# Cybersecurity Annual Reports

Aggregates cybersecurity annual reports across vendors and categories for analysis.

- Repository: https://github.com/danielmiessler/LifeOS (19669 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-28
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add danielmiessler/LifeOS --skill AnnualReports -g -a claude-code -y`
Codex: `npx skills add danielmiessler/LifeOS --skill AnnualReports -g -a codex -y`
Cursor: `npx skills add danielmiessler/LifeOS --skill AnnualReports -g -a cursor -y`
Gemini CLI: `npx skills add danielmiessler/LifeOS --skill AnnualReports -g -a gemini-cli -y`

## Description

Aggregate several hundred cybersecurity annual reports from CrowdStrike, Mandiant, IBM, Verizon, Microsoft, CISA, OWASP, Wiz, Palo Alto across 19+ categories (threat intel, ransomware, breaches, AppSec, cloud, AI, identity, pentest). Intents: UPDATE, ANALYZE, FETCH. USE WHEN annual reports, threat reports, vendor reports, ransomware trends, breach stats, DBIR, IBM Cost of Breach, threat landscape, CISO report, CVE trends. NOT FOR real-time threat feeds or live CVE lookup.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# AnnualReports - Security Report Aggregation

**Contents:** Ideal State · Anti-criteria · Intent Routing · Tool contract · Data & Config · Gotchas · Examples

Keeps one indexed catalog of several hundred annual cybersecurity reports, fetches the ones that answer a question, and synthesizes trends across vendors with every figure traceable to its source.

**Source:** [awesome-annual-security-reports](https://github.com/jacobdjwilson/awesome-annual-security-reports)

## Ideal State

- UPDATE leaves `Data/sources.json` refreshed from the upstream awesome-annual-security-reports GitHub list, and the counts of added and removed reports are reported.
- FETCH leaves a summary of the requested vendor report page saved under `Reports/<vendor>/`, with a note that most full PDFs need registration, and a listing request returns the reports in the asked category with their direct URLs; a requested fetch that could not be completed is reported as unavailable.
- An ANALYZE answer names the vendors consulted, and also the ones absent from the answer. A ransomware synthesis that skipped Sophos says so, because the gap changes how much weight the numbers carry.
- In an ANALYZE answer, every figure carries its vendor, its year, and the report it came from, and where vendors disagree, the disagreement is named and both numbers stand.
- The publication lag is stated once (2026 reports cover 2025 data) so a trend read isn't mistaken for this-minute data.

## Anti-criteria

- Never silently average disagreeing vendors' numbers into one clean figure that no source actually published.
- Never attribute a figure to the wrong report year, and never ship a stat without its vendor, year and report.
- Never leave a requested fetch unavailable without reporting it.
- Never conflate different vendors' terminology: each vendor has their own threat actor naming conventions.

## Intent Routing

The rest: https://github.com/danielmiessler/LifeOS/blob/HEAD/LifeOS/install/skills/AnnualReports/SKILL.md