{ "schemaVersion": "deck-intelligence.v1", "id": "019dd923-5de0-76bd-a169-54303fbbe19b", "slug": "0ec770bd87313ce8", "title": "The CEO’s Guide to Cybersecurity", "subtitle": "BCG", "author": "BCG", "pageCount": 15, "kind": "consulting-deck", "orientation": "portrait", "aspectRatio": 0.784, "document": { "id": "019dd923-5de0-76bd-a169-54303fbbe19b", "slug": "0ec770bd87313ce8", "title": "The CEO’s Guide to Cybersecurity", "rawTitle": "The CEO’s Guide to Cybersecurity", "authorId": "BCG", "authorName": null, "authorDisplay": "BCG", "kind": { "slug": "consulting-deck", "label": "Consulting deck" }, "sourceType": { "slug": "strategy_consulting", "label": "Strategy consulting" }, "fileName": "BCG-Executive-Perspectives-CEO-Guide-to-Cybersecurity.pdf", "sourceUrl": "https://media-publications.bcg.com/BCG-Executive-Perspectives-CEO-Guide-to-Cybersecurity.pdf", "sourceDate": null, "presentationDate": null, "ingestedAt": "2026-04-24 13:06:08+00", "status": "ready", "pageCount": 15, "orientation": "portrait", "aspectRatio": 0.784, "targetCompany": null, "targetTicker": null, "metadata": { "local_root": "/tmp/legacy-images/0ec770bd87313ce8", "origin_corpus": "consulting" } }, "coverage": { "pageCount": 15, "pagesIndexed": 15, "pagesWithImages": 15, "pagesWithMetadata": 15, "imageCoveragePct": 100, "metadataCoveragePct": 100, "componentCount": 92, "chartCount": 0, "metricSlides": 0, "toolMatches": 46, "documentToolMatches": 0, "frameworkMatches": 2, "arcMatches": 1, "beatMatches": 5, "loopMatches": 2, "patternMatches": 0, "storymakersMatch": true, "scoreAvailable": true, "reviewAvailable": true, "activistThesisAvailable": false, "pitchdeckMetadataAvailable": false, "pitchdeckProfileAvailable": false }, "blocks": [], "matches": { "arcs": [ { "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null, "categoryName": "Strategy & Business", "categorySlug": "strategy-business" }, "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "evidence": "Hook + context (p1-3) frames cybersecurity stakes; Q1-6 probe problems (p4-9); Q7-8 propose measurement/budget approach (p10-11); Q9-10 supply expert evidence on outlook/talent (p12-13); Q11 + advisor authority close (p14-15).", "isPrimary": true, "confidence": 55, "extraction": { "at": "2026-04-29 13:07:28.977035+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null } } ], "beats": [ { "to": 3, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null, "categoryName": "Strategy & Business", "categorySlug": "strategy-business" }, "from": 1, "name": "Situation & Context", "beatId": "019dd95a-0702-74a3-87e1-64c707d12a09", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Situation & Context", "slug": "consultants-gambit-situation-context", "status": "active", "canonId": "019dd9b8-05ae-741b-992d-65ee83c639b3", "version": 1, "description": null }, "evidence": "Cover hook 'Are We Safe?', TOC, intro on why CEOs must ask these questions", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 55 }, { "to": 9, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null, "categoryName": "Strategy & Business", "categorySlug": "strategy-business" }, "from": 4, "name": "Problem & Complication", "beatId": "019dd95a-0702-74a3-87e1-68abc4f9b35a", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "Questions 1-6 enumerate exposure: assets, education, strategy, attack vectors, recovery, prevention", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 55 }, { "to": 11, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null, "categoryName": "Strategy & Business", "categorySlug": "strategy-business" }, "from": 10, "name": "Solution & Approach", "beatId": "019dd95a-0702-74a3-87e1-6dec5482820e", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "Q7-8 prescribe measurement program and budget allocation method", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 55 }, { "to": 13, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null, "categoryName": "Strategy & Business", "categorySlug": "strategy-business" }, "from": 12, "name": "Evidence & Proof", "beatId": "019dd95a-0702-74a3-87e1-717aa3475ad1", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Evidence & Proof", "slug": "consultants-gambit-evidence-proof", "status": "active", "canonId": "019dd9b8-07b1-7688-8e1e-7637fec3802a", "version": 1, "description": null }, "evidence": "Q9-10 cite expert guidance on threat outlook and talent strategy", "position": 4, "isPrimaryArc": true, "parentBeatType": { "name": "Evidence", "slug": "evidence", "status": "active", "canonId": "019dd9b8-03f9-772a-b84a-4f07b415b77a", "version": 1, "description": "A dedicated proof beat exists in only ~4 arcs (Gambit, Sequoia, AIDA, Monroes). Other arcs embed evidence inline within development." }, "alignedBlockIds": null, "matchConfidence": 55 }, { "to": 15, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null, "categoryName": "Strategy & Business", "categorySlug": "strategy-business" }, "from": 14, "name": "Impact & Next Steps", "beatId": "019dd95a-0702-74a3-87e1-75a62047f8be", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "Q11 culture-of-resilience close + CompTIA advisor authority backstop", "position": 5, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 55 } ], "loops": [ { "to": 9, "from": 3, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null, "categoryName": "Consulting Framework", "categorySlug": "consulting-framework" }, "matchId": "019dd95a-088c-724c-b30d-fd91b0cb420d", "evidence": "Intro frames the question set, then six distinct, non-overlapping diagnostic questions (assets, training, strategy, attack vectors, recovery, prevention)", "position": 1, "objective": "Enumerate the foundational cybersecurity readiness questions a CEO must diagnose", "confidence": 70, "extraction": { "at": "2026-04-29 13:07:29.689431+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null } }, { "to": 14, "from": 10, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null, "categoryName": "Consulting Framework", "categorySlug": "consulting-framework" }, "matchId": "019dd95a-088c-724c-b30e-0316b53f0e64", "evidence": "Q7-Q11 cover distinct management levers: measurement, budget, threat outlook, talent, current risks", "position": 2, "objective": "Enumerate the operational/strategic management dimensions of a cybersecurity program", "confidence": 65, "extraction": { "at": "2026-04-29 13:07:29.689431+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null } } ], "tools": [ { "tool": { "name": "Curiosity Gap", "slug": "curiosity-gap", "status": "active", "bestFor": null, "canonId": "019dd956-9703-74ef-8b85-96dfd8525025", "version": 1, "bodyDocId": null, "description": "People seek missing information - create open questions that demand resolution", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Storyteller", "layer": "block", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f5-72a3-8b96-15b026b160d8", "evidence": "Title is a question with no answer on the cover, demanding resolution", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 75, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 1, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Issue Tree", "slug": "issue-tree", "status": "active", "bestFor": null, "canonId": "019dd956-82e3-775d-a2b6-318154564b53", "version": 1, "bodyDocId": null, "description": "Breaking down a problem into component parts systematically", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "block", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-2c15b830cfd1", "evidence": "Decomposes 'Are we safe?' into 11 testable sub-questions", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 60, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 3, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "MECE Principle", "slug": "mece-principle", "status": "active", "bestFor": null, "canonId": "019dd956-7c60-71a8-8758-c79d914489c9", "version": 1, "bodyDocId": null, "description": "Mutually Exclusive, Collectively Exhaustive - ensuring complete, non-overlapping structure", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "block", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-2a0b2ecd6716", "evidence": "Frames the eleven questions as a complete, non-overlapping audit set", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 3, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "MECE Principle", "slug": "mece-principle", "status": "active", "bestFor": null, "canonId": "019dd956-7c60-71a8-8758-c79d914489c9", "version": 1, "bodyDocId": null, "description": "Mutually Exclusive, Collectively Exhaustive - ensuring complete, non-overlapping structure", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "block", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-59c07161b02b", "evidence": "Body breaks recovery into four distinct categories: Incident Response, Disaster Recovery, Business Continuity, Insider Protections", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 75, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 8, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Chunking", "slug": "chunking", "status": "active", "bestFor": null, "canonId": "019dd956-abab-72ce-b64c-2924cc83cf39", "version": 1, "bodyDocId": null, "description": "Information grouped into chunks is remembered better - structure content in digestible units", "familyLabel": null, "categoryName": "Loop", "categorySlug": "loop" }, "agent": "Architect", "layer": "loop", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-17ba63c493e5", "evidence": "TOC chunks the program into 11 numbered, equally-weighted questions", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 2, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Anaphora", "slug": "anaphora", "status": "active", "bestFor": null, "canonId": "019dd956-9fee-74aa-a920-078aa44132c0", "version": 1, "bodyDocId": null, "description": "Repeating words at the beginning of successive clauses for rhythm", "familyLabel": null, "categoryName": "Loop", "categorySlug": "loop" }, "agent": "Storyteller", "layer": "loop", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-25279c3bdcbf", "evidence": "Sets up the 'Are you...? / Why are you...?' repetition pattern reused across questions", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 75, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 3, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Anaphora", "slug": "anaphora", "status": "active", "bestFor": null, "canonId": "019dd956-9fee-74aa-a920-078aa44132c0", "version": 1, "bodyDocId": null, "description": "Repeating words at the beginning of successive clauses for rhythm", "familyLabel": null, "categoryName": "Loop", "categorySlug": "loop" }, "agent": "Storyteller", "layer": "loop", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-73c1a6d91c6b", "evidence": "Continues 'How do you...' question opener pattern across Q7-Q10", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 10, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Emotional Appeal", "slug": "emotional-appeal", "status": "active", "bestFor": null, "canonId": "019dd956-bde9-7668-8be7-0097678fec59", "version": 1, "bodyDocId": null, "description": "Connecting to audience feelings rather than just logic", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f5-72a3-8b96-1197d7a57545", "evidence": "Photo of office team with on-screen breach notification triggers safety concern", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 1, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Opening Hooks", "slug": "opening-hooks", "status": "active", "bestFor": null, "canonId": "019dd956-aeb0-77d5-bfbd-9cd9a6be8186", "version": 1, "bodyDocId": null, "description": "Techniques to capture attention: Startling statistic, provocative question, short story, analogy, contrast", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f5-72a3-8b96-0dc66343eb04", "evidence": "Cover poses provocative question 'Are We Safe?' over team image", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 85, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 1, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Visual Hierarchy", "slug": "visual-hierarchy", "status": "active", "bestFor": null, "canonId": "019dd956-b2ca-706b-937f-e52441086fd7", "version": 1, "bodyDocId": null, "description": "Order of perception through Size > Color > Position > Weight > Space", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "019dd95a-14f5-72a3-8b96-1ac28bc95c4a", "evidence": "Numbered TOC lists all 11 questions with consistent typographic treatment and page anchors", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 75, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 2, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-19a455da6f10", "evidence": "Title 'Cybersecurity Questions that All CEOs Need to Ask' states the slide's payload", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 3, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Authority Bias", "slug": "authority-bias", "status": "active", "bestFor": null, "canonId": "019dd956-c38d-70b9-a284-b2b479763356", "version": 1, "bodyDocId": null, "description": "Expert opinions are weighted more heavily - cite credible sources", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Architect", "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-1fd26932887c", "evidence": "Cites 'CompTIA's Cybersecurity Advisory Council' as the question source", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 3, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Concrete Language", "slug": "concrete-language", "status": "active", "bestFor": null, "canonId": "019dd956-bcd4-7398-9723-6aa72346170b", "version": 1, "bodyDocId": null, "description": "Using specific sensory details instead of abstract terms", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-223e34e04da7", "evidence": "Pulls out 'Are you sure?' / 'Why are you sure?' as concrete baseline questions", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 3, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-31ab61676c58", "evidence": "Title 'Do we keep a live inventory of assets?' states the diagnostic itself", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 85, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 4, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Concrete Language", "slug": "concrete-language", "status": "active", "bestFor": null, "canonId": "019dd956-bcd4-7398-9723-6aa72346170b", "version": 1, "bodyDocId": null, "description": "Using specific sensory details instead of abstract terms", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-3a3745c71afb", "evidence": "Callout names the concrete attributes: 'existence, purpose, location, configuration, age, version'", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 4, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "One Idea Rule", "slug": "one-idea-rule", "status": "active", "bestFor": null, "canonId": "019dd956-b0f0-7630-a2f5-bb38f9bd9c57", "version": 1, "bodyDocId": null, "description": "Each slide should communicate exactly one concept", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "019dd95a-14f6-720d-8375-36c014d5acb8", "evidence": "Whole page is the asset-inventory question and its rationale", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 4, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-3c8b2e8beb3f", "evidence": "Title is the question 'Are my employees properly educated about cybersecurity threats?'", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 85, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 5, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "One Idea Rule", "slug": "one-idea-rule", "status": "active", "bestFor": null, "canonId": "019dd956-b0f0-7630-a2f5-bb38f9bd9c57", "version": 1, "bodyDocId": null, "description": "Each slide should communicate exactly one concept", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "019dd95a-14f6-720d-8375-428201d1ebff", "evidence": "Single question on the page with one supporting principle in the callout", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 5, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-45268491e828", "evidence": "Title 'Does our cybersecurity strategy address business risk? How?' frames the slide", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 85, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 6, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "One Idea Rule", "slug": "one-idea-rule", "status": "active", "bestFor": null, "canonId": "019dd956-b0f0-7630-a2f5-bb38f9bd9c57", "version": 1, "bodyDocId": null, "description": "Each slide should communicate exactly one concept", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "019dd95a-14f6-720d-8375-4a66627c2e2c", "evidence": "Single strategic question per page format", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 6, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-4e909ed2c618", "evidence": "Title is the long question about attack scenarios", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 7, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Concrete Language", "slug": "concrete-language", "status": "active", "bestFor": null, "canonId": "019dd956-bcd4-7398-9723-6aa72346170b", "version": 1, "bodyDocId": null, "description": "Using specific sensory details instead of abstract terms", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-53474b31ba42", "evidence": "Names specific threats: ransomware, data theft, severe disruption and losses", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 7, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-5550f39edc1c", "evidence": "Title 'If we were hit by a major attack, how confident are you that we could recover quickly?'", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 85, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 8, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Audience Definition", "slug": "audience-definition", "status": "active", "bestFor": null, "canonId": "019dd956-7f2a-775d-aeee-ff099bcb7756", "version": 1, "bodyDocId": null, "description": "Six key questions: Who are they? What do they know? What do they believe? What do they care about? What do they fear? What decisions can they make?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "11afde9d-8f67-48fa-a945-98f0f997e4a4", "evidence": "If we were hit by a major attack, how confident are you that we could recover quickly?", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 21:36:27.506056+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 8, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Concrete Language", "slug": "concrete-language", "status": "active", "bestFor": null, "canonId": "019dd956-bcd4-7398-9723-6aa72346170b", "version": 1, "bodyDocId": null, "description": "Using specific sensory details instead of abstract terms", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-5f9c0d855073", "evidence": "Lists four named, defined plan types with specific evidence to demand", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 75, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 8, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Problem Statement Canvas", "slug": "problem-statement-canvas", "status": "active", "bestFor": null, "canonId": "019dd956-839d-744b-ad11-9bf3e3642a18", "version": 1, "bodyDocId": null, "description": "Structured definition of the problem: What? Who? Where? When? Scale?