{ "schemaVersion": "deck-intelligence.v1", "id": "019dd923-5de0-76bd-a166-0ebac6399c4f", "slug": "994e80d75408a4b6", "title": "INCIDENT RESPONSE INSIGHTS", "subtitle": "Booz Allen", "author": "Booz Allen", "pageCount": 10, "kind": "consulting-deck", "orientation": "landscape", "aspectRatio": 1.778, "document": { "id": "019dd923-5de0-76bd-a166-0ebac6399c4f", "slug": "994e80d75408a4b6", "title": "INCIDENT RESPONSE INSIGHTS", "rawTitle": "INCIDENT RESPONSE INSIGHTS", "authorId": "misc", "authorName": "Booz Allen", "authorDisplay": "Booz Allen", "kind": { "slug": "consulting-deck", "label": "Consulting deck" }, "sourceType": { "slug": "strategy_consulting", "label": "Strategy consulting" }, "fileName": "incident-response-insights-january-2025.pdf", "sourceUrl": "https://www.boozallen.com/content/dam/home/docs/cyber/incident-response-insights-january-2025.pdf", "sourceDate": "2025-01-15 00:00:00", "presentationDate": null, "ingestedAt": "2026-04-24 07:54:27+00", "status": "ready", "pageCount": 10, "orientation": "landscape", "aspectRatio": 1.778, "targetCompany": null, "targetTicker": null, "metadata": { "local_root": "/tmp/legacy-images/994e80d75408a4b6", "origin_corpus": "consulting" } }, "coverage": { "pageCount": 10, "pagesIndexed": 10, "pagesWithImages": 10, "pagesWithMetadata": 10, "imageCoveragePct": 100, "metadataCoveragePct": 100, "componentCount": 71, "chartCount": 11, "metricSlides": 0, "toolMatches": 2, "documentToolMatches": 0, "frameworkMatches": 0, "arcMatches": 1, "beatMatches": 3, "loopMatches": 0, "patternMatches": 0, "storymakersMatch": false, "scoreAvailable": true, "reviewAvailable": true, "activistThesisAvailable": false, "pitchdeckMetadataAvailable": false, "pitchdeckProfileAvailable": false }, "blocks": [], "matches": { "arcs": [ { "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null, "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "matchId": "64c1bc16-4180-4b57-86e1-932c4ab10292", "evidence": "The deck presents a series of data-driven insights, culminating in a Booz Allen overview", "isPrimary": true, "confidence": 0.8, "extraction": { "at": "2026-07-16 21:11:28.689322+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "beats": [ { "to": 4, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null, "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "from": 1, "name": "Current State", "beatId": "a763e876-23f9-4df3-9ba8-d06c3d4c89a9", "matchId": "64c1bc16-4180-4b57-86e1-932c4ab10292", "beatType": { "name": "What Is", "slug": "sparkline-what-is-1", "status": "active", "canonId": "019dd9b8-25d5-7468-8649-454886d75343", "version": 1, "description": null }, "evidence": "Monthly Incident Metrics, Incident YTD Trends, Threat Actor YTD Trends", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 0.8 }, { "to": 8, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null, "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "from": 5, "name": "Detailed Analysis", "beatId": "fd216dee-a04f-45b2-9de2-82ba6d2fc640", "matchId": "64c1bc16-4180-4b57-86e1-932c4ab10292", "beatType": { "name": "What Is", "slug": "sparkline-what-is-3", "status": "active", "canonId": "019dd9b8-2701-72ba-a477-4121f4fb5d33", "version": 1, "description": null }, "evidence": "Ransom Demand By Threat Actors, Underwriting Focus Area – Top 10 Security Controls", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 }, { "to": 10, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null, "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "from": 9, "name": "Conclusion", "beatId": "8ab5636d-4beb-4997-9849-bff010a10dbf", "matchId": "64c1bc16-4180-4b57-86e1-932c4ab10292", "beatType": { "name": "New Bliss", "slug": "sparkline-new-bliss", "status": "active", "canonId": "019dd9b8-2879-72f7-8968-bcfac0921b99", "version": 1, "description": null }, "evidence": "Booz Allen Overview, INCIDENT RESPONSE CONTACT DETAILS", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "tools": [ { "tool": { "name": "Slide recipe: Cover", "slug": "cover-slide", "status": "active", "bestFor": null, "canonId": "019df269-2a08-767d-9128-e7431e6fe8a3", "version": 1, "bodyDocId": "019df269-29e5-7738-b5fa-6892e5dc8e65", "description": "The first ten seconds. Build it deliberately.", "familyLabel": "slide-recipe", "categoryName": "Slide", "categorySlug": "slide" }, "agent": "designer", "layer": "slide", "agents": [ "designer" ], "matchId": "ae98c38b-2a1a-48f9-a91a-cbdc5f9f1902", "evidence": "INCIDENT RESPONSE INSIGHTS", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 21:28:10.050362+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 1, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Chart Selection Guide", "slug": "chart-selection-guide", "status": "active", "bestFor": null, "canonId": "019dd956-b1a0-700b-ba17-0e16c4d5bcae", "version": 1, "bodyDocId": null, "description": "Choosing the right chart type for your data and message", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "27987413-1525-478d-848e-7a024f30240b", "evidence": "chart/donut: Incidents by Industry - December 2024", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.5, "extraction": { "at": "2026-07-16 21:28:10.125144+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 2, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "patterns": [] }, "storymakers": null, "score": { "backend": "codex", "scoredAt": "2026-05-02 10:50:20.609+00", "subScores": { "scqa_arc": 36, "action_titles": 18, "mece_structure": 46, "closing_strength": 53, "evidence_quality": 74, "clarity_of_thesis": 42, "production_quality": 58, "visual_storytelling": 67 }, "totalScore": 49, "coveragePct": 100, "explanations": { "scqa_arc": "Slides 2-6 provide situation and complication data, but the deck does not frame a central question and the answer jumps late into controls and contact information.", "action_titles": "Most titles are topic labels rather than insight sentences; for example, slide 2 is titled \"Monthly Incident Metrics\" instead of stating the December incident mix shift.", "mece_structure": "The structure moves from metrics to trends to threat actors to ransom demands to controls, but threat actor/ransom sections overlap and slides 7-8 only show controls #6-10 without the full control set.", "closing_strength": "Slide 10 provides contact details and a signup call-to-action, but it does not close with a synthesized recommendation, prioritized actions, or decision path.", "evidence_quality": "The strongest claims in slides 2-6 are backed by charts, data points, and callouts, while the security control and corporate overview slides rely more on asserted guidance and credentials.", "clarity_of_thesis": "The report topic is clear by slides 1-2, but the first five slides never state a declarative thesis beyond incident metrics, threat actor trends, and ransom demand observations.", "production_quality": "The deck has consistent Booz Allen branding and a coherent dark visual system, but low action-title density, crowded data pages, continuation titles, and unclear footnote discipline weaken polish.", "visual_storytelling": "Slides 2-6 use suitable dashboards, stacked bars, and horizontal bars for quantitative claims, though several slides are dense or overcrowded and reduce the story impact." }, "slidesAnalyzed": 10 }, "review": { "backend": null, "verdict": "A data-rich underwriting briefing whose analytical content is strong but whose Storymakers craft — action titles, SCQA spine, MECE pillars — is largely absent, making it a below-average Storymakers exemplar.", "reviewedAt": "2026-05-01 22:18:38.881+00", "slidesSeen": 10, "suggestions": [ "Rewrite titles as declarative insights: e.g., slide 3 'Ransomware