AnnualReports - Security Report Aggregation

Contents: Ideal State · Anti-criteria · Intent Routing · Tool contract · Data & Config · Gotchas · Examples

Keeps one indexed catalog of several hundred annual cybersecurity reports, fetches the ones that answer a question, and synthesizes trends across vendors with every figure traceable to its source.

Source: awesome-annual-security-reports

Ideal State

• UPDATE leaves Data/sources.json refreshed from the upstream awesome-annual-security-reports GitHub list, and the counts of added and removed reports are reported.
• FETCH leaves a summary of the requested vendor report page saved under Reports/<vendor>/, with a note that most full PDFs need registration, and a listing request returns the reports in the asked category with their direct URLs; a requested fetch that could not be completed is reported as unavailable.
• An ANALYZE answer names the vendors consulted, and also the ones absent from the answer. A ransomware synthesis that skipped Sophos says so, because the gap changes how much weight the numbers carry.
• In an ANALYZE answer, every figure carries its vendor, its year, and the report it came from, and where vendors disagree, the disagreement is named and both numbers stand.
• The publication lag is stated once (2026 reports cover 2025 data) so a trend read isn't mistaken for this-minute data.

Anti-criteria

• Never silently average disagreeing vendors' numbers into one clean figure that no source actually published.
• Never attribute a figure to the wrong report year, and never ship a stat without its vendor, year and report.
• Never leave a requested fetch unavailable without reporting it.
• Never conflate different vendors' terminology: each vendor has their own threat actor naming conventions.

Intent Routing