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "76e02382-c96f-48ac-8fb5-e39bbe928d38", "evidence": "Many organizations do not have a plan for recovering from a major attack quickly. Key issues such as reducing downtime, preventing, or minimizing revenue loss, addressing customers' experiences durin", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 21:36:27.466164+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 8, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-63aa75ef9b39", "evidence": "Title is the prevention question itself", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 9, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Audience Definition", "slug": "audience-definition", "status": "active", "bestFor": null, "canonId": "019dd956-7f2a-775d-aeee-ff099bcb7756", "version": 1, "bodyDocId": null, "description": "Six key questions: Who are they? What do they know? What do they believe? What do they care about? What do they fear? What decisions can they make?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "9007a3ee-2bc5-4a40-85ea-993d33af9c04", "evidence": "In order to properly evaluate an organization's cybersecurity program, it's incredibly important for business leadership to understand the current systems in place.", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 21:36:27.586578+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 9, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "One Idea Rule", "slug": "one-idea-rule", "status": "active", "bestFor": null, "canonId": "019dd956-b0f0-7630-a2f5-bb38f9bd9c57", "version": 1, "bodyDocId": null, "description": "Each slide should communicate exactly one concept", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "019dd95a-14f6-720d-8375-67f6d2b06654", "evidence": "Whole slide on the single preventative-measures question", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 75, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 9, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-6973bea414dd", "evidence": "Title 'How do you measure and manage our cybersecurity program?'", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 10, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Pyramid Principle", "slug": "pyramid-principle", "status": "active", "bestFor": "When the document has a single governing decision or recommendation the reader is asked to accept, and the case can be decomposed into a small number of clean groups. Strategy decks, board memos, investment committee papers.", "canonId": "019dd956-7cbd-7219-a477-c871e2bc1aff", "version": 1, "bodyDocId": "88b6ac56-b880-46f9-8621-ef3491ab6235", "description": "Lead with the answer; group three to five MECE supports beneath it; recurse one level down. Top-down hierarchical structure for any document with a single recommendation.", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "2e7a68df-e557-4679-9d9f-8f209951c964", "evidence": "But one of the most exciting elements of building an evolving security program is that as your program matures, your metrics become more advanced.", "pageRefs": null, "priority": "Core", "whenToUse": "When the document has a single governing decision or recommendation the reader is asked to accept, and the case can be decomposed into a small number of clean groups. Strategy decks, board memos, investment committee papers.", "confidence": 0.7, "extraction": { "at": "2026-07-16 21:36:27.66606+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 10, "whyItWorks": "Solves the two failure modes of expert communication at once: (1) the long climb where readers wait pages for the answer, and (2) logical mush from non-MECE groupings. Progressive disclosure lets a reader stop at any depth and get the right information.", "antipattern": "Chronological structure (\"what we did, what we found, what we conclude\") instead of logical hierarchy. Top-of-pyramid that is a topic (\"strategic options\") instead of an answer (\"pursue Option B because...\"). Non-MECE supports that overlap or fail to cover the universe.", "cardinality": null, "narrativePurpose": "Transfer conviction with minimum reader effort by mirroring how decision-makers consume information: answer first, scaffolding behind." }, { "tool": { "name": "So What? Test", "slug": "so-what-test", "status": "active", "bestFor": "On every slide carrying a chart, number, list, or finding intended to inform a decision; whenever a draft title is descriptive rather than directive; whenever the deck will circulate without its author.", "canonId": "019dd956-acd2-76f8-b59a-9bf15a89f10a", "version": 1, "bodyDocId": "fec04b06-b2f1-432b-a97b-916dc7563f64", "description": "The recursive editorial discipline of asking so-what of every slide, chart, and statement until the answer is an implication for the audience — that final answer becomes the slide's title; the chain becomes its body.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-6ffbe15b2137", "evidence": "Callout states the so-what: 'all initiatives ultimately lead back to tangible risks'", "pageRefs": null, "priority": "Core", "whenToUse": "On every slide carrying a chart, number, list, or finding intended to inform a decision; whenever a draft title is descriptive rather than directive; whenever the deck will circulate without its author.", "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 10, "whyItWorks": "Solves the two failure modes of analytical communication at once: stopping at description (analyst-confidence problem) and leaving insight stranded in the analyst's head (translation problem). The recursion is what guarantees the implication makes it into ink.", "antipattern": "Stopping at the first tighter description (still a fact, not an implication), regressing past the audience's decision space into philosophy, smuggling the so-what into speaker notes, or re-using an implication aimed at a previous audience.", "cardinality": null, "narrativePurpose": "Forces every analytical artefact to close the gap between fact and decision, so the reader holds the recommendation by reading titles alone rather than reconstructing the analyst's mental model from raw evidence." }, { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-759b1f9360e7", "evidence": "Title is the budget question", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 11, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Authority Bias", "slug": "authority-bias", "status": "active", "bestFor": null, "canonId": "019dd956-c38d-70b9-a284-b2b479763356", "version": 1, "bodyDocId": null, "description": "Expert opinions are weighted more heavily - cite credible sources", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Architect", "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-7f638a3e821a", "evidence": "'Experts advise...' frames the 10-15% figure as expert guidance", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 11, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Concrete Language", "slug": "concrete-language", "status": "active", "bestFor": null, "canonId": "019dd956-bcd4-7398-9723-6aa72346170b", "version": 1, "bodyDocId": null, "description": "Using specific sensory details instead of abstract terms", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-7adac571b0a3", "evidence": "Quantified prescription: '10% to 15% of an organization's IT budget'", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 85, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 11, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Problem Statement Canvas", "slug": "problem-statement-canvas", "status": "active", "bestFor": null, "canonId": "019dd956-839d-744b-ad11-9bf3e3642a18", "version": 1, "bodyDocId": null, "description": "Structured definition of the problem: What? Who? Where? When? Scale?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "48376359-c645-47b4-bf85-437c57cc33f3", "evidence": "Experts advise that 10% to 15% of an organization's IT budget be allocated for protection against data breaches and cybersecurity attacks.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 21:36:27.744976+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 11, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "af600721-2b81-4b8b-abc9-bb3155c45129", "evidence": "IT budget allocation: 10% to 15%", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 21:36:27.785561+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 11, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null }, { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-821c741a49ec", "evidence": "Title is the threat-outlook question", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 12, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "One Idea Rule", "slug": "one-idea-rule", "status": "active", "bestFor": null, "canonId": "019dd956-b0f0-7630-a2f5-bb38f9bd9c57", "version": 1, "bodyDocId": null, "description": "Each slide should communicate exactly one concept", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "019dd95a-14f6-720d-8375-85a3f88a4651", "evidence": "Single threat-outlook question per slide", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 75, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 12, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-8a51b7db96f9", "evidence": "Title is the talent recruiting/retention question", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 13, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Concrete Language", "slug": "concrete-language", "status": "active", "bestFor": null, "canonId": "019dd956-bcd4-7398-9723-6aa72346170b", "version": 1, "bodyDocId": null, "description": "Using specific sensory details instead of abstract terms", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-8e5d5a10ebd6", "evidence": "Concrete rule: don't ask for '110% of skills' then hire at '80%'", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 13, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Problem Statement Canvas", "slug": "problem-statement-canvas", "status": "active", "bestFor": null, "canonId": "019dd956-839d-744b-ad11-9bf3e3642a18", "version": 1, "bodyDocId": null, "description": "Structured definition of the problem: What? Who? Where? When? Scale?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "c9e7f04d-5450-43f5-9d4a-8bc71de1f081", "evidence": "Don't forget to have the information security manager work with HR to create the right requirements documents and hire the right candidates.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 21:36:27.903868+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 13, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-90a779167daf", "evidence": "Title 'What types of risks are currently threatening our network/systems?'", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 14, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Closing Techniques", "slug": "closing-techniques", "status": "active", "bestFor": null, "canonId": "019dd956-af13-774b-a4fd-7db0a3a88d51", "version": 1, "bodyDocId": null, "description": "Strong endings: Callback, challenge, vision, clear CTA, memorable line", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-96102d59075d", "evidence": "Callout closes with the vision line: 'a culture of resilience'", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 60, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 14, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Authority Bias", "slug": "authority-bias", "status": "active", "bestFor": null, "canonId": "019dd956-c38d-70b9-a284-b2b479763356", "version": 1, "bodyDocId": null, "description": "Expert opinions are weighted more heavily - cite credible sources", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Architect", "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-99229a92d841", "evidence": "Backs the entire question set with 'CompTIA Cybersecurity Advisory Council' credentials", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 85, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 15, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Credibility Transfer", "slug": "credibility-transfer", "status": "active", "bestFor": null, "canonId": "019dd956-bd34-759a-8e3b-2f14b571a2a1", "version": 1, "bodyDocId": null, "description": "Borrowing authority from trusted sources or vivid details", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-9f2910f2ba55", "evidence": "Borrows authority from CompTIA's Council to validate the deck's questions", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 15, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [ { "matchId": "f83d5e89-acd1-4edb-86d8-fa96fc2b1a0b", "evidence": "The slide poses a diagnostic question followed by sub-questions to assess organizational maturity.", "framework": null, "confidence": 0.8, "extraction": { "at": "2026-05-02 18:31:11.513+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 4, "frameworkName": "diagnostic-test" }, { "matchId": "85637326-a915-4c85-9bc2-f085f88b806e", "evidence": "The slide poses a diagnostic question and provides a checklist of evidence to evaluate organizational readiness.", "framework": null, "confidence": 0.8, "extraction": { "at": "2026-05-02 18:31:11.212+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 8, "frameworkName": "diagnostic-test" } ], "patterns": [] }, "storymakers": { "model": "claude-cli-sonnet-4.6", "backend": null, "rawJson": { "arc": { "id": 1, "slug": "consultants-gambit", "beats": [ { "name": "Situation & Context", "end_page": 3, "evidence": "Cover hook 'Are We Safe?', TOC, intro on why CEOs must ask these questions", "position": 1, "start_page": 1 }, { "name": "Problem & Complication", "end_page": 9, "evidence": "Questions 1-6 enumerate exposure: assets, education, strategy, attack vectors, recovery, prevention", "position": 2, "start_page": 4 }, { "name": "Solution & Approach", "end_page": 11, "evidence": "Q7-8 prescribe measurement program and budget allocation method", "position": 3, "start_page": 10 }, { "name": "Evidence & Proof", "end_page": 13, "evidence": "Q9-10 cite expert guidance on threat outlook and talent strategy", "position": 4, "start_page": 12 }, { "name": "Impact & Next Steps", "end_page": 15, "evidence": "Q11 culture-of-resilience close + CompTIA advisor authority backstop", "position": 5, "start_page": 14 } ], "evidence": "Hook + context (p1-3) frames cybersecurity stakes; Q1-6 probe problems (p4-9); Q7-8 propose measurement/budget approach (p10-11); Q9-10 supply expert evidence on outlook/talent (p12-13); Q11 + advisor authority close (p14-15).", "confidence": 55 }, "loops": [ { "id": 40, "slug": "40-mece-breakdown", "end_page": 9, "evidence": "Intro frames the question set, then six distinct, non-overlapping diagnostic questions (assets, training, strategy, attack vectors, recovery, prevention)", "position": 1, "objective": "Enumerate the foundational cybersecurity readiness questions a CEO must diagnose", "confidence": 70, "start_page": 3 }, { "id": 40, "slug": "40-mece-breakdown", "end_page": 14, "evidence": "Q7-Q11 cover distinct management levers: measurement, budget, threat outlook, talent, current risks", "position": 2, "objective": "Enumerate the operational/strategic management dimensions of a cybersecurity program", "confidence": 65, "start_page": 10 } ], "slide_tools": [ { "tools": [ { "id": 123, "slug": "opening-hooks", "layer": "Slide", "evidence": "Cover poses provocative question 'Are We Safe?' over team image", "confidence": 85 }, { "id": 156, "slug": "emotional-appeal", "layer": "Slide", "evidence": "Photo of office team with on-screen breach notification triggers safety concern", "confidence": 70 }, { "id": 67, "slug": "curiosity-gap", "layer": "Block", "evidence": "Title is a question with no answer on the cover, demanding resolution", "confidence": 75 } ], "page_number": 1 }, { "tools": [ { "id": 132, "slug": "visual-hierarchy", "layer": "Slide", "evidence": "Numbered TOC lists all 11 questions with consistent typographic treatment and page anchors", "confidence": 75 }, { "id": 116, "slug": "chunking", "layer": "Loop", "evidence": "TOC chunks the program into 11 numbered, equally-weighted questions", "confidence": 70 } ], "page_number": 2 }, { "tools": [ { "id": 118, "slug": "action-titles", "layer": "Slide", "evidence": "Title 'Cybersecurity Questions that All CEOs Need to Ask' states the slide's payload", "confidence": 80 }, { "id": 169, "slug": "authority-bias", "layer": "Slide", "evidence": "Cites 'CompTIA's Cybersecurity Advisory Council' as the question source", "confidence": 80 }, { "id": 154, "slug": "concrete-language", "layer": "Slide", "evidence": "Pulls out 'Are you sure?' / 'Why are you sure?' as concrete baseline questions", "confidence": 70 }, { "id": 89, "slug": "anaphora", "layer": "Loop", "evidence": "Sets up the 'Are you...? / Why are you...?' repetition pattern reused across questions", "confidence": 75 }, { "id": 2, "slug": "mece-principle", "layer": "Block", "evidence": "Frames the eleven questions as a complete, non-overlapping audit set", "confidence": 70 }, { "id": 18, "slug": "issue-tree", "layer": "Block", "evidence": "Decomposes 'Are we safe?' into 11 testable sub-questions", "confidence": 60 } ], "page_number": 3 }, { "tools": [ { "id": 118, "slug": "action-titles", "layer": "Slide", "evidence": "Title 'Do we keep a live inventory of assets?' states the diagnostic itself", "confidence": 85 }, { "id": 128, "slug": "one-idea-rule", "layer": "Slide", "evidence": "Whole page is the asset-inventory question and its rationale", "confidence": 80 }, { "id": 154, "slug": "concrete-language", "layer": "Slide", "evidence": "Callout names the concrete attributes: 'existence, purpose, location, configuration, age, version'", "confidence": 70 } ], "page_number": 4 }, { "tools": [ { "id": 118, "slug": "action-titles", "layer": "Slide", "evidence": "Title is the question 'Are my employees properly educated about cybersecurity threats?'", "confidence": 85 }, { "id": 128, "slug": "one-idea-rule", "layer": "Slide", "evidence": "Single question on the page with one supporting principle in the callout", "confidence": 80 } ], "page_number": 5 }, { "tools": [ { "id": 118, "slug": "action-titles", "layer": "Slide", "evidence": "Title 'Does our cybersecurity strategy address business risk? How?' frames the slide", "confidence": 85 }, { "id": 128, "slug": "one-idea-rule", "layer": "Slide", "evidence": "Single strategic question per page format", "confidence": 80 } ], "page_number": 6 }, { "tools": [ { "id": 118, "slug": "action-titles", "layer": "Slide", "evidence": "Title is the long question about attack scenarios", "confidence": 80 }, { "id": 