drove 30-50% of all 2024 incidents'; slide 5 'A single 9-digit demand skewed Q4 ransom economics'.", "Insert an executive summary as slide 2 stating the 3-4 headline findings before any chart, so the reader gets the answer first.", "Restructure into MECE acts with dividers: (1) What we saw in 2024, (2) Why it matters for your risk, (3) What to do about it, (4) How to engage us — and move slide 9 to front matter or appendix.", "Bridge slides 6->7 with a 'so what' transition that explicitly links observed threat-actor and ransom patterns to the specific top-10 controls being recommended.", "Split slide 3 (overcrowded, 12 data points) into two focused views, demoting the rest to appendix." ], "closingScore": 50, "openingScore": 35, "topStrengths": [ "Strong analytical substrate — slides 2-6 carry rich, quantified evidence (12-26 data points) with sharp callouts that could anchor an insight-led narrative.", "Slide 10 provides a concrete, channel-specific CTA (hotlines + signup) rather than ending in an appendix dump." ], "topWeaknesses": [ "Every analytical slide (2-6) uses a noun-phrase topic title; the insight lives only in the sidebar callout, violating the action-title principle.", "No SCQA spine — the deck never poses the Question the trend data is answering, and slides 7-9 (controls, corporate overview) feel bolted on rather than derived from the analysis.", "Slide 9 'Booz Allen Overview' is misplaced 'about us' content near the close; it dilutes the resolution moment and is flagged overcrowded for an establish_context function." ], "narrativeScore": 45, "pillarCritique": "There are no real section dividers; the implicit pillars (incident metrics -> threat actors -> ransom economics -> controls -> about/contact) are sequential topic dumps rather than a MECE decomposition of a single question.", "closingCritique": "Slide 10 delivers a clear contact CTA and signup, which is functional, but the preceding slide is a corporate overview rather than a synthesized recommendation or 'so what'. The close mobilizes contact, not conviction.", "openingCritique": "Slide 1 is a generic cover and slide 2 dives straight into 'Monthly Incident Metrics' charts — no stakes, no governing insight, no answer-first framing. A reader must mine 4-5 dense dashboards before grasping what the deck argues.", "extractionSeconds": 86.837, "narrativeCritique": "The deck reads as a data-dump (Situation -> Analysis) with no clear Complication or Resolution arc; slides 2-6 stack metrics, then jump abruptly to security controls (7-8) and a corporate 'about us' (9) before contacts (10). There is no thesis bridging the trend data to the recommendations.", "titleQualityScore": 30, "titleQualityCritique": "Titles are almost entirely topic labels ('Monthly Incident Metrics', 'Incident YTD Trends', 'Threat Actors 2024 YTD', 'Ransom Demand By Threat Actors') rather than action titles. The callouts (e.g., slide 5's '9-digit ransom demand outlier') carry the real insight and should have been promoted to titles." }, "activistThesis": null, "pitchdeck": { "metadata": null, "profile": null }, "slides": [ { "page": 1, "type": "setup", "function": "front_matter", "imagePath": "https://imgproxy.kitesheet.com/IB9ajGGM7Y50lxM6rBQBgw9iFg6VHLjOfw1rtEVm6xk/rs:fit:1200:1200:0/q:82/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy85OTRlODBkNzU0MDhhNGI2L3AwMDEuanBn", "rawType": "cover", "block": null, "metadata": { "slideType": "cover", "slideTypeCanon": { "name": "Cover", "slug": "cover", "status": "active", "canonId": "019de52d-05f2-729d-9f93-e0504f0a2410", "version": 1, "description": null }, "function": "front_matter", "functionCanon": { "name": "Front matter", "slug": "front_matter", "status": "active", "canonId": "019de52d-133d-73f0-9e26-201eda96b098", "version": 1, "description": null }, "density": "balanced", "densityScore": 35, "componentCount": 6, "textChars": 296, "nDataPoints": 0, "notes": null, "elementsJson": [ "headline_text", "photo", "other" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:49:43.594+00", "seconds": 2.863, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a166-0ebac6399c4f/1", "deck": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f", "deckAnchor": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f#slide-1", "deckJson": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f.json" }, "components": [ { "bbox": { "h": 0.08, "w": 0.35, "x": 0.07, "y": 0.67 }, "kind": "disclaimer", "text": "Disclaimer: The content of this document is for informational purposes only. Booz Allen Hamilton is not responsible for your reliance on, or implementation of the guidance described in this document.", "attrs": null, "canon": { "kind": { "name": "Disclaimer", "slug": "disclaimer", "status": "active", "canonId": "91173477-d91f-4024-bbaf-d4f93e3f82dc", "version": 1, "description": "Legal/cautionary text that occupies most of the body of its slide." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:43.594+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8a5221fe-140a-45b3-a9ca-2123cc9349ca", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.1, "x": 0.07, "y": 0.083 }, "kind": "image", "text": "Booz Allen", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Logo", "slug": "logo", "status": "active", "canonId": "019de52c-fdaf-743d-94c4-d7c6a0e55302", "version": 1, "description": null }, "framework": null }, "subkind": "logo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:43.594+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0fb0894d-d541-4f88-bff9-53e1a9786fbb", "parentComponentId": null }, { "bbox": { "h": 1, "w": 0.6, "x": 0.4, "y": 0 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Photo", "slug": "photo", "status": "active", "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875", "version": 1, "description": null }, "framework": null }, "subkind": "photo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:43.594+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f1a5505e-51e6-41f9-9d74-93b47f62bda2", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.35, "x": 0.07, "y": 0.62 }, "kind": "paragraph", "text": "BASED ON INCIDENT DATA AS OF END OF DECEMBER 2024", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:43.594+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f34e91e7-dd07-4b79-be87-d2da88a99d5d", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.35, "x": 0.07, "y": 0.15 }, "kind": "title", "text": "INCIDENT RESPONSE INSIGHTS", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:43.594+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1d298d9b-eb3a-42c2-abaf-04d30013edbf", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.15, "x": 0.07, "y": 0.54 }, "kind": "title", "text": "JANUARY 2025", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:43.594+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3677eb56-9557-46a5-98f3-7888e6a1f6f1", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Slide recipe: Cover", "slug": "cover-slide", "status": "active", "bestFor": null, "canonId": "019df269-2a08-767d-9128-e7431e6fe8a3", "version": 1, "bodyDocId": "019df269-29e5-7738-b5fa-6892e5dc8e65", "description": "The first ten seconds. Build it deliberately.", "familyLabel": "slide-recipe", "categoryName": "Slide", "categorySlug": "slide" }, "agent": "designer", "layer": "slide", "agents": [ "designer" ], "matchId": "ae98c38b-2a1a-48f9-a91a-cbdc5f9f1902", "evidence": "INCIDENT RESPONSE INSIGHTS", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 21:28:10.050362+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 1, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 4, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 1, "name": "Current State", "beatId": "a763e876-23f9-4df3-9ba8-d06c3d4c89a9", "matchId": "64c1bc16-4180-4b57-86e1-932c4ab10292", "beatType": { "name": "What Is", "slug": "sparkline-what-is-1", "status": "active", "canonId": "019dd9b8-25d5-7468-8649-454886d75343", "version": 1, "description": null }, "evidence": "Monthly Incident Metrics, Incident YTD Trends, Threat Actor YTD Trends", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "thumbSrc": "https://imgproxy.kitesheet.com/EMspYEOIXlrJ4Pt3n5xDUyv4ouxMM9h_PuzEfTWNC0A/rs:fit:480:480:0/q:78/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy85OTRlODBkNzU0MDhhNGI2L3AwMDEuanBn", "imagePathAlt": "https://imgproxy.kitesheet.com/OzKyWKU0qfQgOpbJUUrn9fyEgEp-rGidmvo8KuCrfkc/rs:fit:1200:1200:0/q:82/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy85OTRlODBkNzU0MDhhNGI2L3AwMDEucG5n", "thumbSrcAlt": "https://imgproxy.kitesheet.com/-Kpe1Kx7WgKUz_x7GHtr_2tK-Uog8QOIIue1Apu38wI/rs:fit:480:480:0/q:78/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy85OTRlODBkNzU0MDhhNGI2L3AwMDEucG5n" }, { "page": 2, "type": "analysis", "title": "The slide uses a dark theme with donut charts and 100% stacked bar charts to visualize incident distribution.", "function": "summarize", "rawType": "kpi_dashboard", "block": null, "metadata": { "slideType": "kpi_dashboard", "slideTypeCanon": { "name": "KPI dashboard", "slug": "kpi_dashboard", "status": "active", "canonId": "019de52d-0be5-7295-af4d-b850fe7b7e65", "version": 1, "description": null }, "function": "summarize", "functionCanon": { "name": "Summarize", "slug": "summarize", "status": "active", "canonId": "019de52d-1541-704f-b86f-bf7b75056373", "version": 1, "description": null }, "density": "dense", "densityScore": 72, "componentCount": 8, "textChars": 619, "nDataPoints": 30, "notes": "The slide uses a dark theme with donut charts and 100% stacked bar charts to visualize incident distribution.", "elementsJson": [ "donut_chart", "bar_chart_100pct", "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:49:46.737+00", "seconds": 5.822, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a166-0ebac6399c4f/2", "deck": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f", "deckAnchor": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f#slide-2", "deckJson": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "In December, we saw a marked increase in Insider Threats, DDoS and Sensitive Data Loss incidents, but a decrease in Ransomware, Email Compromise, Network Intrusion and Unauthorized Access compared to the previous month.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:17:14+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-f389-7267-bca0-7fe7522f9c34", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.25, "x": 0.65, "y": 0.55 }, "kind": "chart", "text": "Incidents Industry Monthly Trends", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Stacked bar chart (100%)", "slug": "bar-stacked-100pct", "status": "active", "canonId": "019de52c-ff14-71b8-8d88-860f8d7da84b", "version": 1, "description": null }, "framework": null }, "subkind": "bar-stacked-100pct", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:46.737+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "31739a05-6985-4e66-8f98-b0bf987e5080", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.25, "x": 0.35, "y": 0.55 }, "kind": "chart", "text": "Incidents Types Monthly Trends", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Stacked bar chart (100%)", "slug": "bar-stacked-100pct", "status": "active", "canonId": "019de52c-ff14-71b8-8d88-860f8d7da84b", "version": 1, "description": null }, "framework": null }, "subkind": "bar-stacked-100pct", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:46.737+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e8aa84ac-acd1-4320-ad65-966f27c87245", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.25, "x": 0.35, "y": 0.05 }, "kind": "chart", "text": "Incidents by Types - December 2024", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Donut chart", "slug": "donut", "status": "active", "canonId": "019de52d-0006-752c-9528-0fef476b8004", "version": 1, "description": null }, "framework": null }, "subkind": "donut", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:46.737+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "36939089-0548-4b23-8ab2-ab7cdc855840", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.25, "x": 0.65, "y": 0.05 }, "kind": "chart", "text": "Incidents by Industry - December 2024", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Donut chart", "slug": "donut", "status": "active", "canonId": "019de52d-0006-752c-9528-0fef476b8004", "version": 1, "description": null }, "framework": null }, "subkind": "donut", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:46.737+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "77637ffa-f27b-4c21-8688-9fc4949c6a09", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Incident volume", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:17:14+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-f389-7267-bca0-8098bf8aefea", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.18, "x": 0.15, "y": 0.28 }, "kind": "paragraph", "text": "In December, we saw a marked increase in Insider Threats, DDoS and Sensitive Data Loss incidents, but a decrease in Ransomware, Email Compromise, Network Intrusion and Unauthorized Access matters compared to the previous month.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:46.737+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "52275e20-78c2-4798-ae0e-bd916d804a34", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.15, "x": 0.15, "y": 0.18 }, "kind": "title", "text": "Monthly Incident Metrics", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:46.737+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1f503f3c-57be-40fa-9236-86330630cf44", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Chart Selection Guide", "slug": "chart-selection-guide", "status": "active", "bestFor": null, "canonId": "019dd956-b1a0-700b-ba17-0e16c4d5bcae", "version": 1, "bodyDocId": null, "description": "Choosing the right chart type for your data and message", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "27987413-1525-478d-848e-7a024f30240b", "evidence": "chart/donut: Incidents by Industry - December 2024", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.5, "extraction": { "at": "2026-07-16 21:28:10.125144+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 2, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 4, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 1, "name": "Current State", "beatId": "a763e876-23f9-4df3-9ba8-d06c3d4c89a9", "matchId": "64c1bc16-4180-4b57-86e1-932c4ab10292", "beatType": { "name": "What Is", "slug": "sparkline-what-is-1", "status": "active", "canonId": "019dd9b8-25d5-7468-8649-454886d75343", "version": 1, "description": null }, "evidence": "Monthly Incident Metrics, Incident YTD Trends, Threat Actor YTD Trends", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 3, "type": "analysis", "title": "The slide uses 100% stacked bar charts to show composition over time.", "function": "analyze_data", "rawType": "kpi_dashboard", "block": null, "metadata": { "slideType": "kpi_dashboard", "slideTypeCanon": { "name": "KPI dashboard", "slug": "kpi_dashboard", "status": "active", "canonId": "019de52d-0be5-7295-af4d-b850fe7b7e65", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "dense", "densityScore": 68, "componentCount": 7, "textChars": 716, "nDataPoints": 24, "notes": "The slide uses 100% stacked bar charts to show composition over time.", "elementsJson": [ "bar_chart_100pct", "bar_chart_100pct", "paragraph", "logo_grid" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:49:54.395+00", "seconds": 13.394, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a166-0ebac6399c4f/3", "deck": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f", "deckAnchor": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f#slide-3", "deckJson": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Ransomware matters have dominated our case load and have been between ~30% to ~50% of the total incident volume, followed by Email Compromise making up ~10% to ~40% of the total incident volume.