The annual report from PWC (direct link to the full .pdf file) on the Global State of Information Security makes for interesting reading. There are some insightful facts and figures being reported and plenty of analysis on these reported elsewhere,...
http://www.computerweekly.com/blogs/stuart_king/2008/10/pwcreport.html