154, "slug": "concrete-language", "layer": "Slide", "evidence": "Names specific threats: ransomware, data theft, severe disruption and losses", "confidence": 70 } ], "page_number": 7 }, { "tools": [ { "id": 118, "slug": "action-titles", "layer": "Slide", "evidence": "Title 'If we were hit by a major attack, how confident are you that we could recover quickly?'", "confidence": 85 }, { "id": 2, "slug": "mece-principle", "layer": "Block", "evidence": "Body breaks recovery into four distinct categories: Incident Response, Disaster Recovery, Business Continuity, Insider Protections", "confidence": 75 }, { "id": 154, "slug": "concrete-language", "layer": "Slide", "evidence": "Lists four named, defined plan types with specific evidence to demand", "confidence": 75 } ], "page_number": 8 }, { "tools": [ { "id": 118, "slug": "action-titles", "layer": "Slide", "evidence": "Title is the prevention question itself", "confidence": 80 }, { "id": 128, "slug": "one-idea-rule", "layer": "Slide", "evidence": "Whole slide on the single preventative-measures question", "confidence": 75 } ], "page_number": 9 }, { "tools": [ { "id": 118, "slug": "action-titles", "layer": "Slide", "evidence": "Title 'How do you measure and manage our cybersecurity program?'", "confidence": 80 }, { "id": 119, "slug": "so-what-test", "layer": "Slide", "evidence": "Callout states the so-what: 'all initiatives ultimately lead back to tangible risks'", "confidence": 70 }, { "id": 89, "slug": "anaphora", "layer": "Loop", "evidence": "Continues 'How do you...' question opener pattern across Q7-Q10", "confidence": 70 } ], "page_number": 10 }, { "tools": [ { "id": 118, "slug": "action-titles", "layer": "Slide", "evidence": "Title is the budget question", "confidence": 80 }, { "id": 154, "slug": "concrete-language", "layer": "Slide", "evidence": "Quantified prescription: '10% to 15% of an organization's IT budget'", "confidence": 85 }, { "id": 169, "slug": "authority-bias", "layer": "Slide", "evidence": "'Experts advise...' frames the 10-15% figure as expert guidance", "confidence": 80 } ], "page_number": 11 }, { "tools": [ { "id": 118, "slug": "action-titles", "layer": "Slide", "evidence": "Title is the threat-outlook question", "confidence": 80 }, { "id": 128, "slug": "one-idea-rule", "layer": "Slide", "evidence": "Single threat-outlook question per slide", "confidence": 75 } ], "page_number": 12 }, { "tools": [ { "id": 118, "slug": "action-titles", "layer": "Slide", "evidence": "Title is the talent recruiting/retention question", "confidence": 80 }, { "id": 154, "slug": "concrete-language", "layer": "Slide", "evidence": "Concrete rule: don't ask for '110% of skills' then hire at '80%'", "confidence": 80 } ], "page_number": 13 }, { "tools": [ { "id": 118, "slug": "action-titles", "layer": "Slide", "evidence": "Title 'What types of risks are currently threatening our network/systems?'", "confidence": 80 }, { "id": 124, "slug": "closing-techniques", "layer": "Slide", "evidence": "Callout closes with the vision line: 'a culture of resilience'", "confidence": 60 } ], "page_number": 14 }, { "tools": [ { "id": 169, "slug": "authority-bias", "layer": "Slide", "evidence": "Backs the entire question set with 'CompTIA Cybersecurity Advisory Council' credentials", "confidence": 85 }, { "id": 155, "slug": "credibility-transfer", "layer": "Slide", "evidence": "Borrows authority from CompTIA's Council to validate the deck's questions", "confidence": 70 } ], "page_number": 15 } ], "slides_seen": 15, "deck_summary": "BCG/CompTIA's question-based audit reads as a MECE-style enumeration loosely wrapped in a Consultant's Gambit shell — strong on action-titled questions and authority-backed callouts, but it carries no charts, no named consulting frameworks, and only a thin narrative arc connecting the eleven items.", "secondary_arcs": [], "images_inspected": 6, "slide_frameworks": [] }, "matchedAt": "2026-04-26 19:26:35+00", "slidesSeen": 15, "deckSummary": "BCG/CompTIA's question-based audit reads as a MECE-style enumeration loosely wrapped in a Consultant's Gambit shell — strong on action-titled questions and authority-backed callouts, but it carries no charts, no named consulting frameworks, and only a thin narrative arc connecting the eleven items.", "imagesInspected": 6, "extractionSeconds": 235.23633 }, "score": { "backend": "claude", "scoredAt": "2026-05-02 10:36:58.355+00", "subScores": { "scqa_arc": 35, "action_titles": 25, "mece_structure": 70, "closing_strength": 15, "evidence_quality": 30, "clarity_of_thesis": 45, "production_quality": 50, "visual_storytelling": 20 }, "totalScore": 42, "coveragePct": 100, "explanations": { "scqa_arc": "Deck establishes Situation and Complication weakly in slides 1-3, then poses 11 parallel Questions but never delivers a synthesized Answer — it is a question catalogue, not a narrative arc.", "action_titles": "Titles are interrogative topic labels rather than insight-bearing sentences (e.g., slide 8: 'If we were hit by a major attack, how confident are you that we could recover quickly?' instead of an answer like 'Most firms cannot recover within 72 hours — three gaps drive this').", "mece_structure": "The 11 questions cover distinct domains (assets, training, risk alignment, attack simulation, recovery, prevention, metrics, budget, threat outlook, talent, current risks) with limited overlap, though slides 4 and 14 partially duplicate the asset/risk-visibility theme.", "closing_strength": "Deck ends on slide 14 with another diagnostic question and slide 15 is an 'About the Council' appendix — there is no recommendation, summary of answers, or call to action.", "evidence_quality": "Aside from one benchmark on slide 11 ('10%-15% of IT budget') and one quote, claims are framed as expert assertions and rhetorical prompts with no data, case studies, or citations.", "clarity_of_thesis": "Slides 1-3 frame the topic ('Are We Safe?') and the need for evidence-based cybersecurity inquiry, but no declarative thesis or recommended posture is stated — the reader gets a question, not an argument.", "production_quality": "Consistent BCG minimalist template, clean numbered structure, and disciplined callouts, but action-title density is effectively zero (titles are questions) and several slides are flagged dense/overcrowded (slides 4-13).", "visual_storytelling": "Every content slide (4-14) is text-heavy paragraphs plus bulleted follow-up questions; no charts, frameworks, big-numbers, or diagrams are used despite topics like budget benchmarks (slide 11) crying out for visualization." }, "slidesAnalyzed": 15 }, "review": { "backend": null, "verdict": "A useful CEO checklist masquerading as a deck — teach it as an anti-pattern for action titles and closing, not as a Storymakers exemplar.", "reviewedAt": "2026-04-24 16:37:27+00", "slidesSeen": 15, "suggestions": [ "Rewrite every question title as a declarative action title stating the answer (e.g. p.4 → 'A live asset inventory is the precondition for any defense')", "Group the 11 questions into 3-4 MECE pillars (e.g. Know Your Assets / Know Your Adversary / Know Your Response / Know Your Economics) with real divider slides", "Add a closing synthesis slide before the appendix: the CEO's 3-move playbook or a scorecard the reader can use on Monday" ], "closingScore": 30, "openingScore": 55, "topStrengths": [ "Strong provocative cover on p.1 ('Are We Safe?') — rare emotional hook for a B2B deck", "Callouts consistently deliver the prescriptive insight the titles withhold (e.g. p.4 'You cannot defend assets if you are unaware of their existence...')", "Clear audience framing on p.3 — explicitly scoped to CEO-level questions" ], "topWeaknesses": [ "No recommendation slide — p.13 is tagged 'recommend' but is still phrased as a question about talent", "Titles are questions, not answers — violates action-title discipline across all 11 content slides", "No MECE structure — 11 questions are listed flat with no pillars, themes, or grouping", "Ends on an appendix (p.15) with no synthesis, next steps, or 'so what' slide" ], "narrativeScore": 42, "pillarCritique": "The section_divider slides (p.5, 6, 10, 11, 12) are not MECE pillars — they are individual numbered questions in a flat list, so the deck has no true structural hierarchy beyond 'here are 11 things to ask'.", "closingCritique": "The last pre-appendix slides (p.13-14) are simply questions 10 and 11 with no synthesis, call to action, or next steps — the deck trails off into an 'About the Council' appendix rather than landing a recommendation.", "openingCritique": "The cover 'Are We Safe?' is a strong provocative hook and p.3 frames the CEO's job-to-be-done, but the deck never states a thesis or answer — by slide 5 the reader is still being asked questions rather than given a point of view.", "extractionSeconds": 41.948917, "narrativeCritique": "The deck is structured as a list of 11 questions rather than a story arc — it establishes a situation ('Are We Safe?') but never builds tension, analyzes root causes, or resolves to a recommendation. The Complication and Resolution acts are effectively missing; it reads as a questionnaire, not SCQA.", "titleQualityScore": 38, "titleQualityCritique": "Titles are interrogative topic prompts, not insight-bearing action titles — e.g. p.4 'Do we keep a live inventory of assets?' and p.11 'How do you determine the appropriate budget for technology risk management?' pose questions but deliver no answer; only the callouts carry insight." }, "activistThesis": null, "pitchdeck": { "metadata": null, "profile": null }, "slides": [ { "page": 1, "type": "setup", "function": "front_matter", "imagePath": "https://imgproxy.kitesheet.com/yvc-lSfjbkvLecoafV5hrOb09PQG16LnY2ObzfN-6cA/rs:fit:1200:1200:0/q:82/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy8wZWM3NzBiZDg3MzEzY2U4L3AwMDEuanBn", "rawType": "cover", "block": null, "metadata": { "slideType": "cover", "slideTypeCanon": { "name": "Cover", "slug": "cover", "status": "active", "canonId": "019de52d-05f2-729d-9f93-e0504f0a2410", "version": 1, "description": null }, "function": "front_matter", "functionCanon": { "name": "Front matter", "slug": "front_matter", "status": "active", "canonId": "019de52d-133d-73f0-9e26-201eda96b098", "version": 1, "description": null }, "density": "sparse", "densityScore": 16, "componentCount": 4, "textChars": 191, "nDataPoints": 0, "notes": null, "elementsJson": [ "photo", "headline_text" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:31:10.485+00", "seconds": 2.486, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a169-54303fbbe19b/1", "deck": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b", "deckAnchor": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b#slide-1", "deckJson": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "A CEO’S GUIDE TO ADDRESSING CYBERSECURITY CONCERNS", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:32:32+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-fefa-773b-abc7-12dbb3821a5b", "parentComponentId": null }, { "bbox": { "h": 1, "w": 1, "x": 0, "y": 0 }, "kind": "image", "text": "Office scene with employees working at desks, viewed through a glass partition.", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Photo", "slug": "photo", "status": "active", "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875", "version": 1, "description": null }, "framework": null }, "subkind": "photo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:10.485+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2620a28c-5c9d-46d2-8928-6500d49a4c57", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.9, "x": 0.05, "y": 0.75 }, "kind": "title", "text": "Are We Safe?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:10.485+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c3c04d2e-da5b-43a6-8891-e7a9b4e4232e", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.5, "x": 0.05, "y": 0.82 }, "kind": "title", "text": "A CEO'S GUIDE TO ADDRESSING CYBERSECURITY CONCERNS", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:10.485+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a48f1a83-1994-4cc8-952a-651fdf8d3468", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Curiosity Gap", "slug": "curiosity-gap", "status": "active", "bestFor": null, "canonId": "019dd956-9703-74ef-8b85-96dfd8525025", "version": 1, "bodyDocId": null, "description": "People seek missing information - create open questions that demand resolution", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Storyteller", "layer": "block", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f5-72a3-8b96-15b026b160d8", "evidence": "Title is a question with no answer on the cover, demanding resolution", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 75, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 1, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Emotional Appeal", "slug": "emotional-appeal", "status": "active", "bestFor": null, "canonId": "019dd956-bde9-7668-8be7-0097678fec59", "version": 1, "bodyDocId": null, "description": "Connecting to audience feelings rather than just logic", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f5-72a3-8b96-1197d7a57545", "evidence": "Photo of office team with on-screen breach notification triggers safety concern", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 1, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Opening Hooks", "slug": "opening-hooks", "status": "active", "bestFor": null, "canonId": "019dd956-aeb0-77d5-bfbd-9cd9a6be8186", "version": 1, "bodyDocId": null, "description": "Techniques to capture attention: Startling statistic, provocative question, short story, analogy, contrast", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f5-72a3-8b96-0dc66343eb04", "evidence": "Cover poses provocative question 'Are We Safe?' over team image", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 85, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 1, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 3, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 1, "name": "Situation & Context", "beatId": "019dd95a-0702-74a3-87e1-64c707d12a09", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Situation & Context", "slug": "consultants-gambit-situation-context", "status": "active", "canonId": "019dd9b8-05ae-741b-992d-65ee83c639b3", "version": 1, "description": null }, "evidence": "Cover hook 'Are We Safe?', TOC, intro on why CEOs must ask these questions", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 55 } ], "loops": [], "thumbSrc": "https://imgproxy.kitesheet.com/uib4Zt5LESIfCB1XBUbsYRWZuUAbGaEx5MR34l-5cdA/rs:fit:480:480:0/q:78/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy8wZWM3NzBiZDg3MzEzY2U4L3AwMDEuanBn", "imagePathAlt": "https://imgproxy.kitesheet.com/Zpz5U1sYSGcmy-bPCytXzDRCvSdhOwD-kDe0oEb03BQ/rs:fit:1200:1200:0/q:82/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy8wZWM3NzBiZDg3MzEzY2U4L3AwMDEucG5n", "thumbSrcAlt": "https://imgproxy.kitesheet.com/sCiBIFOiGLIpAQFe_4_ma94CYSMYztVtLX3Q4XHE9HY/rs:fit:480:480:0/q:78/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy8wZWM3NzBiZDg3MzEzY2U4L3AwMDEucG5n" }, { "page": 2, "type": "setup", "title": "The slide uses a teal background with white text and dotted leaders connecting the section titles to page numbers.", "function": "front_matter", "rawType": "table_of_contents", "block": null, "metadata": { "slideType": "table_of_contents", "slideTypeCanon": { "name": "Table of contents", "slug": "table_of_contents", "status": "active", "canonId": "019de52d-0643-721b-9b85-69676bb85cf8", "version": 1, "description": null }, "function": "front_matter", "functionCanon": { "name": "Front matter", "slug": "front_matter", "status": "active", "canonId": "019de52d-133d-73f0-9e26-201eda96b098", "version": 1, "description": null }, "density": "sparse", "densityScore": 10, "componentCount": 2, "textChars": 238, "nDataPoints": 0, "notes": "The slide uses a teal background with white text and dotted leaders connecting the section titles to page numbers.", "elementsJson": [ "numbered_list" ], "confidence": 1, "extraction": { "model": "google/gemini-3.5-flash", "runId": null, "at": "2026-07-17 03:42:05.906+00", "seconds": 4.682, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a169-54303fbbe19b/2", "deck": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b", "deckAnchor": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b#slide-2", "deckJson": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b.json" }, "components": [ { "bbox": { "h": 0.5, "w": 0.54, "x": 0.23, "y": 0.33 }, "kind": "list", "text": "Cybersecurity Questions that All CEOs Need to Ask\n1. Do we keep a live inventory of assets?\n2. Are my employees properly educated about cybersecurity threats?\n3. Does our cybersecurity strategy address business risk? How?", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Numbered list", "slug": "numbered", "status": "active", "canonId": "019de52c-fcc0-7718-a284-a4250c805df2", "version": 1, "description": null }, "framework": null }, "subkind": "numbered", "groupRole": null, "confidence": null, "extraction": { "at": "2026-07-17 03:42:05.906+00", "model": "google/gemini-3.5-flash", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b829a65f-8ebf-4a9a-bce3-9c10d0b22f45", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.33, "x": 0.23, "y": 0.28 }, "kind": "title", "text": "Table of Contents", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-07-17 03:42:05.906+00", "model": "google/gemini-3.5-flash", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8155066d-acc9-4a62-a0d0-0f3abe5eccfd", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Chunking", "slug": "chunking", "status": "active", "bestFor": null, "canonId": "019dd956-abab-72ce-b64c-2924cc83cf39", "version": 1, "bodyDocId": null, "description": "Information grouped into chunks is remembered better - structure content in digestible units", "familyLabel": null, "categoryName": "Loop", "categorySlug": "loop" }, "agent": "Architect", "layer": "loop", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-17ba63c493e5", "evidence": "TOC chunks the program into 11 numbered, equally-weighted questions", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 2, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Visual Hierarchy", "slug": "visual-hierarchy", "status": "active", "bestFor": null, "canonId": "019dd956-b2ca-706b-937f-e52441086fd7", "version": 1, "bodyDocId": null, "description": "Order of perception through Size > Color > Position > Weight > Space", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "019dd95a-14f5-72a3-8b96-1ac28bc95c4a", "evidence": "Numbered TOC lists all 11 questions with consistent typographic treatment and page anchors", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 75, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 2, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 3, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 1, "name": "Situation & Context", "beatId": "019dd95a-0702-74a3-87e1-64c707d12a09", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Situation & Context", "slug": "consultants-gambit-situation-context", "status": "active", "canonId": "019dd9b8-05ae-741b-992d-65ee83c639b3", "version": 1, "description": null }, "evidence": "Cover hook 'Are We Safe?', TOC, intro on why CEOs must ask these questions", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 55 } ], "loops": [], "locked": true }, { "page": 3, "type": "setup", "title": "The slide introduces two foundational questions: 'Are you sure?' and 'Why are you sure?' as a baseline for evaluating cybersecurity information.", "function": "frame_problem", "rawType": "key_messages", "block": null, "metadata": { "slideType": "key_messages", "slideTypeCanon": { "name": "Key messages", "slug": "key_messages", "status": "active", "canonId": "019de52d-0712-703f-89f5-bda6688faf3f", "version": 1, "description": null }, "function": "frame_problem", "functionCanon": { "name": "Frame problem", "slug": "frame_problem", "status": "active", "canonId": "019de52d-13db-753e-ad70-e9b2d0dab398", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 81, "componentCount": 9, "textChars": 1815, "nDataPoints": 0, "notes": "The slide introduces two foundational questions: 'Are you sure?' and 'Why are you sure?' as a baseline for evaluating cybersecurity information.", "elementsJson": [ "headline_text", "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:31:12.334+00", "seconds": 4.242, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a169-54303fbbe19b/3", "deck": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b", "deckAnchor": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b#slide-3", "deckJson": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Cybersecurity expectations should be measured against the reality of implementation of processes, procedures, education, and verification.