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:17:08+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-f389-7267-bc9f-3b4b0888be0c", "parentComponentId": null }, { "bbox": { "h": 0.7, "w": 0.28, "x": 0.38, "y": 0.1 }, "kind": "chart", "text": "Incidents by Types – 2024 YTD", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Stacked bar chart (100%)", "slug": "bar-stacked-100pct", "status": "active", "canonId": "019de52c-ff14-71b8-8d88-860f8d7da84b", "version": 1, "description": null }, "framework": null }, "subkind": "bar-stacked-100pct", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:54.395+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3a4a1b88-6432-4c67-8444-e9346f95e64d", "parentComponentId": null }, { "bbox": { "h": 0.7, "w": 0.28, "x": 0.68, "y": 0.1 }, "kind": "chart", "text": "Incidents by Industry – 2024 YTD", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Stacked bar chart (100%)", "slug": "bar-stacked-100pct", "status": "active", "canonId": "019de52c-ff14-71b8-8d88-860f8d7da84b", "version": 1, "description": null }, "framework": null }, "subkind": "bar-stacked-100pct", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:54.395+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "87bd20b9-ba0e-49a5-bb4a-efe729806fff", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Incident volume distribution", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:17:08+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-f389-7267-bc9f-3fb1fb46f500", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.2, "x": 0.15, "y": 0.62 }, "kind": "paragraph", "text": "The top five most impacted sectors are consistently across Manufacturing, Financial Services, Construction, Healthcare and Legal organizations, making up between ~50% to ~70% of our caseload each month.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:54.395+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "71bc3ee3-9fd4-4774-a171-bbf2ca2956bb", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.2, "x": 0.15, "y": 0.28 }, "kind": "paragraph", "text": "For 2024 overall, Ransomware matters have dominated our case load and have been between ~30% to ~50% of the total incident volume, followed by Email Compromise making up ~10% to ~40% of the total incident volume.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:54.395+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d789fa1d-0d24-41ff-9883-4ab78e68ee51", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.15, "x": 0.15, "y": 0.18 }, "kind": "title", "text": "Incident YTD Trends", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:54.395+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1631a096-5886-4cea-83d7-55567e507d97", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 4, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 1, "name": "Current State", "beatId": "a763e876-23f9-4df3-9ba8-d06c3d4c89a9", "matchId": "64c1bc16-4180-4b57-86e1-932c4ab10292", "beatType": { "name": "What Is", "slug": "sparkline-what-is-1", "status": "active", "canonId": "019dd9b8-25d5-7468-8649-454886d75343", "version": 1, "description": null }, "evidence": "Monthly Incident Metrics, Incident YTD Trends, Threat Actor YTD Trends", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 4, "type": "analysis", "title": "The chart displays a high-density legend with 50+ threat actor categories mapped to colors.", "function": "analyze_data", "rawType": "kpi_dashboard", "block": null, "metadata": { "slideType": "kpi_dashboard", "slideTypeCanon": { "name": "KPI dashboard", "slug": "kpi_dashboard", "status": "active", "canonId": "019de52d-0be5-7295-af4d-b850fe7b7e65", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "dense", "densityScore": 58, "componentCount": 6, "textChars": 596, "nDataPoints": 144, "notes": "The chart displays a high-density legend with 50+ threat actor categories mapped to colors.", "elementsJson": [ "headline_text", "bar_chart_100pct", "paragraph", "icon_grid" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:49:44.3+00", "seconds": 2.73, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a166-0ebac6399c4f/4", "deck": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f", "deckAnchor": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f#slide-4", "deckJson": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "In Q4 2024, we observed Akira, Blacksuit, RansomHub, Black Basta Group Akira, Play Ransomware Group, Rhysida, CLOP and Frag Threat Actor Groups dominate the Ransomware landscape.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:17:17+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-f389-7267-bca0-b446a25ccbe4", "parentComponentId": null }, { "bbox": { "h": 0.65, "w": 0.55, "x": 0.4, "y": 0.1 }, "kind": "chart", "text": "Threat Actors 2024 YTD", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Stacked bar chart (100%)", "slug": "bar-stacked-100pct", "status": "active", "canonId": "019de52c-ff14-71b8-8d88-860f8d7da84b", "version": 1, "description": null }, "framework": null }, "subkind": "bar-stacked-100pct", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:44.3+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5195f7c9-cad8-45cd-9a6b-5bf5a335211d", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.55, "x": 0.4, "y": 0.75 }, "kind": "list", "text": "Legend of threat actors", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:44.3+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bc4a3615-8298-41c6-a7f1-2113c5c91bb7", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Threat actor activity share", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:17:17+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-f389-7267-bca0-b807c067c5c6", "parentComponentId": null }, { "bbox": { "h": 0.3, "w": 0.2, "x": 0.15, "y": 0.28 }, "kind": "paragraph", "text": "In Q4 2024, we observed Akira, Blacksuit, RansomHub, Black Basta Group Akira, Play Ransomware Group, Rhysida, CLOP and Frag Threat Actor Groups dominate the Ransomware landscape. Additionally, in Q4 2024, we observed a few new Threat Actor groups such as CLOP, Schrodingercat, Abyss Locker and Cactus impacting our clients.