I think if you have a need to work in this area, that the best bet is to start doing incident detection on your own network, and work on building coalitions that help you get NDA-level information with your peers.
There is no one right answer across the board. The "total # of shoulder surfing attacks" vs. "total # of brute force passwords" is going to be pretty diffcult to get hard statistics numbers. This is not an area that a researcher can address with a Gallup poll, since if you call an IT security professional and ask, they will either hang up or report YOU as the security incident.
Add to it that industries will vary widely - there are some common threats out there, but the scope of attacks CAN target different entities or industries.
I'll say that this fits closely with the IT areas of Incident Detection, Respose and Prevention. Large scale systems tend to use some COTS based solution to detect the kind of attacks you mention - either network stats like bruteforce password attempts, or signs of the outcomes of social engineering. In a mature system, they don't just respond to the crisis, but ask "how can we do better?", so they aggregate and compare the data in some way. How exactly is the secret sauce that won't cross security barriers without some well-understood agreements.
The best data I've seen comes from pay-for services - my favorite is the ACSC - the Advanced CyberSecurity Center - where member banks do share this sort of information. There's Gartner and Forrester, too, who are less specific, less easy to get detailed info from and less fully targeted at security.
There's not much public info I'd be trusting in this area - my first questions would be "how did you collect it?", "from who?" and "what where they measuring?"
This is definitely a case where how you ask the question will influence the answer.