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:32:31+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-fefa-773b-abc6-2743a66e640f", "parentComponentId": null }, { "bbox": { "h": 0.085, "w": 0.605, "x": 0.198, "y": 0.675 }, "kind": "list", "text": "Are you sure? Cybersecurity expectations should be measured against the reality of implementation of processes, procedures, education, and verification. False assumptions or beliefs about security conditions are often found after a major security incident.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.334+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4100a8ad-df90-4336-b31a-f60b109889c3", "parentComponentId": null }, { "bbox": { "h": 0.065, "w": 0.605, "x": 0.198, "y": 0.775 }, "kind": "list", "text": "Why are you sure? Refrain from basing a business decision after being told that “all is good” without supporting evidence from responsible parties. Request or even require independent testing based on the outcome expected.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.334+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4679b4ef-7549-4508-abd0-1fd6a36da7e2", "parentComponentId": null }, { "bbox": { "h": 0.045, "w": 0.605, "x": 0.198, "y": 0.535 }, "kind": "paragraph", "text": "CompTIA's Cybersecurity Advisory Council has developed a series of questions to ask within your organization to ensure that you have a complete security picture in order to make the best decisions for the company.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.334+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "27e2e28b-6623-4790-8a7f-4208a522be6c", "parentComponentId": null }, { "bbox": { "h": 0.085, "w": 0.605, "x": 0.198, "y": 0.375 }, "kind": "paragraph", "text": "The best business decisions are often made based on senior leadership's confidence in facts, figures and calculations made by appropriate parties within the organization. Relying on gut instinct—or worse, potentially false or incomplete information—is a dangerous road to travel, especially in cybersecurity.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.334+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5d362a58-389e-4253-8467-cccdf938e522", "parentComponentId": null }, { "bbox": { "h": 0.045, "w": 0.605, "x": 0.198, "y": 0.585 }, "kind": "paragraph", "text": "Note: It's important that the person/people answering the questions recognize that they are obligated to share any and all pertinent information germane to the larger decisions being made, whether a direct request was made or not.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.334+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5ebe9d18-f4f7-4dcf-8562-9446f2383366", "parentComponentId": null }, { "bbox": { "h": 0.065, "w": 0.605, "x": 0.198, "y": 0.465 }, "kind": "paragraph", "text": "Whereas a gut instinct may work in marketing, sales, or other facets of the business, the planning, implementation, and verification of security operations require facts to be complete and accurate. You need to have all the answers to every possible question at any time.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.334+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c702dce9-ad70-416d-85ac-4a6fa492b1f5", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.605, "x": 0.198, "y": 0.635 }, "kind": "paragraph", "text": "For each of the questions below, keep in mind that responses should also address the following questions/criteria as a baseline:", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.334+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d6273a10-0c15-4eaa-b4bf-e10b8e472b21", "parentComponentId": null }, { "bbox": { "h": 0.21, "w": 0.41, "x": 0.198, "y": 0.155 }, "kind": "title", "text": "Cybersecurity Questions that All CEOs Need to Ask", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.334+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "94bc0fc3-da55-41d8-acf8-add336286486", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Issue Tree", "slug": "issue-tree", "status": "active", "bestFor": null, "canonId": "019dd956-82e3-775d-a2b6-318154564b53", "version": 1, "bodyDocId": null, "description": "Breaking down a problem into component parts systematically", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "block", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-2c15b830cfd1", "evidence": "Decomposes 'Are we safe?' into 11 testable sub-questions", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 60, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 3, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "MECE Principle", "slug": "mece-principle", "status": "active", "bestFor": null, "canonId": "019dd956-7c60-71a8-8758-c79d914489c9", "version": 1, "bodyDocId": null, "description": "Mutually Exclusive, Collectively Exhaustive - ensuring complete, non-overlapping structure", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "block", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-2a0b2ecd6716", "evidence": "Frames the eleven questions as a complete, non-overlapping audit set", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 3, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Anaphora", "slug": "anaphora", "status": "active", "bestFor": null, "canonId": "019dd956-9fee-74aa-a920-078aa44132c0", "version": 1, "bodyDocId": null, "description": "Repeating words at the beginning of successive clauses for rhythm", "familyLabel": null, "categoryName": "Loop", "categorySlug": "loop" }, "agent": "Storyteller", "layer": "loop", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-25279c3bdcbf", "evidence": "Sets up the 'Are you...? / Why are you...?' repetition pattern reused across questions", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 75, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 3, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-19a455da6f10", "evidence": "Title 'Cybersecurity Questions that All CEOs Need to Ask' states the slide's payload", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 3, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Authority Bias", "slug": "authority-bias", "status": "active", "bestFor": null, "canonId": "019dd956-c38d-70b9-a284-b2b479763356", "version": 1, "bodyDocId": null, "description": "Expert opinions are weighted more heavily - cite credible sources", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Architect", "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-1fd26932887c", "evidence": "Cites 'CompTIA's Cybersecurity Advisory Council' as the question source", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 3, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Concrete Language", "slug": "concrete-language", "status": "active", "bestFor": null, "canonId": "019dd956-bcd4-7398-9723-6aa72346170b", "version": 1, "bodyDocId": null, "description": "Using specific sensory details instead of abstract terms", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-223e34e04da7", "evidence": "Pulls out 'Are you sure?' / 'Why are you sure?' as concrete baseline questions", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 3, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 3, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 1, "name": "Situation & Context", "beatId": "019dd95a-0702-74a3-87e1-64c707d12a09", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Situation & Context", "slug": "consultants-gambit-situation-context", "status": "active", "canonId": "019dd9b8-05ae-741b-992d-65ee83c639b3", "version": 1, "description": null }, "evidence": "Cover hook 'Are We Safe?', TOC, intro on why CEOs must ask these questions", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 55 } ], "loops": [ { "to": 9, "from": 3, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "019dd95a-088c-724c-b30d-fd91b0cb420d", "evidence": "Intro frames the question set, then six distinct, non-overlapping diagnostic questions (assets, training, strategy, attack vectors, recovery, prevention)", "position": 1, "objective": "Enumerate the foundational cybersecurity readiness questions a CEO must diagnose", "confidence": 70, "extraction": { "at": "2026-04-29 13:07:29.689431+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null } } ], "locked": true }, { "page": 4, "type": "analysis", "title": "The slide uses a numbered list format (1) to structure a diagnostic inquiry into asset management.", "function": "diagnose", "rawType": "diagnosis", "block": null, "metadata": { "slideType": "diagnosis", "slideTypeCanon": { "name": "Diagnosis", "slug": "diagnosis", "status": "active", "canonId": "019de52d-0cd7-7212-898f-0464041ff8d8", "version": 1, "description": null }, "function": "diagnose", "functionCanon": { "name": "Diagnose", "slug": "diagnose", "status": "active", "canonId": "019de52d-1657-7223-acc5-7437d878c850", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 79, "componentCount": 9, "textChars": 1322, "nDataPoints": 0, "notes": "The slide uses a numbered list format (1) to structure a diagnostic inquiry into asset management.", "elementsJson": [ "headline_text", "bullet_list", "paragraph", "numbered_list" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:31:11.513+00", "seconds": 3.364, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a169-54303fbbe19b/4", "deck": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b", "deckAnchor": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b#slide-4", "deckJson": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "You cannot defend assets if you are unaware of their existence, purpose, location, and status information such as configuration, age, and version.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:32:32+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-fefa-773b-abc6-d55a09e079f9", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.7, "x": 0.14, "y": 0.28 }, "kind": "list", "text": "Hardware and Software: You cannot defend assets if you are unaware of their existence, purpose, location, and status information such as configuration, age, and version.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.513+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1cf7fe69-af31-4e6c-a459-b22c5dca7fad", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.5, "x": 0.36, "y": 0.75 }, "kind": "list", "text": "How were our polices determined? Were they defined specifically for our company? Are they simple and easy to follow? Do our employees understand them? Are we testing for behaviors? Do we have a mechanism for reeducation? Can our policies be audited?", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.513+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "317db327-e721-4eb1-89b2-65300bcc60d6", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.7, "x": 0.14, "y": 0.55 }, "kind": "list", "text": "Policies: Policies are a critical starting point in any risk management program, but a few important factors should be considered from the executive perspective.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.513+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4e8a3861-e607-444f-81de-8e6e2aa76341", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.7, "x": 0.14, "y": 0.44 }, "kind": "list", "text": "Data: Your team should know what data you have, where it resides and how it is used. That's a critical part of systems design, security, and management.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.513+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "85be3fed-24c3-4f75-b01a-0b74aa78bfcf", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.7, "x": 0.14, "y": 0.23 }, "kind": "paragraph", "text": "Maintaining—and continually updating—an accurate inventory of both physical and virtual assets, including all devices, licenses, and policies is critical to help determine your cyber posture and vulnerabilities. Here's a detailed look at several categories of assets:", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.513+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "083bfb7b-d6b4-4305-aac8-027ea91c8e66", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.6, "x": 0.14, "y": 0.17 }, "kind": "paragraph", "text": "In other words, do we know what needs to be protected (i.e. hardware, software licenses, IP, and other sensitive data)?", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.513+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "674ffb43-c222-4740-a06e-9c011e67f441", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.6, "x": 0.13, "y": 0.14 }, "kind": "title", "text": "1 Do we keep a live inventory of assets?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.513+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d4d6d1be-27ba-4e5b-9a73-24def76f9396", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.2, "x": 0.36, "y": 0.72 }, "kind": "title", "text": "FOLLOW-UP QUESTIONS", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.513+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7cba3dd1-f5ee-4468-8dd5-3f7f56253f87", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-31ab61676c58", "evidence": "Title 'Do we keep a live inventory of assets?' states the diagnostic itself", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 85, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 4, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Concrete Language", "slug": "concrete-language", "status": "active", "bestFor": null, "canonId": "019dd956-bcd4-7398-9723-6aa72346170b", "version": 1, "bodyDocId": null, "description": "Using specific sensory details instead of abstract terms", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-3a3745c71afb", "evidence": "Callout names the concrete attributes: 'existence, purpose, location, configuration, age, version'", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 4, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "One Idea Rule", "slug": "one-idea-rule", "status": "active", "bestFor": null, "canonId": "019dd956-b0f0-7630-a2f5-bb38f9bd9c57", "version": 1, "bodyDocId": null, "description": "Each slide should communicate exactly one concept", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "019dd95a-14f6-720d-8375-36c014d5acb8", "evidence": "Whole page is the asset-inventory question and its rationale", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 4, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [ { "matchId": "f83d5e89-acd1-4edb-86d8-fa96fc2b1a0b", "evidence": "The slide poses a diagnostic question followed by sub-questions to assess organizational maturity.", "framework": null, "confidence": 0.8, "extraction": { "at": "2026-05-02 18:31:11.513+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 4, "frameworkName": "diagnostic-test" } ], "arcBeats": [ { "to": 9, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 4, "name": "Problem & Complication", "beatId": "019dd95a-0702-74a3-87e1-68abc4f9b35a", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "Questions 1-6 enumerate exposure: assets, education, strategy, attack vectors, recovery, prevention", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 55 } ], "loops": [ { "to": 9, "from": 3, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "019dd95a-088c-724c-b30d-fd91b0cb420d", "evidence": "Intro frames the question set, then six distinct, non-overlapping diagnostic questions (assets, training, strategy, attack vectors, recovery, prevention)", "position": 1, "objective": "Enumerate the foundational cybersecurity readiness questions a CEO must diagnose", "confidence": 70, "extraction": { "at": "2026-04-29 13:07:29.689431+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null } } ], "locked": true }, { "page": 5, "type": "tension", "title": "The slide uses a '2' as a section marker, suggesting it is part of a larger diagnostic or assessment framework.", "function": "frame_problem", "rawType": "problem_statement", "block": null, "metadata": { "slideType": "problem_statement", "slideTypeCanon": { "name": "Problem statement", "slug": "problem_statement", "status": "active", "canonId": "019de52d-0879-768d-bba8-8da8a5a121d4", "version": 1, "description": null }, "function": "frame_problem", "functionCanon": { "name": "Frame problem", "slug": "frame_problem", "status": "active", "canonId": "019de52d-13db-753e-ad70-e9b2d0dab398", "version": 1, "description": null }, "density": "dense", "densityScore": 59, "componentCount": 6, "textChars": 1263, "nDataPoints": 0, "notes": "The slide uses a '2' as a section marker, suggesting it is part of a larger diagnostic or assessment framework.", "elementsJson": [ "headline_text", "paragraph", "numbered_list" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:31:10.895+00", "seconds": 2.532, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a169-54303fbbe19b/5", "deck": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b", "deckAnchor": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b#slide-5", "deckJson": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "It's not enough to train employees by giving them information and then testing for what they remember.