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:44.3+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "59500d55-dbb3-4e3b-a8d5-58031f5c1bff", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.2, "x": 0.15, "y": 0.18 }, "kind": "title", "text": "Threat Actor YTD Trends", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:44.3+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ef969226-bc69-4ac1-aa20-8673038909b8", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 4, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 1, "name": "Current State", "beatId": "a763e876-23f9-4df3-9ba8-d06c3d4c89a9", "matchId": "64c1bc16-4180-4b57-86e1-932c4ab10292", "beatType": { "name": "What Is", "slug": "sparkline-what-is-1", "status": "active", "canonId": "019dd9b8-25d5-7468-8649-454886d75343", "version": 1, "description": null }, "evidence": "Monthly Incident Metrics, Incident YTD Trends, Threat Actor YTD Trends", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 5, "type": "analysis", "title": "The slide uses horizontal bar charts to compare ransom amounts across two quarters.", "function": "analyze_data", "rawType": "data_table", "block": null, "metadata": { "slideType": "data_table", "slideTypeCanon": { "name": "Data table", "slug": "data_table", "status": "active", "canonId": "019de52d-0bbd-71b9-9918-417f904abbf8", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "dense", "densityScore": 66, "componentCount": 7, "textChars": 644, "nDataPoints": 26, "notes": "The slide uses horizontal bar charts to compare ransom amounts across two quarters.", "elementsJson": [ "bar_chart_horizontal", "bar_chart_horizontal", "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:49:44.299+00", "seconds": 2.525, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a166-0ebac6399c4f/5", "deck": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f", "deckAnchor": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f#slide-5", "deckJson": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "The ransom demand data for Q4 is heavily skewed by a threat actor making a 9-digit ransom demand for a single matter.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:17:07+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-f389-7267-bc9f-1c5471335e2f", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.75, "x": 0.2, "y": 0.05 }, "kind": "chart", "text": "2024 Q4 (October, November, December) ransom demands", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Horizontal bar chart", "slug": "bar-horizontal", "status": "active", "canonId": "019de52c-fec4-7221-986b-1cb5f5e84b1f", "version": 1, "description": null }, "framework": null }, "subkind": "bar-horizontal", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:44.299+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6429456e-d5f1-4b0f-b0b7-514cd21be245", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.75, "x": 0.2, "y": 0.5 }, "kind": "chart", "text": "2024 Q3 (July, August, September) ransom demands", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Horizontal bar chart", "slug": "bar-horizontal", "status": "active", "canonId": "019de52c-fec4-7221-986b-1cb5f5e84b1f", "version": 1, "description": null }, "framework": null }, "subkind": "bar-horizontal", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:44.299+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "faf9de52-e5ec-4805-844d-3c025428d932", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Ransom Demand: $131,270,000", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:17:07+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-f389-7267-bc9f-21c3a3df21ba", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.15, "x": 0.05, "y": 0.25 }, "kind": "paragraph", "text": "In Q42024, Blacksuit, RansomHub, Black Basta Group, Akira, Frag, Cactus Play Ransomware Group, Abyss Locker and Monti have led on ransom demands. The ransom demand data for Q4 is heavily skewed by a threat actor making a 9-digit ransom demand for a single matter.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:44.299+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "91ae981d-19b5-40fc-bf14-554096e1e4fe", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.15, "x": 0.05, "y": 0.55 }, "kind": "paragraph", "text": "In Q3 2024, Play Ransomware Group, FOG, RansomHub, Rhysida, Blacksuit and Akira have led on ransom demands.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:44.299+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9f65a5ad-48c3-402c-889e-0582dba3db66", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.15, "x": 0.05, "y": 0.18 }, "kind": "title", "text": "Ransom Demand By Threat Actors", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:44.299+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5bba0c1b-ca07-4d22-a91c-77ea6c6e551f", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 8, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 5, "name": "Detailed Analysis", "beatId": "fd216dee-a04f-45b2-9de2-82ba6d2fc640", "matchId": "64c1bc16-4180-4b57-86e1-932c4ab10292", "beatType": { "name": "What Is", "slug": "sparkline-what-is-3", "status": "active", "canonId": "019dd9b8-2701-72ba-a477-4121f4fb5d33", "version": 1, "description": null }, "evidence": "Ransom Demand By Threat Actors, Underwriting Focus Area – Top 10 Security Controls", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 6, "type": "analysis", "title": "The slide uses horizontal bar charts to visualize the magnitude of ransom demands for different threat groups in two separate quarters.", "function": "analyze_data", "rawType": "data_table", "block": null, "metadata": { "slideType": "data_table", "slideTypeCanon": { "name": "Data table", "slug": "data_table", "status": "active", "canonId": "019de52d-0bbd-71b9-9918-417f904abbf8", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "dense", "densityScore": 50, "componentCount": 6, "textChars": 457, "nDataPoints": 18, "notes": "The slide uses horizontal bar charts to visualize the magnitude of ransom demands for different threat groups in two separate quarters.", "elementsJson": [ "bar_chart_horizontal", "bar_chart_horizontal", "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:49:46.802+00", "seconds": 5.009, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a166-0ebac6399c4f/6", "deck": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f", "deckAnchor": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f#slide-6", "deckJson": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "In Q2 2024, RansomHub, Medusa, Rhysida, and Radar and Dispossessor Team led on ransom demands.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:17:16+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-f389-7267-bca0-9912fbfb5f0d", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.8, "x": 0.18, "y": 0.05 }, "kind": "chart", "text": "2024 Q2 (April, May, June) ransom demands by actor", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Horizontal bar chart", "slug": "bar-horizontal", "status": "active", "canonId": "019de52c-fec4-7221-986b-1cb5f5e84b1f", "version": 1, "description": null }, "framework": null }, "subkind": "bar-horizontal", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:46.802+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c71cf3a6-0456-4c7c-b8d6-d80a49a05ade", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.8, "x": 0.18, "y": 0.52 }, "kind": "chart", "text": "2024 Q1 (January, February, March) ransom demands by actor", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Horizontal bar chart", "slug": "bar-horizontal", "status": "active", "canonId": "019de52c-fec4-7221-986b-1cb5f5e84b1f", "version": 1, "description": null }, "framework": null }, "subkind": "bar-horizontal", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:46.802+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c924fd64-1cc2-4998-91a6-73ae24566899", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Ransom Demand Amount: $30,000,000", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:17:16+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-f389-7267-bca0-9fe3377c9dd4", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.15, "x": 0.15, "y": 0.28 }, "kind": "paragraph", "text": "In Q2 2024, RansomHub, Medusa, Rhysida, and Radar and Dispossessor Team led on ransom demands. For Q1 2024, Play Ransomware Group, Lockbit, Akira and Ransomhouse led on ransom demands.