{ "schemaVersion": "deck-intelligence.v1", "id": "019dd923-5e88-73ef-bd57-cf13ce8ed1d4", "slug": "72b88f635783ce33", "title": "incident response insights january 2025", "subtitle": "Booz Allen", "author": "Booz Allen", "pageCount": 10, "kind": "consulting-deck", "orientation": "landscape", "aspectRatio": 1.778, "document": { "id": "019dd923-5e88-73ef-bd57-cf13ce8ed1d4", "slug": "72b88f635783ce33", "title": "incident response insights january 2025", "rawTitle": "incident response insights january 2025", "authorId": "BoozAllenHamilton", "authorName": "Booz Allen", "authorDisplay": "Booz Allen", "kind": { "slug": "consulting-deck", "label": "Consulting deck" }, "sourceType": { "slug": "strategy_consulting", "label": "Strategy consulting" }, "fileName": "incident-response-insights-january-2025.pdf", "sourceUrl": null, "sourceDate": "2025-01-15 00:00:00", "presentationDate": null, "ingestedAt": "2026-04-24 14:50:24+00", "status": "ready", "pageCount": 10, "orientation": "landscape", "aspectRatio": 1.778, "targetCompany": null, "targetTicker": null, "metadata": { "local_root": "/tmp/legacy-images/72b88f635783ce33", "origin_corpus": "consulting" } }, "coverage": { "pageCount": 10, "pagesIndexed": 10, "pagesWithImages": 10, "pagesWithMetadata": 10, "imageCoveragePct": 100, "metadataCoveragePct": 100, "componentCount": 75, "chartCount": 11, "metricSlides": 0, "toolMatches": 2, "documentToolMatches": 0, "frameworkMatches": 0, "arcMatches": 1, "beatMatches": 6, "loopMatches": 3, "patternMatches": 0, "storymakersMatch": false, "scoreAvailable": true, "reviewAvailable": true, "activistThesisAvailable": false, "pitchdeckMetadataAvailable": false, "pitchdeckProfileAvailable": false }, "blocks": [], "matches": { "arcs": [ { "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null, "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "matchId": "62eb898a-b450-4eab-9006-9f7a52772e74", "evidence": "The deck starts with KPI dashboards and industry trends, then transitions to specific data tables and focus areas, ending with an executive summary and appendix.", "isPrimary": true, "confidence": 0.8, "extraction": { "at": "2026-07-16 21:17:56.295891+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "beats": [ { "to": 2, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null, "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "from": 1, "name": "Current Situation", "beatId": "997c097e-28be-4a56-9ffb-e83c8f65cd81", "matchId": "62eb898a-b450-4eab-9006-9f7a52772e74", "beatType": { "name": "What Is", "slug": "sparkline-what-is-1", "status": "active", "canonId": "019dd9b8-25d5-7468-8649-454886d75343", "version": 1, "description": null }, "evidence": "The deck begins with a cover slide and KPI dashboards", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 0.8 }, { "to": 4, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null, "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "from": 3, "name": "Threat Actor Trends", "beatId": "eaade8c6-1657-4aff-be26-9eaef86a8739", "matchId": "62eb898a-b450-4eab-9006-9f7a52772e74", "beatType": { "name": "What Is", "slug": "sparkline-what-is-3", "status": "active", "canonId": "019dd9b8-2701-72ba-a477-4121f4fb5d33", "version": 1, "description": null }, "evidence": "Slides 3-4 show industry trends and threat actor YTD trends", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 }, { "to": 6, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null, "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "from": 5, "name": "Problem & Complication", "beatId": "4acdfd36-78d5-49a0-8202-4da7ca3af4fc", "matchId": "62eb898a-b450-4eab-9006-9f7a52772e74", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "Slides 5-6 present data tables on ransom demand by threat actors", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 }, { "to": 8, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null, "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "from": 7, "name": "Solution & Approach", "beatId": "bd27ea9a-e6f5-4654-85e4-0ef70838c072", "matchId": "62eb898a-b450-4eab-9006-9f7a52772e74", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "Slides 7-8 list underwriting focus areas – top 10 security controls", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 }, { "to": 9, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null, "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "from": 9, "name": "Desire for Improvement", "beatId": "7f0c200f-402d-4914-a74c-0d1775791175", "matchId": "62eb898a-b450-4eab-9006-9f7a52772e74", "beatType": { "name": "Desire", "slug": "aida-desire", "status": "active", "canonId": "019dd9b8-11f0-704e-b2bb-fbb6a226467d", "version": 1, "description": null }, "evidence": "Slide 9 provides a Booz Allen overview, indicating a desire for improvement", "position": 4, "isPrimaryArc": true, "parentBeatType": { "name": "Evidence", "slug": "evidence", "status": "active", "canonId": "019dd9b8-03f9-772a-b84a-4f07b415b77a", "version": 