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:32:33+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-fefa-773b-abc7-50a41aa65755", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.4, "x": 0.36, "y": 0.58 }, "kind": "list", "text": "FOLLOW-UP QUESTIONS\nHow often are my employees educated about cybersecurity threats?\nAre you sure?\nHave they been tested?", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:10.895+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7c61003c-5a61-436e-8eb3-58bd6112f635", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.72, "x": 0.14, "y": 0.37 }, "kind": "paragraph", "text": "Random testing alone leads to more cautious behavior and reduction in careless or reckless actions. Testing must be sneaky and as realistic as possible without warning. Also, make it randomized so targets don't expect it or become complacent.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:10.895+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7c88e035-929a-4512-9476-ed5d13556346", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.72, "x": 0.14, "y": 0.46 }, "kind": "paragraph", "text": "Some may criticize random testing as potentially embarrassing to those who fail, but embarrassment from failing a test on a job is far better than the loss of that job and potentially many more due to failing a real-world incident. Cyber simulations can cause a “fight or flight” response and muscle memory that later helps recognize a potentially bad situation and appropriate reaction.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:10.895+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c5c3e597-b26a-476c-ae48-23a9ddf901c2", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.72, "x": 0.14, "y": 0.24 }, "kind": "paragraph", "text": "It's not enough to train employees by giving them information and then testing for what they remember. It's more important to show them why they need to understand the information, the ramifications for failing to act appropriately, and to randomly test them to see their responses when faced with a decision that could lead to a successful attack.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:10.895+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e7b0281e-52eb-4678-9b1e-395f2381b0f7", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.6, "x": 0.14, "y": 0.15 }, "kind": "title", "text": "Are my employees properly educated about cybersecurity threats?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:10.895+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c42ff98b-0c84-4c2a-8afc-bf2d66a388f6", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-3c8b2e8beb3f", "evidence": "Title is the question 'Are my employees properly educated about cybersecurity threats?'", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 85, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 5, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "One Idea Rule", "slug": "one-idea-rule", "status": "active", "bestFor": null, "canonId": "019dd956-b0f0-7630-a2f5-bb38f9bd9c57", "version": 1, "bodyDocId": null, "description": "Each slide should communicate exactly one concept", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "019dd95a-14f6-720d-8375-428201d1ebff", "evidence": "Single question on the page with one supporting principle in the callout", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 5, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 9, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 4, "name": "Problem & Complication", "beatId": "019dd95a-0702-74a3-87e1-68abc4f9b35a", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "Questions 1-6 enumerate exposure: assets, education, strategy, attack vectors, recovery, prevention", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 55 } ], "loops": [ { "to": 9, "from": 3, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "019dd95a-088c-724c-b30d-fd91b0cb420d", "evidence": "Intro frames the question set, then six distinct, non-overlapping diagnostic questions (assets, training, strategy, attack vectors, recovery, prevention)", "position": 1, "objective": "Enumerate the foundational cybersecurity readiness questions a CEO must diagnose", "confidence": 70, "extraction": { "at": "2026-04-29 13:07:29.689431+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null } } ], "locked": true }, { "page": 6, "type": "analysis", "title": "The slide uses a numbered header '3' suggesting it is part of a larger diagnostic sequence.", "function": "diagnose", "rawType": "diagnosis", "block": null, "metadata": { "slideType": "diagnosis", "slideTypeCanon": { "name": "Diagnosis", "slug": "diagnosis", "status": "active", "canonId": "019de52d-0cd7-7212-898f-0464041ff8d8", "version": 1, "description": null }, "function": "diagnose", "functionCanon": { "name": "Diagnose", "slug": "diagnose", "status": "active", "canonId": "019de52d-1657-7223-acc5-7437d878c850", "version": 1, "description": null }, "density": "dense", "densityScore": 51, "componentCount": 5, "textChars": 1303, "nDataPoints": 0, "notes": "The slide uses a numbered header '3' suggesting it is part of a larger diagnostic sequence.", "elementsJson": [ "paragraph", "numbered_list" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:31:10.917+00", "seconds": 2.547, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a169-54303fbbe19b/6", "deck": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b", "deckAnchor": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b#slide-6", "deckJson": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "It's critical to know how technology is accessed, leveraged, and the impacts of an attack on that technology.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:32:34+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-fefa-773b-abc7-be9efa150abe", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.5, "x": 0.36, "y": 0.44 }, "kind": "list", "text": "Does our cybersecurity strategy address business risk? How?\nIs there an actual risk matrix that identifies specific business risks and how they are addressed from the security perspective?\nAre the board and business unit executives informed about our cybersecurity strategy?\nIs there a regular mechanism of communication and dialogue with the most senior executives around the who, what, where, how of the organization's security strategy and better yet, posture as measured against that strategy?\nHow are we protecting ourselves in case of a breach?\nAre we aligning our cybersecurity strategy with business objectives?\nDo we have the right data governance strategy to minimize cyber risk?\nHow can we operate in case of ransomware attack?\nHow long does it take for us to detect, respond and recover?\nDo we have the right data governance strategy to minimize cyber risk?", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:10.917+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e6b1a64e-a8a2-44bb-bcb5-efc9fdb63f57", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.72, "x": 0.14, "y": 0.23 }, "kind": "paragraph", "text": "It's critical to know how technology is accessed, leveraged, and the impacts of an attack on that technology. Many employees don't fully understand the business impact of a major cyber incident... It's important to have the ability to recover...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:10.917+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ec966b45-afbb-4e09-80e9-5fcb5bf65d18", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.7, "x": 0.08, "y": 0.14 }, "kind": "title", "text": "3 Does our cybersecurity strategy address business risk? How?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:10.917+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f7111e2c-7cb3-4159-b735-0ab6bb751edb", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.2, "x": 0.36, "y": 0.41 }, "kind": "title", "text": "FOLLOW-UP QUESTIONS", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:10.917+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "544d52c2-86a2-43e1-8cba-8972b71e6f8b", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-45268491e828", "evidence": "Title 'Does our cybersecurity strategy address business risk? How?' frames the slide", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 85, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 6, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "One Idea Rule", "slug": "one-idea-rule", "status": "active", "bestFor": null, "canonId": "019dd956-b0f0-7630-a2f5-bb38f9bd9c57", "version": 1, "bodyDocId": null, "description": "Each slide should communicate exactly one concept", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "019dd95a-14f6-720d-8375-4a66627c2e2c", "evidence": "Single strategic question per page format", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 6, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 9, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 4, "name": "Problem & Complication", "beatId": "019dd95a-0702-74a3-87e1-68abc4f9b35a", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "Questions 1-6 enumerate exposure: assets, education, strategy, attack vectors, recovery, prevention", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 55 } ], "loops": [ { "to": 9, "from": 3, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "019dd95a-088c-724c-b30d-fd91b0cb420d", "evidence": "Intro frames the question set, then six distinct, non-overlapping diagnostic questions (assets, training, strategy, attack vectors, recovery, prevention)", "position": 1, "objective": "Enumerate the foundational cybersecurity readiness questions a CEO must diagnose", "confidence": 70, "extraction": { "at": "2026-04-29 13:07:29.689431+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null } } ], "locked": true }, { "page": 7, "type": "appendix", "title": "This slide is part of a series of diagnostic questions, likely for a board or executive leadership team.", "function": "frame_problem", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "frame_problem", "functionCanon": { "name": "Frame problem", "slug": "frame_problem", "status": "active", "canonId": "019de52d-13db-753e-ad70-e9b2d0dab398", "version": 1, "description": null }, "density": "dense", "densityScore": 51, "componentCount": 5, "textChars": 1324, "nDataPoints": 0, "notes": "This slide is part of a series of diagnostic questions, likely for a board or executive leadership team.", "elementsJson": [ "headline_text", "paragraph", "numbered_list" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:31:12.092+00", "seconds": 3.718, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a169-54303fbbe19b/7", "deck": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b", "deckAnchor": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b#slide-7", "deckJson": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b.json" }, "components": [ { "bbox": { "h": 0.02, "w": 0.15, "x": 0.36, "y": 0.47 }, "kind": "callout", "text": "FOLLOW-UP QUESTION", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": null, "subkind": { "name": "Primary callout", "slug": "primary", "status": "active", "canonId": "019de52c-fbd1-70eb-a9ce-8997f8674c1d", "version": 1, "description": null }, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.092+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cc16ca2c-9356-4376-a5bc-9cd95bb7218c", "parentComponentId": null }, { "bbox": null, "kind": "callout", "text": "The goal is to unlock their deep understanding and knowledge of your environment—and what keeps them up at night.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:32:35+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-fefa-773b-abc8-2423b85538b1", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.5, "x": 0.36, "y": 0.5 }, "kind": "list", "text": "What are the top three technology-related issues that could put us out of business today?", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.092+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2d209030-3513-4729-8f9b-17f9a0988489", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.72, "x": 0.14, "y": 0.27 }, "kind": "paragraph", "text": "Answers to this can be very enlightening. It is rare that technology leaders don't know of weaknesses within their environment that could be leveraged to harm the organization. They often will not share this information unless asked specifically. Asking what they know, rather than what they want to share, often leads to more open-ended and transparent answers. If you asked a narrow question designed to limit potential answers, you will get limited, less candid answers. The goal is to unlock their deep understanding and knowledge of your environment—and what keeps them up at night.\n\nKnowing what your technology team thinks is a critical factor in understanding your risk. Are they equipped to make necessary decisions in a vacuum, or should they be made with support from higher-level leadership? Even CIOs may often have a more myopic view of some issues that could benefit from a wider discussion of company risk exposure and tolerance levels.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.092+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "afcacf62-f8cd-475f-91a6-145cda703cff", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.72, "x": 0.14, "y": 0.14 }, "kind": "title", "text": "How would you attempt to attack us, infect our systems with ransomware, steal our data, and otherwise cause us potentially severe disruption and losses?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.092+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3edef029-3025-4b0a-8455-b992edeb3635", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-4e909ed2c618", "evidence": "Title is the long question about attack scenarios", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 7, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Concrete Language", "slug": "concrete-language", "status": "active", "bestFor": null, "canonId": "019dd956-bcd4-7398-9723-6aa72346170b", "version": 1, "bodyDocId": null, "description": "Using specific sensory details instead of abstract terms", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-53474b31ba42", "evidence": "Names specific threats: ransomware, data theft, severe disruption and losses", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 7, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 9, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 4, "name": "Problem & Complication", "beatId": "019dd95a-0702-74a3-87e1-68abc4f9b35a", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "Questions 1-6 enumerate exposure: assets, education, strategy, attack vectors, recovery, prevention", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 55 } ], "loops": [ { "to": 9, "from": 3, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "019dd95a-088c-724c-b30d-fd91b0cb420d", "evidence": "Intro frames the question set, then six distinct, non-overlapping diagnostic questions (assets, training, strategy, attack vectors, recovery, prevention)", "position": 1, "objective": "Enumerate the foundational cybersecurity readiness questions a CEO must diagnose", "confidence": 70, "extraction": { "at": "2026-04-29 13:07:29.689431+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null } } ], "locked": true }, { "page": 8, "type": "analysis", "title": "The slide uses a numbered list format (5) to frame a diagnostic inquiry into organizational resilience.", "function": "diagnose", "rawType": "diagnosis", "block": null, "metadata": { "slideType": "diagnosis", "slideTypeCanon": { "name": "Diagnosis", "slug": "diagnosis", "status": "active", "canonId": "019de52d-0cd7-7212-898f-0464041ff8d8", "version": 1, "description": null }, "function": "diagnose", "functionCanon": { "name": "Diagnose", "slug": "diagnose", "status": "active", "canonId": "019de52d-1657-7223-acc5-7437d878c850", "version": 1, "description": null }, "density": "dense", "densityScore": 52, "componentCount": 6, "textChars": 759, "nDataPoints": 0, "notes": "The slide uses a numbered list format (5) to frame a diagnostic inquiry into organizational resilience.", "elementsJson": [ "paragraph", "bullet_list", "numbered_list" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:31:11.212+00", "seconds": 2.81, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a169-54303fbbe19b/8", "deck": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b", "deckAnchor": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b#slide-8", "deckJson": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b.json" }, "components": [ { "bbox": { "h": 0.03, "w": 0.5, "x": 0.36, "y": 0.82 }, "kind": "callout", "text": "FOLLOW-UP QUESTIONS", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": null, "subkind": { "name": "Primary callout", "slug": "primary", "status": "active", "canonId": "019de52c-fbd1-70eb-a9ce-8997f8674c1d", "version": 1, "description": null }, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.212+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9d55c24b-d41e-4353-a44f-46e595a34768", "parentComponentId": null }, { "bbox": null, "kind": "callout", "text": "Ask for evidence of the following: Incident Response Plans, Disaster Recovery Plans, Business Continuity Plans, and Insider Protections.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:32:32+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-fefa-773b-abc6-b9a339b71b08", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.5, "x": 0.36, "y": 0.85 }, "kind": "list", "text": "Can our IT department demonstrate the right reporting and systems? What are you monitoring and measuring to make sure we are protected?", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.212+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "576e2400-a306-465c-b135-6ab4faeeb0dc", "parentComponentId": null }, { "bbox": { "h": 0.5, "w": 0.72, "x": 0.14, "y": 0.33 }, "kind": "list", "text": "Incident Response Plans; Disaster Recovery Plans; Business Continuity Plans; Insider Protections", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.212+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d3bf5cea-099c-454d-b864-6a043824285f", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.72, "x": 0.14, "y": 0.21 }, "kind": "paragraph", "text": "Many organizations do not have a plan for recovering from a major attack quickly. Key issues such as reducing downtime, preventing, or minimizing revenue loss, addressing customers' experiences during a recovery, and minimizing recovery costs must be addressed before an incident occurs.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.212+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "caae466f-a332-4cf5-aae3-3dd6d8d2fe4b", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.72, "x": 0.14, "y": 0.14 }, "kind": "title", "text": "If we were hit by a major attack, how confident are you that we could recover quickly?