Source: own research after collecting and processing 14000 annual reports the last 2 years. Mostly for infosec purposes but it seems to be useful in other areas as well.