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:46.802+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "eabcf6f2-da92-4a14-adda-8304ab536cbc", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.15, "x": 0.15, "y": 0.18 }, "kind": "title", "text": "Ransom Demand By Threat Actors (cont.)", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:46.802+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3f29b6be-0a62-4b18-b3da-c5e3436c81b4", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 8, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 5, "name": "Detailed Analysis", "beatId": "fd216dee-a04f-45b2-9de2-82ba6d2fc640", "matchId": "64c1bc16-4180-4b57-86e1-932c4ab10292", "beatType": { "name": "What Is", "slug": "sparkline-what-is-3", "status": "active", "canonId": "019dd9b8-2701-72ba-a477-4121f4fb5d33", "version": 1, "description": null }, "evidence": "Ransom Demand By Threat Actors, Underwriting Focus Area – Top 10 Security Controls", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 7, "type": "setup", "title": "Part of a series; continues from a previous slide covering controls #1-5.", "function": "present_solution", "rawType": "initiative_list", "block": null, "metadata": { "slideType": "initiative_list", "slideTypeCanon": { "name": "Initiative list", "slug": "initiative_list", "status": "active", "canonId": "019de52d-0caf-770e-9b91-b99239121f50", "version": 1, "description": null }, "function": "present_solution", "functionCanon": { "name": "Present solution", "slug": "present_solution", "status": "active", "canonId": "019de52d-15b8-71da-bd23-2b767850cbce", "version": 1, "description": null }, "density": "balanced", "densityScore": 39, "componentCount": 5, "textChars": 575, "nDataPoints": 0, "notes": "Part of a series; continues from a previous slide covering controls #1-5.", "elementsJson": [ "bullet_list" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:49:45.167+00", "seconds": 3.263, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a166-0ebac6399c4f/7", "deck": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f", "deckAnchor": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f#slide-7", "deckJson": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f.json" }, "components": [ { "bbox": { "h": 0.35, "w": 0.35, "x": 0.2, "y": 0.6 }, "kind": "list", "text": "7) Event Logging: Recommends SIEM solutions, proper log preservation, and recording detailed session information.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:45.167+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0bf0c73f-acc7-41b3-a02e-c7f5d37d86bb", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.35, "x": 0.2, "y": 0.08 }, "kind": "list", "text": "6) Password and End-User Account Management: Emphasizes active user management, strong password policies, and group privilege control.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:45.167+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "84dac8ba-b861-430b-b173-c0d5862503c9", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.35, "x": 0.6, "y": 0.5 }, "kind": "list", "text": "8) Backups: Advises on both onsite and offsite storage to protect against encryption or deletion by threat actors.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:45.167+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "da18b93b-e801-401d-bb59-bad8f09febea", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.15, "x": 0.02, "y": 0.18 }, "kind": "paragraph", "text": "IR Update Summary: Read on for a summary of our Incident Response team's recent observations alongside insights from across the cybersecurity community.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:45.167+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "648864e9-451d-43ca-befb-24fd03fe59c6", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.4, "x": 0.2, "y": 0.03 }, "kind": "title", "text": "Underwriting Focus Area – Top 10 Security Controls - #6 to #10", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:45.167+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f4ef8f58-addd-49bc-bfcb-bbda6abf61ff", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 8, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 5, "name": "Detailed Analysis", "beatId": "fd216dee-a04f-45b2-9de2-82ba6d2fc640", "matchId": "64c1bc16-4180-4b57-86e1-932c4ab10292", "beatType": { "name": "What Is", "slug": "sparkline-what-is-3", "status": "active", "canonId": "019dd9b8-2701-72ba-a477-4121f4fb5d33", "version": 1, "description": null }, "evidence": "Ransom Demand By Threat Actors, Underwriting Focus Area – Top 10 Security Controls", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 8, "type": "setup", "title": "The slide is part of a series, continuing from a previous slide covering controls #1-5.", "function": "present_solution", "rawType": "initiative_list", "block": null, "metadata": { "slideType": "initiative_list", "slideTypeCanon": { "name": "Initiative list", "slug": "initiative_list", "status": "active", "canonId": "019de52d-0caf-770e-9b91-b99239121f50", "version": 1, "description": null }, "function": "present_solution", "functionCanon": { "name": "Present solution", "slug": "present_solution", "status": "active", "canonId": "019de52d-15b8-71da-bd23-2b767850cbce", "version": 1, "description": null }, "density": "dense", "densityScore": 63, "componentCount": 6, "textChars": 3019, "nDataPoints": 0, "notes": "The slide is part of a series, continuing from a previous slide covering controls #1-5.", "elementsJson": [ "headline_text", "bullet_list" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:49:50.874+00", "seconds": 8.781, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a166-0ebac6399c4f/8", "deck": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f", "deckAnchor": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f#slide-8", "deckJson": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Immutable backups are preferred as they can not be deleted or changed.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:17:08+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-f389-7267-bc9f-7f0bfaef258e", "parentComponentId": null }, { "bbox": { "h": 0.82, "w": 0.38, "x": 0.61, "y": 0.11 }, "kind": "list", "text": "10) Incident Response Planning and Testing\n- Have a written plan in-place covering all aspects of IT staff responsibility in the event of an incident.\n- Conduct testing and simulation of an incident with the personnel who would be involved in the response.\n- Ensure IT personnel have 24x7 contact information for decision makers. Time is critical during an active incident. The decision makers will need to have the correct information quickly to assess initial steps such as whether to disconnect systems, isolate systems or completely disconnect the company from the internet.\n- Preservation of evidence is key to a forensic investigation which may be needed to assess potential notification obligations. Make sure IT staff knows which tools are available for system preservation and are trained on them. Look at having additional storage on-hand if compromised virtual machines need to be offloaded or disk images need to be created.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:50.874+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4692231c-fe62-42c8-b604-59e454584fd0", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.38, "x": 0.21, "y": 0.11 }, "kind": "list", "text": "8) Backups (cont.)\n- If backups are stored offsite, check if the storage provider retains backups copies and if there are protections in-place to prevent deletion of the backups. Immutable backups are preferred as they can not be deleted or changed. Ensure the backups cannot be deleted as a result of an email or telephone call without some type of additional verification. A verification password is not a good verification option if it is stored in the company network or email system.