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.212+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b7b3b42a-2c62-4ef2-85ac-540b83210abe", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "MECE Principle", "slug": "mece-principle", "status": "active", "bestFor": null, "canonId": "019dd956-7c60-71a8-8758-c79d914489c9", "version": 1, "bodyDocId": null, "description": "Mutually Exclusive, Collectively Exhaustive - ensuring complete, non-overlapping structure", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "block", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-59c07161b02b", "evidence": "Body breaks recovery into four distinct categories: Incident Response, Disaster Recovery, Business Continuity, Insider Protections", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 75, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 8, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-5550f39edc1c", "evidence": "Title 'If we were hit by a major attack, how confident are you that we could recover quickly?'", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 85, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 8, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Audience Definition", "slug": "audience-definition", "status": "active", "bestFor": null, "canonId": "019dd956-7f2a-775d-aeee-ff099bcb7756", "version": 1, "bodyDocId": null, "description": "Six key questions: Who are they? What do they know? What do they believe? What do they care about? What do they fear? What decisions can they make?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "11afde9d-8f67-48fa-a945-98f0f997e4a4", "evidence": "If we were hit by a major attack, how confident are you that we could recover quickly?", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 21:36:27.506056+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 8, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Concrete Language", "slug": "concrete-language", "status": "active", "bestFor": null, "canonId": "019dd956-bcd4-7398-9723-6aa72346170b", "version": 1, "bodyDocId": null, "description": "Using specific sensory details instead of abstract terms", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-5f9c0d855073", "evidence": "Lists four named, defined plan types with specific evidence to demand", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 75, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 8, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Problem Statement Canvas", "slug": "problem-statement-canvas", "status": "active", "bestFor": null, "canonId": "019dd956-839d-744b-ad11-9bf3e3642a18", "version": 1, "bodyDocId": null, "description": "Structured definition of the problem: What? Who? Where? When? Scale?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "76e02382-c96f-48ac-8fb5-e39bbe928d38", "evidence": "Many organizations do not have a plan for recovering from a major attack quickly. Key issues such as reducing downtime, preventing, or minimizing revenue loss, addressing customers' experiences durin", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 21:36:27.466164+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 8, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [ { "matchId": "85637326-a915-4c85-9bc2-f085f88b806e", "evidence": "The slide poses a diagnostic question and provides a checklist of evidence to evaluate organizational readiness.", "framework": null, "confidence": 0.8, "extraction": { "at": "2026-05-02 18:31:11.212+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 8, "frameworkName": "diagnostic-test" } ], "arcBeats": [ { "to": 9, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 4, "name": "Problem & Complication", "beatId": "019dd95a-0702-74a3-87e1-68abc4f9b35a", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "Questions 1-6 enumerate exposure: assets, education, strategy, attack vectors, recovery, prevention", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 55 } ], "loops": [ { "to": 9, "from": 3, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "019dd95a-088c-724c-b30d-fd91b0cb420d", "evidence": "Intro frames the question set, then six distinct, non-overlapping diagnostic questions (assets, training, strategy, attack vectors, recovery, prevention)", "position": 1, "objective": "Enumerate the foundational cybersecurity readiness questions a CEO must diagnose", "confidence": 70, "extraction": { "at": "2026-04-29 13:07:29.689431+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null } } ], "locked": true }, { "page": 9, "type": "appendix", "title": "Part of a series of diagnostic questions for cybersecurity assessment.", "function": "diagnose", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "diagnose", "functionCanon": { "name": "Diagnose", "slug": "diagnose", "status": "active", "canonId": "019de52d-1657-7223-acc5-7437d878c850", "version": 1, "description": null }, "density": "balanced", "densityScore": 46, "componentCount": 5, "textChars": 857, "nDataPoints": 0, "notes": "Part of a series of diagnostic questions for cybersecurity assessment.", "elementsJson": [ "headline_text", "paragraph", "bullet_list" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:31:11.234+00", "seconds": 2.701, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a169-54303fbbe19b/9", "deck": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b", "deckAnchor": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b#slide-9", "deckJson": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "In order to properly evaluate an organization's cybersecurity program, it's incredibly important for business leadership to understand the current systems in place.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:57:09+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-0a6c-76ba-8e74-571714361ca4", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.55, "x": 0.36, "y": 0.35 }, "kind": "list", "text": "How do you know our measures are effective, i.e., can you demonstrate how you are following best practices?\nHas anyone (outside of the organization) reviewed and verified that we have sufficient preventative measures in place?", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.234+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2059af09-b836-482f-9f0d-ce5d3f7d915a", "parentComponentId": null }, { "bbox": { "h": 0.07, "w": 0.72, "x": 0.14, "y": 0.21 }, "kind": "paragraph", "text": "In order to properly evaluate an organization's cybersecurity program, it's incredibly important for business leadership to understand the current systems in place. In particular, the tools deployed to prevent or reduce threats potentially impacting the organization. These systems should be verified, documented, and tested frequently with detailed reporting output.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.234+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3c42a189-536f-49c5-a88f-08388774ad13", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.82, "x": 0.09, "y": 0.14 }, "kind": "title", "text": "6 What preventative measures have you implemented already to protect our company?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.234+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4db6c522-f21e-4920-980a-09ae6469731b", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.23, "x": 0.36, "y": 0.32 }, "kind": "title", "text": "FOLLOW-UP QUESTIONS", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.234+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "68109fd9-70d9-498f-8570-aed906d2d060", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-63aa75ef9b39", "evidence": "Title is the prevention question itself", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 9, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Audience Definition", "slug": "audience-definition", "status": "active", "bestFor": null, "canonId": "019dd956-7f2a-775d-aeee-ff099bcb7756", "version": 1, "bodyDocId": null, "description": "Six key questions: Who are they? What do they know? What do they believe? What do they care about? What do they fear? What decisions can they make?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "9007a3ee-2bc5-4a40-85ea-993d33af9c04", "evidence": "In order to properly evaluate an organization's cybersecurity program, it's incredibly important for business leadership to understand the current systems in place.", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 21:36:27.586578+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 9, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "One Idea Rule", "slug": "one-idea-rule", "status": "active", "bestFor": null, "canonId": "019dd956-b0f0-7630-a2f5-bb38f9bd9c57", "version": 1, "bodyDocId": null, "description": "Each slide should communicate exactly one concept", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "019dd95a-14f6-720d-8375-67f6d2b06654", "evidence": "Whole slide on the single preventative-measures question", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 75, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 9, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 9, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 4, "name": "Problem & Complication", "beatId": "019dd95a-0702-74a3-87e1-68abc4f9b35a", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "Questions 1-6 enumerate exposure: assets, education, strategy, attack vectors, recovery, prevention", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 55 } ], "loops": [ { "to": 9, "from": 3, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "019dd95a-088c-724c-b30d-fd91b0cb420d", "evidence": "Intro frames the question set, then six distinct, non-overlapping diagnostic questions (assets, training, strategy, attack vectors, recovery, prevention)", "position": 1, "objective": "Enumerate the foundational cybersecurity readiness questions a CEO must diagnose", "confidence": 70, "extraction": { "at": "2026-04-29 13:07:29.689431+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null } } ], "locked": true }, { "page": 10, "type": "setup", "title": "The slide uses a large '7' as a section marker, typical of a deck structure.", "function": "transition", "rawType": "section_divider", "block": null, "metadata": { "slideType": "section_divider", "slideTypeCanon": { "name": "Section divider", "slug": "section_divider", "status": "active", "canonId": "019de52d-066a-7402-9554-6ae504999041", "version": 1, "description": null }, "function": "transition", "functionCanon": { "name": "Transition", "slug": "transition", "status": "active", "canonId": "019de52d-1365-7149-92aa-66df859e75fd", "version": 1, "description": null }, "density": "dense", "densityScore": 73, "componentCount": 7, "textChars": 1547, "nDataPoints": 2, "notes": "The slide uses a large '7' as a section marker, typical of a deck structure.", "elementsJson": [ "paragraph", "numbered_list" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:31:11.824+00", "seconds": 2.929, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a169-54303fbbe19b/10", "deck": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b", "deckAnchor": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b#slide-10", "deckJson": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b.json" }, "components": [ { "bbox": { "h": 0.02, "w": 0.2, "x": 0.36, "y": 0.47 }, "kind": "callout", "text": "FOLLOW-UP QUESTIONS", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": null, "subkind": { "name": "Primary callout", "slug": "primary", "status": "active", "canonId": "019de52c-fbd1-70eb-a9ce-8997f8674c1d", "version": 1, "description": null }, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.824+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "32cc0c8a-810e-493a-9ec9-99f7f73fcadc", "parentComponentId": null }, { "bbox": null, "kind": "callout", "text": "The beauty of a cybersecurity program is that all initiatives ultimately lead back to tangible risks, which allows for your organization to establish a quantifiable action to address said risk.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:32:31+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-fefa-773b-abc6-7f3f39554c14", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.45, "x": 0.36, "y": 0.5 }, "kind": "list", "text": "What KPIs do you use?\nDo you have leading or lagging indicators of our organization's cyber health?", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.824+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "185c778d-6ea9-4624-a6a0-2bc13ed7b3bb", "parentComponentId": null }, { "bbox": { "h": 0.11, "w": 0.72, "x": 0.14, "y": 0.36 }, "kind": "paragraph", "text": "But one of the most exciting elements of building an evolving security program is that as your program matures, your metrics become more advanced. You begin to establish Key Risk Indicators (KRI) and Key Performance Indicators (KPI) that can tie back to monetary values. For example, you might scope the expected impact of a ransomware attack to your organization once every four years and calculate that the expected impact of the attack would be $500,000. Divided across four years, you've successfully just calculated an annualized expected cost of $125,000 for your organization that can now be budgeted for.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.824+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5d4417ad-33e6-4ead-bd37-83188eb9eb52", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.72, "x": 0.14, "y": 0.22 }, "kind": "paragraph", "text": "In order to maintain an ever-evolving, ever-maturing security program, it's paramount that your organization leverage clear objectives and metrics wherever possible. The beauty of a cybersecurity program is that all initiatives ultimately lead back to tangible risks, which allows for your organization to establish a quantifiable action to address said risk.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.824+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "980667ca-2fcc-4aa4-b1b4-ff9ffee97e81", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.72, "x": 0.14, "y": 0.31 }, "kind": "paragraph", "text": "These quantified metrics can be something simple, like a calculation of how many of your IT controls passed vs. failed during an assessment, or how many new hires had a background check and how many did not.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.824+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "df4545b8-b02c-4f8a-9acc-2784e49b1764", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.65, "x": 0.08, "y": 0.14 }, "kind": "title", "text": "7 How do you measure and manage our cybersecurity program?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:11.824+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ba100900-3c50-4c49-afb2-9f39f23adf44", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Anaphora", "slug": "anaphora", "status": "active", "bestFor": null, "canonId": "019dd956-9fee-74aa-a920-078aa44132c0", "version": 1, "bodyDocId": null, "description": "Repeating words at the beginning of successive clauses for rhythm", "familyLabel": null, "categoryName": "Loop", "categorySlug": "loop" }, "agent": "Storyteller", "layer": "loop", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-73c1a6d91c6b", "evidence": "Continues 'How do you...' question opener pattern across Q7-Q10", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 10, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-6973bea414dd", "evidence": "Title 'How do you measure and manage our cybersecurity program?'", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 10, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Pyramid Principle", "slug": "pyramid-principle", "status": "active", "bestFor": "When the document has a single governing decision or recommendation the reader is asked to accept, and the case can be decomposed into a small number of clean groups. Strategy decks, board memos, investment committee papers.", "canonId": "019dd956-7cbd-7219-a477-c871e2bc1aff", "version": 1, "bodyDocId": "88b6ac56-b880-46f9-8621-ef3491ab6235", "description": "Lead with the answer; group three to five MECE supports beneath it; recurse one level down. Top-down hierarchical structure for any document with a single recommendation.", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "2e7a68df-e557-4679-9d9f-8f209951c964", "evidence": "But one of the most exciting elements of building an evolving security program is that as your program matures, your metrics become more advanced.", "pageRefs": null, "priority": "Core", "whenToUse": "When the document has a single governing decision or recommendation the reader is asked to accept, and the case can be decomposed into a small number of clean groups. Strategy decks, board memos, investment committee papers.", "confidence": 0.7, "extraction": { "at": "2026-07-16 21:36:27.66606+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 10, "whyItWorks": "Solves the two failure modes of expert communication at once: (1) the long climb where readers wait pages for the answer, and (2) logical mush from non-MECE groupings. Progressive disclosure lets a reader stop at any depth and get the right information.", "antipattern": "Chronological structure (\"what we did, what we found, what we conclude\") instead of logical hierarchy. Top-of-pyramid that is a topic (\"strategic options\") instead of an answer (\"pursue Option B because...\"). Non-MECE supports that overlap or fail to cover the universe.", "cardinality": null, "narrativePurpose": "Transfer conviction with minimum reader effort by mirroring how decision-makers consume information: answer first, scaffolding behind." }, { "tool": { "name": "So What? Test", "slug": "so-what-test", "status": "active", "bestFor": "On every slide carrying a chart, number, list, or finding intended to inform a decision; whenever a draft title is descriptive rather than directive; whenever the deck will circulate without its author.", "canonId": "019dd956-acd2-76f8-b59a-9bf15a89f10a", "version": 1, "bodyDocId": "fec04b06-b2f1-432b-a97b-916dc7563f64", "description": "The recursive editorial discipline of asking so-what of every slide, chart, and statement until the answer is an implication for the audience — that final answer becomes the slide's title; the chain becomes its body.