If you track the events reported (insert numerous caveats) they can be associated to a particular OSI layer and give you an idea of what is going on year to year.
However, even with this raw data you can see significant trends in the data by flipping the axis and looking at the clustering moving up and down the OSI in subsequent years.
This is work from BlackBelt Cyber an evidence based risk management methodology