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:50.874+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a6f9d618-a74f-46ab-8f9d-39f1bdb44ea8", "parentComponentId": null }, { "bbox": { "h": 0.52, "w": 0.38, "x": 0.21, "y": 0.42 }, "kind": "list", "text": "9) Know your environment/Asset List/Software list/RMM & RDP Tools\n- Have a network diagram and asset list for all systems in the corporate network. Keep both up to date as network changes are made and as new devices are added or retired.\n- Have a list of authorized software in the environment. Review the network regularly for unauthorized software and uninstall it. Remove software which is no longer used or needed. Particular attention should be paid to tools which threat actors can use to \"live off the land\". This includes RMM tools, data transfer tools and network reconnaissance tools.\n- Only use approved Remote Monitoring and Management tools (RMM). Ensure the software requires multi-factor authentication, if available. Do not allow employees to install their own RMM tools. Require employees needing remote access to only use approved methods with the necessary safeguards in-place.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:50.874+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c7b55b5d-a9e3-429e-931f-e11e4c3776f3", "parentComponentId": null }, { "bbox": { "h": 0.75, "w": 0.17, "x": 0.02, "y": 0.18 }, "kind": "paragraph", "text": "IR Update Summary\nRead on for a summary of our Incident Response team's recent observations alongside insights from across the cybersecurity community. The information shared here is intended to provide a snapshot of current activity and is subject to change as the various threat group tactics, techniques, and procedures evolve.\nHighlights\nUnderwriting Focus Area – Top 10 Security Controls. Last month we covered the top 5 security controls for underwriting focus. This month we highlight the remaining 5 security controls to round out the top 10 controls.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:50.874+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5bb56430-1a2b-4e93-ab54-b5ea645bc150", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.5, "x": 0.21, "y": 0.03 }, "kind": "title", "text": "Underwriting Focus Area – Top 10 Security Controls - #6 to #10 (cont.)", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:50.874+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "44dc0fe9-8a50-4ed8-b197-eabc141ae769", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 8, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 5, "name": "Detailed Analysis", "beatId": "fd216dee-a04f-45b2-9de2-82ba6d2fc640", "matchId": "64c1bc16-4180-4b57-86e1-932c4ab10292", "beatType": { "name": "What Is", "slug": "sparkline-what-is-3", "status": "active", "canonId": "019dd9b8-2701-72ba-a477-4121f4fb5d33", "version": 1, "description": null }, "evidence": "Ransom Demand By Threat Actors, Underwriting Focus Area – Top 10 Security Controls", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 9, "type": "setup", "title": "The slide uses a dark-themed layout typical of Booz Allen consulting decks.", "function": "summarize", "rawType": "executive_summary", "block": null, "metadata": { "slideType": "executive_summary", "slideTypeCanon": { "name": "Executive summary", "slug": "executive_summary", "status": "active", "canonId": "019de52d-06be-73ff-81b3-f99fe7f0025e", "version": 1, "description": null }, "function": "summarize", "functionCanon": { "name": "Summarize", "slug": "summarize", "status": "active", "canonId": "019de52d-1541-704f-b86f-bf7b75056373", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 91, "componentCount": 11, "textChars": 1466, "nDataPoints": 5, "notes": "The slide uses a dark-themed layout typical of Booz Allen consulting decks.", "elementsJson": [ "logo_grid", "bullet_list", "map", "icon_grid" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:49:45.726+00", "seconds": 3.453, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a166-0ebac6399c4f/9", "deck": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f", "deckAnchor": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f#slide-9", "deckJson": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f.json" }, "components": [ { "bbox": { "h": 0.2, "w": 0.2, "x": 0.57, "y": 0.72 }, "kind": "callout", "text": "Technical Depth & Breadth: Expertise in building, enhancing, and scaling security across the enterprise from AI to Zero-Trust and everything in between", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": null, "subkind": { "name": "Primary callout", "slug": "primary", "status": "active", "canonId": "019de52c-fbd1-70eb-a9ce-8997f8674c1d", "version": 1, "description": null }, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:45.726+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3fb9dfc1-9cf0-42e8-a3c9-24d84cd802d8", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.2, "x": 0.34, "y": 0.72 }, "kind": "callout", "text": "Outcome Driven: A robust portfolio of cyber capabilities with a practitioner-led approach, rooted in a 110-year-old consulting heritage to solve complex challenges faced by the global private sector", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": null, "subkind": { "name": "Primary callout", "slug": "primary", "status": "active", "canonId": "019de52c-fbd1-70eb-a9ce-8997f8674c1d", "version": 1, "description": null }, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:45.726+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4e041a1c-fa19-4cb9-812e-fb47491310df", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.2, "x": 0.79, "y": 0.72 }, "kind": "callout", "text": "Adversary Informed: Real-time insights into criminal and nation-state adversaries to drive effective tactical and strategic decision-making", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": null, "subkind": { "name": "Primary callout", "slug": "primary", "status": "active", "canonId": "019de52c-fbd1-70eb-a9ce-8997f8674c1d", "version": 1, "description": null }, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:45.726+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5dbdcc1b-fd34-4587-957b-efa4645068a6", "parentComponentId": null }, { "bbox": null, "kind": "callout", "text": "Business insight meets cybersecurity innovation to reduce enterprise cyber risk, leveraging advanced tradecraft and a practitioner-led approach across a variety of industry sectors across the globe.