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-6ffbe15b2137", "evidence": "Callout states the so-what: 'all initiatives ultimately lead back to tangible risks'", "pageRefs": null, "priority": "Core", "whenToUse": "On every slide carrying a chart, number, list, or finding intended to inform a decision; whenever a draft title is descriptive rather than directive; whenever the deck will circulate without its author.", "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 10, "whyItWorks": "Solves the two failure modes of analytical communication at once: stopping at description (analyst-confidence problem) and leaving insight stranded in the analyst's head (translation problem). The recursion is what guarantees the implication makes it into ink.", "antipattern": "Stopping at the first tighter description (still a fact, not an implication), regressing past the audience's decision space into philosophy, smuggling the so-what into speaker notes, or re-using an implication aimed at a previous audience.", "cardinality": null, "narrativePurpose": "Forces every analytical artefact to close the gap between fact and decision, so the reader holds the recommendation by reading titles alone rather than reconstructing the analyst's mental model from raw evidence." } ], "frameworks": [], "arcBeats": [ { "to": 11, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 10, "name": "Solution & Approach", "beatId": "019dd95a-0702-74a3-87e1-6dec5482820e", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "Q7-8 prescribe measurement program and budget allocation method", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 55 } ], "loops": [ { "to": 14, "from": 10, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "019dd95a-088c-724c-b30e-0316b53f0e64", "evidence": "Q7-Q11 cover distinct management levers: measurement, budget, threat outlook, talent, current risks", "position": 2, "objective": "Enumerate the operational/strategic management dimensions of a cybersecurity program", "confidence": 65, "extraction": { "at": "2026-04-29 13:07:29.689431+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null } } ], "locked": true }, { "page": 11, "type": "tension", "title": "The slide uses a numbered list format (8) suggesting it is part of a larger series of questions.", "function": "frame_problem", "rawType": "problem_statement", "block": null, "metadata": { "slideType": "problem_statement", "slideTypeCanon": { "name": "Problem statement", "slug": "problem_statement", "status": "active", "canonId": "019de52d-0879-768d-bba8-8da8a5a121d4", "version": 1, "description": null }, "function": "frame_problem", "functionCanon": { "name": "Frame problem", "slug": "frame_problem", "status": "active", "canonId": "019de52d-13db-753e-ad70-e9b2d0dab398", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 84, "componentCount": 9, "textChars": 1488, "nDataPoints": 1, "notes": "The slide uses a numbered list format (8) suggesting it is part of a larger series of questions.", "elementsJson": [ "paragraph", "numbered_list" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:31:12.11+00", "seconds": 3.129, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a169-54303fbbe19b/11", "deck": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b", "deckAnchor": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b#slide-11", "deckJson": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Experts advise that 10% to 15% of an organization's IT budget be allocated for protection against data breaches and cybersecurity attacks.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:32:32+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-fefa-773b-abc6-f352e2597e52", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.5, "x": 0.36, "y": 0.5 }, "kind": "list", "text": "What percentage of our IT budget is allocated for cybersecurity?\nHow do we determine that percentage each year?\nDo we calculate potential business loss caused by an attack?", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.11+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5bd0b760-bbe6-4dd4-98a3-f0ecc7843d81", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "IT budget allocation: 10% to 15%", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:32:32+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-fefa-773b-abc6-f8607706cd1e", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.72, "x": 0.14, "y": 0.46 }, "kind": "paragraph", "text": "Experts advise that 10% to 15% of an organization's IT budget be allocated for protection against data breaches and cybersecurity attacks. The higher your current risk, the larger the investment needed. Estimate your value of your company's net worth, including risk of down time, should a cyberattack happen, to determine the value of business loss.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.11+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7b8398fe-5e51-4c20-be99-bf936810a3af", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.72, "x": 0.14, "y": 0.22 }, "kind": "paragraph", "text": "As cyber threats continue to increase, aligning appropriate budget with technology risk management should be a top priority. Cybersecurity spend is like having insurance. It may be hard to measure, but it is required to reduce risk of revenue loss, customer information, intellectual property, company downtime, and reputation.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.11+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "83952026-9273-4b91-b4d7-8378825b1411", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.72, "x": 0.14, "y": 0.35 }, "kind": "paragraph", "text": "No matter how many technology companies you have incorporated or how good you believe your cyber hygiene, there's always room for improvement. Most CISOs and companies don't have an infinite budget, but cybersecurity spend is an essential cost of doing business: \"an ounce of prevention is better than a pound of cure.\"", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.11+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c40b5fb4-9286-43d0-9e66-0af904054b9c", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "an ounce of prevention is better than a pound of cure.", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:32:32+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-fefa-773b-abc6-f48f34340750", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.8, "x": 0.08, "y": 0.14 }, "kind": "title", "text": "8 How do you determine the appropriate budget for technology risk management?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.11+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "fa21d83b-85ef-4795-a0e9-ce10dc363ecd", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.2, "x": 0.36, "y": 0.47 }, "kind": "title", "text": "FOLLOW-UP QUESTIONS", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.11+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "147239d5-0ecc-4a14-9654-5ffbd97a9da7", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-759b1f9360e7", "evidence": "Title is the budget question", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 11, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Authority Bias", "slug": "authority-bias", "status": "active", "bestFor": null, "canonId": "019dd956-c38d-70b9-a284-b2b479763356", "version": 1, "bodyDocId": null, "description": "Expert opinions are weighted more heavily - cite credible sources", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Architect", "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-7f638a3e821a", "evidence": "'Experts advise...' frames the 10-15% figure as expert guidance", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 11, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Concrete Language", "slug": "concrete-language", "status": "active", "bestFor": null, "canonId": "019dd956-bcd4-7398-9723-6aa72346170b", "version": 1, "bodyDocId": null, "description": "Using specific sensory details instead of abstract terms", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-7adac571b0a3", "evidence": "Quantified prescription: '10% to 15% of an organization's IT budget'", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 85, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 11, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Problem Statement Canvas", "slug": "problem-statement-canvas", "status": "active", "bestFor": null, "canonId": "019dd956-839d-744b-ad11-9bf3e3642a18", "version": 1, "bodyDocId": null, "description": "Structured definition of the problem: What? Who? Where? When? Scale?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "48376359-c645-47b4-bf85-437c57cc33f3", "evidence": "Experts advise that 10% to 15% of an organization's IT budget be allocated for protection against data breaches and cybersecurity attacks.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 21:36:27.744976+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 11, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "af600721-2b81-4b8b-abc9-bb3155c45129", "evidence": "IT budget allocation: 10% to 15%", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 21:36:27.785561+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 11, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 11, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 10, "name": "Solution & Approach", "beatId": "019dd95a-0702-74a3-87e1-6dec5482820e", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "Q7-8 prescribe measurement program and budget allocation method", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 55 } ], "loops": [ { "to": 14, "from": 10, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "019dd95a-088c-724c-b30e-0316b53f0e64", "evidence": "Q7-Q11 cover distinct management levers: measurement, budget, threat outlook, talent, current risks", "position": 2, "objective": "Enumerate the operational/strategic management dimensions of a cybersecurity program", "confidence": 65, "extraction": { "at": "2026-04-29 13:07:29.689431+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null } } ], "locked": true }, { "page": 12, "type": "setup", "title": "The slide uses a large number '9' as a section marker.", "function": "transition", "rawType": "transition", "block": null, "metadata": { "slideType": "transition", "slideTypeCanon": { "name": "Transition", "slug": "transition", "status": "active", "canonId": "019de52d-0693-7766-9f05-887f41f8e41e", "version": 1, "description": null }, "function": "transition", "functionCanon": { "name": "Transition", "slug": "transition", "status": "active", "canonId": "019de52d-1365-7149-92aa-66df859e75fd", "version": 1, "description": null }, "density": "dense", "densityScore": 51, "componentCount": 5, "textChars": 1316, "nDataPoints": 0, "notes": "The slide uses a large number '9' as a section marker.", "elementsJson": [ "paragraph", "numbered_list" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:31:12.752+00", "seconds": 3.505, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a169-54303fbbe19b/12", "deck": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b", "deckAnchor": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b#slide-12", "deckJson": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "It's critical that businesses respond appropriately and quickly to address the continually changing threat landscape.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:32:33+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-fefa-773b-abc7-69d1dd95d190", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.5, "x": 0.36, "y": 0.5 }, "kind": "list", "text": "What is driving our resilience strategy?\nWhat are we doing specifically to respond to address evolving risks?", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.752+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "972f7484-79c5-45e9-8409-8b867f79bc00", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.72, "x": 0.14, "y": 0.21 }, "kind": "paragraph", "text": "Companies failed to anticipate the impact posed by a global pandemic, sacrificing security process in the interest of business continuity and availability. Workers moved to unmanaged home networks and IT and security teams lost visibility to what devices had access to high-value data, applications, and the health of connected devices.\nThe outcome was not unexpected: 2020 was the worst year on record for cyber-attacks and 2021 has been more of the same. Many organizations did not survive, primarily SMBs that lacked resources to adapt their security posture.\nBut the trend is not completely new. Organization attack surfaces have continually increased as data, infrastructure and applications shift to the center of business and society. Our digital economy has become fragile and faces an inflection point of how we adapt and survive a potential if not already forming cyber pandemic.\nIt's critical that businesses respond appropriately and quickly to address the continually changing threat landscape.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.752+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b3b8ee02-0392-478e-b24b-5a63dbefe46f", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.8, "x": 0.08, "y": 0.14 }, "kind": "title", "text": "9 What does the threat outlook mean to your resilience strategy?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.752+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "14af6ab4-6778-4bf4-8531-a6d389cc4383", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.2, "x": 0.36, "y": 0.47 }, "kind": "title", "text": "FOLLOW-UP QUESTIONS", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:12.752+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f9d041e1-f08c-47b1-b87e-846a0209b194", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-821c741a49ec", "evidence": "Title is the threat-outlook question", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 12, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "One Idea Rule", "slug": "one-idea-rule", "status": "active", "bestFor": null, "canonId": "019dd956-b0f0-7630-a2f5-bb38f9bd9c57", "version": 1, "bodyDocId": null, "description": "Each slide should communicate exactly one concept", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "019dd95a-14f6-720d-8375-85a3f88a4651", "evidence": "Single threat-outlook question per slide", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 75, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 12, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 13, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 12, "name": "Evidence & Proof", "beatId": "019dd95a-0702-74a3-87e1-717aa3475ad1", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Evidence & Proof", "slug": "consultants-gambit-evidence-proof", "status": "active", "canonId": "019dd9b8-07b1-7688-8e1e-7637fec3802a", "version": 1, "description": null }, "evidence": "Q9-10 cite expert guidance on threat outlook and talent strategy", "position": 4, "isPrimaryArc": true, "parentBeatType": { "name": "Evidence", "slug": "evidence", "status": "active", "canonId": "019dd9b8-03f9-772a-b84a-4f07b415b77a", "version": 1, "description": "A dedicated proof beat exists in only ~4 arcs (Gambit, Sequoia, AIDA, Monroes). Other arcs embed evidence inline within development." }, "alignedBlockIds": null, "matchConfidence": 55 } ], "loops": [ { "to": 14, "from": 10, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "019dd95a-088c-724c-b30e-0316b53f0e64", "evidence": "Q7-Q11 cover distinct management levers: measurement, budget, threat outlook, talent, current risks", "position": 2, "objective": "Enumerate the operational/strategic management dimensions of a cybersecurity program", "confidence": 65, "extraction": { "at": "2026-04-29 13:07:29.689431+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null } } ], "locked": true }, { "page": 13, "type": "tension", "title": "The slide uses a numbered header '10' suggesting it is part of a larger series of questions or steps.", "function": "frame_problem", "rawType": "problem_statement", "block": null, "metadata": { "slideType": "problem_statement", "slideTypeCanon": { "name": "Problem statement", "slug": "problem_statement", "status": "active", "canonId": "019de52d-0879-768d-bba8-8da8a5a121d4", "version": 1, "description": null }, "function": "frame_problem", "functionCanon": { "name": "Frame problem", "slug": "frame_problem", "status": "active", "canonId": "019de52d-13db-753e-ad70-e9b2d0dab398", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 78, "componentCount": 8, "textChars": 2621, "nDataPoints": 0, "notes": "The slide uses a numbered header '10' suggesting it is part of a larger series of questions or steps.", "elementsJson": [ "paragraph", "numbered_list" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:31:13.815+00", "seconds": 4.521, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a169-54303fbbe19b/13", "deck": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b", "deckAnchor": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b#slide-13", "deckJson": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Don't have the philosophy of asking for 110% of skills required and then hiring a candidate with 80% of the skills listed.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:32:32+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-fefa-773b-abc6-a242555df596", "parentComponentId": null }, { "bbox": { "x": 0.36, "y": 0.66 }, "kind": "list", "text": "Do we know which resources are necessary vs. optional? Have we developed qualifications for all cyber personnel? What's our biggest challenge in hiring cyber talent?", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:13.815+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1048586b-3436-4348-8f75-20b3191f9640", "parentComponentId": null }, { "bbox": { "x": 0.14, "y": 0.52 }, "kind": "paragraph", "text": "Don't forget to have the information security manager work with HR to create the right requirements documents and hire the right candidates. After defining the requirements for the role including educational background, work experience, certifications, and degrees, the manager should communicate those clearly to HR in the job description. Additionally, it should be clear which requirements are absolute and which may be optional. Job descriptions should be written realistically. Don't have the philosophy of asking for 110% of skills required and then hiring a candidate with 80% of the skills listed. This approach often backfires and means fewer qualified candidates apply which is why it's so important for the manager to work with HR on realistic and fillable descriptions. Descriptions should also use gender neutral wording.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:13.815+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0872aebc-f7cf-4c37-b765-6bb563dffa54", "parentComponentId": null }, { "bbox": { "x": 0.14, "y": 0.37 }, "kind": "paragraph", "text": "Use the matrix above to assess the current talent pool and determine overlaps and gaps in staffing. Build out a plan to address the gaps and eliminate any overlaps. You may find that overlapped roles can help fill in gaps.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:13.815+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2ab90c8f-ad79-4571-a6a1-46d2eddcd960", "parentComponentId": null }, { "bbox": { "x": 0.14, "y": 0.42 }, "kind": "paragraph", "text": "It's important to identify required qualifications for all cybersecurity personnel. The qualifications should be based on the role and responsibilities associated with and required for specific roles. A data center or NOC/SOC manager may need to be on premise and have physical security expertise to ensure the center is properly secured, but a threat hunter may be able to work from anywhere and have no physical security expertise. Role qualifications should be revisited at least once per year to ensure personnel are current with modern certifications and critical learning paths.