free to download, but does ask for contact info. It asks for business contact, but if you are signed into Google with a personal account it will accept that email.

Summary

Staying well-informed is essential for building and maintaining an effective security program and defense strategy. The preceding list provides plenty of useful insights, as well as ammunition to assist with making an argument for more security resources.

A funny sidenote to this article: When I asked my assistant Copi to provide me with a list of annual reports, I noticed it left out the Mandiant report. I asked it the reason for this, and it stated, “I didn’t include the Mandiant M-Trends report earlier simply because it didn’t immediately come to mind when I was listing well-known annual cybersecurity reports.”

I thought that was interesting as the Mandiant report is a well-known annual cybersecurity report, but also because Google is a major competitor, especially in the AI assistant space. Curious. I’ll have to keep my eye on Copi from now on.

Active Resources

Here are links to the latest reports. As of the writing of this article, these reports are still actively being published.

Verizon Data Breach Investigations Report (DBIR)
https://www.verizon.com/about/news/2025-data-breach-investigations-report

IBM Cost of a Data Breach
https://www.ibm.com/reports/data-breach

ENISA Threat Landscape Report
https://www.enisa.europa.eu/publications/enisa-threat-landscape-2024

Cisco Annual Cyber Security Report
https://www.cisco.com/c/en/us/products/security/cybersecurity-reports.html

Check Point Cyber Security Report
https://www.checkpoint.com/resources/items/report--cyber-security-report-2025

Microsoft Digital Defense Report
https://www.microsoft.com/en-us/security/security-insider/intelligence-reports/microsoft-digital-defense-report-2024

CISA and NSA Annual Cybersecurity Advisory
https://www.cisa.gov/resources-tools/resources/cybersecurity-advisory-committee-csac-reports-and-recommendations

NIST Cybersecurity and Privacy Annual Report
https://www.nist.gov/publications/fiscal-year-2023-cybersecurity-and-privacy-annual-report

Mandiant M-Trends
https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2024

Inactive Resources

Here are links to reports that are no longer being published. Since the main focus on the reports is trends, I provide these resources for additional historical context.

Cisco Annual Cybersecurity Report
https://community.cisco.com/t5/security-blogs/2018-annual-cybersecurity-report-is-now-available/ba-p/3664614?dtid=osscdc000283&linkclickid=srch

Symantec Internet Security Threat Report
https://docs.broadcom.com/doc/istr-24-executive-summary-en

Ponemon Institute Cybersecurity Studies
https://www.ponemon.org/research/ponemon-library/security

Daily Cuppa

Today’s cup of tea is Organic Vanilla Rooibos provided by Equal Exchange. Fair trade, organic, and full of flavor. I especially enjoy its tobacco-like aroma when dry, and its deep richness when steeped.

If you found this list of resources useful feel free to buy the author a cup of tea.

Cybersecurity Trend Reports for the Well-Informed IT Security Pro