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:17:09+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-f389-7267-bc9f-98facf6f50f5", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.15, "x": 0.83, "y": 0.16 }, "kind": "image", "text": "Global map graphic", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Map", "slug": "map", "status": "active", "canonId": "019de52c-fe4d-77bd-b0a4-d72d58b9e5a4", "version": 1, "description": null }, "framework": null }, "subkind": "map", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:45.726+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "783712b3-ddfb-4ff3-9cc8-444e26562a4a", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.18, "x": 0.42, "y": 0.38 }, "kind": "list", "text": "Financial Services; Health & Life Sciences; Energy & Utilities; Software & Hi-Tech; Manufacturing, Automotive & Airlines; Retail & Hospitality; Maritime & Transportation", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:45.726+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0c40f9d1-8c19-4fbc-8749-1bbf69100a89", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.2, "x": 0.2, "y": 0.38 }, "kind": "list", "text": "7,000+ Cyber Subject Matter Experts; 6,441 Cyber Certifications; 2 NSA Accreditations; 4 CREST Certifications; 1,000+ Annual IR Engagements", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:45.726+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5c887c7f-7622-4c93-98b3-18ca0f8a118f", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.35, "x": 0.63, "y": 0.42 }, "kind": "list", "text": "Frost & Sullivan 3x consecutive; Forrester Cybersecurity Incident Response Wave Strong Performer; Gartner Digital Forensics & Incident Response Market Guide; IDC Market Scape US Incident Response Leader", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:45.726+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9f06f80e-d8f1-4649-8e2e-706634f41cbf", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Cyber Subject Matter Experts: 7,000+", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:17:09+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-f389-7267-bc9f-9c142574c64a", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.15, "x": 0.05, "y": 0.28 }, "kind": "paragraph", "text": "Business insight meets cybersecurity innovation to reduce enterprise cyber risk, leveraging advanced tradecraft and a practitioner-led approach across a variety of industry sectors across the globe", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:45.726+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bd8f87eb-0df0-43a0-9960-c78dab86b1ae", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.15, "x": 0.05, "y": 0.18 }, "kind": "title", "text": "Booz Allen Overview", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:45.726+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "49ccca28-8a51-42d8-a81b-27d37683105f", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 10, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 9, "name": "Conclusion", "beatId": "8ab5636d-4beb-4997-9849-bff010a10dbf", "matchId": "64c1bc16-4180-4b57-86e1-932c4ab10292", "beatType": { "name": "New Bliss", "slug": "sparkline-new-bliss", "status": "active", "canonId": "019dd9b8-2879-72f7-8968-bcfac0921b99", "version": 1, "description": null }, "evidence": "Booz Allen Overview, INCIDENT RESPONSE CONTACT DETAILS", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 10, "type": "appendix", "function": "other", "rawType": "appendix", "block": null, "metadata": { "slideType": "appendix", "slideTypeCanon": { "name": "Appendix", "slug": "appendix", "status": "active", "canonId": "019de52d-0762-71f8-b564-89ab863301cc", "version": 1, "description": null }, "function": "other", "functionCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-15e1-75bc-99dc-07732380e2ce", "version": 1, "description": null }, "density": "dense", "densityScore": 61, "componentCount": 9, "textChars": 433, "nDataPoints": 0, "notes": null, "elementsJson": [ "headline_text", "paragraph", "screenshot", "headshot", "logo_grid" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:49:44.971+00", "seconds": 2.672, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a166-0ebac6399c4f/10", "deck": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f", "deckAnchor": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f#slide-10", "deckJson": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Signup to receive our IR update communications.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:17:08+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-f389-7267-bc9f-5822e251a7fa", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.15, "x": 0.45, "y": 0.6 }, "kind": "image", "text": "Tony Gaidhane", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Headshot", "slug": "headshot", "status": "active", "canonId": "019de52c-fd5f-765c-9282-38b54f61bbbf", "version": 1, "description": null }, "framework": null }, "subkind": "headshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:44.971+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bf27a3ec-a343-45aa-8db1-a8c6517e1ac6", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.15, "x": 0.05, "y": 0.6 }, "kind": "image", "text": "Brendan Rooney", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Headshot", "slug": "headshot", "status": "active", "canonId": "019de52c-fd5f-765c-9282-38b54f61bbbf", "version": 1, "description": null }, "framework": null }, "subkind": "headshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:44.971+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e1e1cbbb-73bf-4734-a74f-c1ada4d6c69e", "parentComponentId": null }, { "bbox": { "h": 0.45, "w": 0.15, "x": 0.845, "y": 0.05 }, "kind": "image", "text": "Mobile signup page screenshot", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:44.971+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b23bc065-07c1-485f-a68f-b3756f28d806", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.15, "x": 0.6, "y": 0.7 }, "kind": "paragraph", "text": "Tony Gaidhane\nVice President\nGlobal Incident Response", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:44.971+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "05c09f41-6490-49a6-b5b7-8ced6a900f65", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.35, "x": 0.05, "y": 0.4 }, "kind": "paragraph", "text": "Email: incident@bah.com\nU.S. Hotline: +1 (888) 266-9478 “BOOZ-IRT”\nUK/EU Hotline: +44 (808) 296-8080", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:44.971+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "238228ac-a678-4d53-803f-e76ede61adcf", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.15, "x": 0.2, "y": 0.7 }, "kind": "paragraph", "text": "Brendan Rooney\nSenior Vice President\nGlobal Incident Response", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:44.971+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "93177ce7-4dca-43db-8c05-30bcd7eb64cc", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.25, "x": 0.715, "y": 0.35 }, "kind": "paragraph", "text": "Signup to receive our IR update communications.\ninfo.boozallen.com/IR_Update_Signup", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:44.971+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bede6bb8-352d-4efd-86df-fb157474764d", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.4, "x": 0.05, "y": 0.35 }, "kind": "title", "text": "INCIDENT RESPONSE CONTACT DETAILS", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:49:44.971+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "95d63213-409c-45b2-b961-aa6a59096d49", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 10, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 9, "name": "Conclusion", "beatId": "8ab5636d-4beb-4997-9849-bff010a10dbf", "matchId": "64c1bc16-4180-4b57-86e1-932c4ab10292", "beatType": { "name": "New Bliss", "slug": "sparkline-new-bliss", "status": "active", "canonId": "019dd9b8-2879-72f7-8968-bcfac0921b99", "version": 1, "description": null }, "evidence": "Booz Allen Overview, INCIDENT RESPONSE CONTACT DETAILS", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true } ], "arcBeats": [ { "from": 1, "to": 4, "label": "Current State", "description": "Monthly Incident Metrics, Incident YTD Trends, Threat Actor YTD Trends" }, { "from": 5, "to": 8, "label": "Detailed Analysis", "description": "Ransom Demand By Threat Actors, Underwriting Focus Area – Top 10 Security Controls" }, { "from": 9, "to": 10, "label": "Conclusion", "description": "Booz Allen Overview, INCIDENT RESPONSE CONTACT DETAILS" } ], "loops": [] }