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:13.815+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6d777e5b-1c74-43bc-9435-32caf0b68adb", "parentComponentId": null }, { "bbox": { "x": 0.14, "y": 0.27 }, "kind": "paragraph", "text": "To attract the best cyber talent, start with a resource requirements matrix that includes current requirements and planned resource needs for the next six to 12 months. The matrix should include key decision points such as cost of resources (hourly or subscription), preferred channel (contractor, FTE, managed service provider), and any regulatory constraints or overhead. Note that the matrix will most likely include headcount and resources across multiple areas and lines of business within the organization.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:13.815+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c44e80ff-006b-41e9-bca6-4cc6631cf21e", "parentComponentId": null }, { "bbox": { "x": 0.06, "y": 0.14 }, "kind": "title", "text": "10 How do you find, recruit, and retain the best cyber talent available, or find the best combination of managed services and cyber talent in a competitive market?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:13.815+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "067174a5-8e5a-4280-bbf9-bdf1fc60e055", "parentComponentId": null }, { "bbox": { "x": 0.36, "y": 0.64 }, "kind": "title", "text": "FOLLOW-UP QUESTIONS", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:13.815+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9fd43f27-01c6-4d0a-88b3-66c4f66d49bf", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-8a51b7db96f9", "evidence": "Title is the talent recruiting/retention question", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 13, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Concrete Language", "slug": "concrete-language", "status": "active", "bestFor": null, "canonId": "019dd956-bcd4-7398-9723-6aa72346170b", "version": 1, "bodyDocId": null, "description": "Using specific sensory details instead of abstract terms", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-8e5d5a10ebd6", "evidence": "Concrete rule: don't ask for '110% of skills' then hire at '80%'", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 13, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Problem Statement Canvas", "slug": "problem-statement-canvas", "status": "active", "bestFor": null, "canonId": "019dd956-839d-744b-ad11-9bf3e3642a18", "version": 1, "bodyDocId": null, "description": "Structured definition of the problem: What? Who? Where? When? Scale?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "c9e7f04d-5450-43f5-9d4a-8bc71de1f081", "evidence": "Don't forget to have the information security manager work with HR to create the right requirements documents and hire the right candidates.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 21:36:27.903868+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 13, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 13, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 12, "name": "Evidence & Proof", "beatId": "019dd95a-0702-74a3-87e1-717aa3475ad1", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Evidence & Proof", "slug": "consultants-gambit-evidence-proof", "status": "active", "canonId": "019dd9b8-07b1-7688-8e1e-7637fec3802a", "version": 1, "description": null }, "evidence": "Q9-10 cite expert guidance on threat outlook and talent strategy", "position": 4, "isPrimaryArc": true, "parentBeatType": { "name": "Evidence", "slug": "evidence", "status": "active", "canonId": "019dd9b8-03f9-772a-b84a-4f07b415b77a", "version": 1, "description": "A dedicated proof beat exists in only ~4 arcs (Gambit, Sequoia, AIDA, Monroes). Other arcs embed evidence inline within development." }, "alignedBlockIds": null, "matchConfidence": 55 } ], "loops": [ { "to": 14, "from": 10, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "019dd95a-088c-724c-b30e-0316b53f0e64", "evidence": "Q7-Q11 cover distinct management levers: measurement, budget, threat outlook, talent, current risks", "position": 2, "objective": "Enumerate the operational/strategic management dimensions of a cybersecurity program", "confidence": 65, "extraction": { "at": "2026-04-29 13:07:29.689431+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null } } ], "locked": true }, { "page": 14, "type": "analysis", "title": "The slide uses a '11' numbering, likely indicating a section or sequence number. It includes a decorative wave graphic.", "function": "diagnose", "rawType": "diagnosis", "block": null, "metadata": { "slideType": "diagnosis", "slideTypeCanon": { "name": "Diagnosis", "slug": "diagnosis", "status": "active", "canonId": "019de52d-0cd7-7212-898f-0464041ff8d8", "version": 1, "description": null }, "function": "diagnose", "functionCanon": { "name": "Diagnose", "slug": "diagnose", "status": "active", "canonId": "019de52d-1657-7223-acc5-7437d878c850", "version": 1, "description": null }, "density": "dense", "densityScore": 61, "componentCount": 6, "textChars": 1642, "nDataPoints": 0, "notes": "The slide uses a '11' numbering, likely indicating a section or sequence number. It includes a decorative wave graphic.", "elementsJson": [ "paragraph", "numbered_list" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:31:17.204+00", "seconds": 7.309, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a169-54303fbbe19b/14", "deck": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b", "deckAnchor": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b#slide-14", "deckJson": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Managing risk and ensuring continuity takes an organization level commitment to a culture of resilience.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 14:32:32+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd951-fefa-773b-abc7-222bac9891bf", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.5, "x": 0.36, "y": 0.47 }, "kind": "list", "text": "Are we monitoring for threats across the enterprise specific to our risk?\nDoes our monitoring include non-persistent connection (e.g., BYOD, remote workers, IoT)?\nWhat is our visibility to attack life cycle? What do you see? Where? When?\nHow do we manage our supply chain threats?\nDo you know your actual attack surface?", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:17.204+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "eb28e4b6-ae8c-489d-9e99-731a738a173b", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.72, "x": 0.14, "y": 0.26 }, "kind": "paragraph", "text": "Managing risk and ensuring continuity takes an organization level commitment to a culture of resilience. Many areas for improvement are operational: a lack of proper planning and preparation for adversity, siloed teams without insight into systemwide operational interdependencies or aligned to business risk, and the transformation of risk management to an operational activity. Resilience requires bringing the areas of risk management, business continuity, and IT/Dev/Sec ops together to produce a secure by design operational process supporting mission critical functions.\n\nOf course, each business is different, and not all data, infrastructure, applications, systems, and source code are equally mission-critical or valuable to that organization. On the other hand, access to some seemingly less critical systems can serve as an entry point for an attacker as everything is connected and one human or technical error can lead to a crippling attack.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:17.204+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "532f0b71-5c08-447b-9a3c-f500faf9e381", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.72, "x": 0.14, "y": 0.2 }, "kind": "paragraph", "text": "How do we know we have full visibility of those threats? Do we have visibility across all systems or just critical infrastructure? What steps (if any) have we done to reduce them?", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:17.204+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "71dec8a0-1bb9-4c21-9288-aa2672364a23", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.65, "x": 0.14, "y": 0.14 }, "kind": "title", "text": "What types of risks are currently threatening our network/systems?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:17.204+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3ce53f1c-b711-40bc-ad4d-53c59f7d0eaf", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.2, "x": 0.36, "y": 0.44 }, "kind": "title", "text": "FOLLOW-UP QUESTIONS", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:17.204+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7505ae96-71c8-4592-80ca-5bde4d6941e0", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Action Titles", "slug": "action-titles", "status": "active", "bestFor": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "canonId": "019dd956-ac70-700b-a608-ba58e78f5dcc", "version": 1, "bodyDocId": "816dad3c-9983-41c1-a86e-978ebd582841", "description": "The McKinsey-bred discipline of writing every slide title as a complete declarative sentence with a verb and an insight, not a topic label. Each title is a sub-claim that ladders up to the deck's governing thought; read in sequence, the titles reconstruct the executive summary.", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "019dd95a-14f6-720d-8375-90a779167daf", "evidence": "Title 'What types of risks are currently threatening our network/systems?'", "pageRefs": null, "priority": "Core", "whenToUse": "Any decision-grade deliverable — strategy recommendation, board update, investment memo, M&A review, post-mortem — where the reader is being asked to agree, decide, or act and will skim the title bar at speed.", "confidence": 80, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 14, "whyItWorks": "Solves two failure modes at once. (1) The buried claim: action titles place the conclusion on the page before any analysis is read, so a busy reader doesn't reverse-engineer it from the chart. (2) The spineless deck: because each title is a claim, slides have to ladder up to the governing thought; logical gaps become visible as topic-shaped titles in a sequence that no longer reads as a story.", "antipattern": "Topic labels disguised as titles — Volume by quarter, Key findings, Pricing strategy, Margins have been impacted. No verb, or a passive verb with no agent, or a fact (Revenue grew 12%) without the so-what. Also: titles that overreach the chart's evidence, multi-claim X-grew-but-Y-fell welded titles, and mechanical repetition of the same X-drove-Y template across the deck.", "cardinality": null, "narrativePurpose": "Forces the deck to carry its argument in the title bar so a senior reader can extract the recommendation without opening a single slide; converts a binder of topics into a navigable pyramid where every slide is a node defending the apex." }, { "tool": { "name": "Closing Techniques", "slug": "closing-techniques", "status": "active", "bestFor": null, "canonId": "019dd956-af13-774b-a4fd-7db0a3a88d51", "version": 1, "bodyDocId": null, "description": "Strong endings: Callback, challenge, vision, clear CTA, memorable line", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-96102d59075d", "evidence": "Callout closes with the vision line: 'a culture of resilience'", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 60, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 14, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 15, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 14, "name": "Impact & Next Steps", "beatId": "019dd95a-0702-74a3-87e1-75a62047f8be", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "Q11 culture-of-resilience close + CompTIA advisor authority backstop", "position": 5, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 55 } ], "loops": [ { "to": 14, "from": 10, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "019dd95a-088c-724c-b30e-0316b53f0e64", "evidence": "Q7-Q11 cover distinct management levers: measurement, budget, threat outlook, talent, current risks", "position": 2, "objective": "Enumerate the operational/strategic management dimensions of a cybersecurity program", "confidence": 65, "extraction": { "at": "2026-04-29 13:07:29.689431+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null } } ], "locked": true }, { "page": 15, "type": "appendix", "title": "This slide serves as an organizational profile or 'About Us' page.", "function": "summarize", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "summarize", "functionCanon": { "name": "Summarize", "slug": "summarize", "status": "active", "canonId": "019de52d-1541-704f-b86f-bf7b75056373", "version": 1, "description": null }, "density": "dense", "densityScore": 57, "componentCount": 6, "textChars": 1063, "nDataPoints": 0, "notes": "This slide serves as an organizational profile or 'About Us' page.", "elementsJson": [ "paragraph" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:31:16.286+00", "seconds": 6.231, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5de0-76bd-a169-54303fbbe19b/15", "deck": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b", "deckAnchor": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b#slide-15", "deckJson": "/decks/019dd923-5de0-76bd-a169-54303fbbe19b.json" }, "components": [ { "bbox": { "h": 0.08, "w": 0.55, "x": 0.23, "y": 0.34 }, "kind": "paragraph", "text": "The CompTIA Cybersecurity Advisory Council brings together thought leaders and innovators from a multitude of disciplines, working together to educate technology solution providers on the latest and greatest cybersecurity practices and protocols for business.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:16.286+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "aa476810-2301-450f-bd94-2736b004d4bd", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.55, "x": 0.23, "y": 0.45 }, "kind": "paragraph", "text": "Cybersecurity is a critical component for every business and any technology solution today, but one that requires constant vigilance, collaboration, and communication. We strive to address some of today's most pressing issues and threats, providing guidance for tech companies of all sizes.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:16.286+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b9ded1fa-24a1-4f76-912e-3970edac3f09", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.55, "x": 0.23, "y": 0.56 }, "kind": "paragraph", "text": "The pressure from hackers and other bad actors isn't abating. Thus, it's critical for tech companies to continue their investments in both cybersecurity protocols as well as developing the next generation of resources that will be required to protect assets. The Cybersecurity Advisory Council's roster of industry experts and thought leaders offers the guidance and tools necessary to help tech businesses stay ahead of the curve.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:16.286+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bbc280b9-bc9b-4934-9235-95195ddb8726", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.45, "x": 0.23, "y": 0.28 }, "kind": "title", "text": "About the Cybersecurity Advisory Council", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:16.286+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2547b8ab-dd14-4df6-a00b-f77cd7d72e58", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.3, "x": 0.23, "y": 0.42 }, "kind": "title", "text": "What We Stand For", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:16.286+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b671f214-736c-4e34-b5e2-a513aed0a56b", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.45, "x": 0.23, "y": 0.53 }, "kind": "title", "text": "How We're Making an Impact", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:31:16.286+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c692d948-53d2-4bbf-8bfa-e53944ccc7b3", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Authority Bias", "slug": "authority-bias", "status": "active", "bestFor": null, "canonId": "019dd956-c38d-70b9-a284-b2b479763356", "version": 1, "bodyDocId": null, "description": "Expert opinions are weighted more heavily - cite credible sources", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Architect", "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-99229a92d841", "evidence": "Backs the entire question set with 'CompTIA Cybersecurity Advisory Council' credentials", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 85, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 15, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Credibility Transfer", "slug": "credibility-transfer", "status": "active", "bestFor": null, "canonId": "019dd956-bd34-759a-8e3b-2f14b571a2a1", "version": 1, "bodyDocId": null, "description": "Borrowing authority from trusted sources or vivid details", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "019dd95a-14f6-720d-8375-9f2910f2ba55", "evidence": "Borrows authority from CompTIA's Council to validate the deck's questions", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 70, "extraction": { "at": "2026-04-29 13:07:32.858858+00", "model": "claude-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 15, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 15, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 14, "name": "Impact & Next Steps", "beatId": "019dd95a-0702-74a3-87e1-75a62047f8be", "matchId": "019dd95a-0543-7581-99af-3cd6c6018135", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "Q11 culture-of-resilience close + CompTIA advisor authority backstop", "position": 5, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 55 } ], "loops": [], "locked": true } ], "arcBeats": [ { "from": 1, "to": 3, "label": "Situation & Context", "description": "Cover hook 'Are We Safe?', TOC, intro on why CEOs must ask these questions" }, { "from": 4, "to": 9, "label": "Problem & Complication", "description": "Questions 1-6 enumerate exposure: assets, education, strategy, attack vectors, recovery, prevention" }, { "from": 10, "to": 11, "label": "Solution & Approach", "description": "Q7-8 prescribe measurement program and budget allocation method" }, { "from": 12, "to": 13, "label": "Evidence & Proof", "description": "Q9-10 cite expert guidance on threat outlook and talent strategy" }, { "from": 14, "to": 15, "label": "Impact & Next Steps", "description": "Q11 culture-of-resilience close + CompTIA advisor authority backstop" } ], "loops": [ { "from": 3, "to": 9, "label": "Mece Breakdown", "description": "Enumerate the foundational cybersecurity readiness questions a CEO must diagnose" }, { "from": 10, "to": 14, "label": "Mece Breakdown", "description": "Enumerate the operational/strategic management dimensions of a cybersecurity program" } ] }