[tptacek]

I don't think these kinds of surveys are (1) accurate or (2) particularly useful, but the gold standard for this kind of stuff is the Verizon DBIR:

https://enterprise.verizon.com/resources/reports/dbir/

[TeMPOraL]

For CISOs wanting to learn from past attacks, is there anything you would recommend as either accurate or useful (or both)?