Its a shame the report is of "organisations of all sizes and all industries" as that is precisely what benchmarking aims to avoid.

To benchmark, industry and organisation size a key.

Grouping in a 2 man recruitment firm with a 50,000 person military contractor just results in meaningless statistics that really cant be used for any form of benchmarking by a CISO worth their salt.