1, "description": "A dedicated proof beat exists in only ~4 arcs (Gambit, Sequoia, AIDA, Monroes). Other arcs embed evidence inline within development." }, "alignedBlockIds": null, "matchConfidence": 0.8 }, { "to": 10, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null, "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "from": 10, "name": "Call to Action", "beatId": "75674ad3-8b08-47b6-8310-d7d866f49acc", "matchId": "62eb898a-b450-4eab-9006-9f7a52772e74", "beatType": { "name": "Action", "slug": "aida-action", "status": "active", "canonId": "019dd9b8-1285-74f0-8552-c04c08014586", "version": 1, "description": null }, "evidence": "Slide 10 provides incident response contact details, encouraging action", "position": 5, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [ { "to": 3, "from": 2, "loop": { "name": "51_voice_of_customer", "slug": "51-voice-of-customer", "status": "active", "bestFor": "Product strategy, customer experience, market research", "canonId": "019dd956-7aaf-750b-950b-af0df38f5266", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "What Customers Say (Verbatim) -> The Pattern Across Voices -> The Insight -> The Response", "description": "Let customer quotes and feedback drive the narrative and validate the insight", "familyLabel": null, "categoryName": "Validation", "categorySlug": "validation" }, "matchId": "13990092-445c-4248-90f8-d23c56a6a58f", "evidence": "Slides 2-3 provide KPI dashboards and YTD trends", "position": 0, "objective": "Understand current incident response metrics", "confidence": 0.6, "extraction": { "at": "2026-07-16 21:17:56.551328+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } }, { "to": 6, "from": 5, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null, "categoryName": "Consulting Framework", "categorySlug": "consulting-framework" }, "matchId": "092d7f4b-4dd7-4f30-9c0a-1f27000e04ea", "evidence": "Slides 5-6 present data tables on ransom demand", "position": 1, "objective": "Analyze ransom demand by threat actors", "confidence": 0.6, "extraction": { "at": "2026-07-16 21:17:56.587596+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } }, { "to": 8, "from": 7, "loop": { "name": "47_quick_win_big_bet", "slug": "47-quick-win-big-bet", "status": "active", "bestFor": "Transformation planning, 100-day plans, resource allocation", "canonId": "019dd956-790d-708d-983e-ef9bbc68f741", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Full List -> Quick Wins (Low effort, High impact) -> Big Bets (High effort, High impact) -> Sequenced Roadmap", "description": "Separate initiatives into immediate wins and longer-term strategic bets", "familyLabel": null, "categoryName": "Consulting Framework", "categorySlug": "consulting-framework" }, "matchId": "3e012379-c218-4e95-9b42-73de08e48d72", "evidence": "Slides 7-8 list underwriting focus areas – top 10 security controls", "position": 2, "objective": "Identify top security controls for underwriting focus", "confidence": 0.6, "extraction": { "at": "2026-07-16 21:17:56.623872+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "tools": [ { "tool": { "name": "Slide recipe: Cover", "slug": "cover-slide", "status": "active", "bestFor": null, "canonId": "019df269-2a08-767d-9128-e7431e6fe8a3", "version": 1, "bodyDocId": "019df269-29e5-7738-b5fa-6892e5dc8e65", "description": "The first ten seconds. Build it deliberately.", "familyLabel": "slide-recipe", "categoryName": "Slide", "categorySlug": "slide" }, "agent": "designer", "layer": "slide", "agents": [ "designer" ], "matchId": "dffc3ab3-09fa-4b4a-8318-9149ab22b8b2", "evidence": "INCIDENT RESPONSE INSIGHTS", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 21:44:31.137819+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 1, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Executive summary", "slug": "executive-summary", "status": "active", "bestFor": null, "canonId": "019dd9e1-4b63-72d5-9734-da757d91ca61", "version": 1, "bodyDocId": null, "description": "A condensed view of the entire argument on a single slide / block.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "f419cec8-6aa9-40e9-8624-473ed37dfb10", "evidence": "Booz Allen Overview", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 21:44:31.445685+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 9, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null } ], "frameworks": [], "patterns": [] }, "storymakers": null, "score": { "backend": "codex", "scoredAt": "2026-05-02 20:07:56.185+00", "subScores": { "scqa_arc": 38, "action_titles": 28, "mece_structure": 45, "closing_strength": 35, "evidence_quality": 78, "clarity_of_thesis": 40, "production_quality": 52, "visual_storytelling": 68 }, "totalScore": 48, "coveragePct": 100, "explanations": { "scqa_arc": "Slides 2-6 provide situation and complication data and Slides 7-8 imply controls as an answer, but the deck never frames a question or converts analysis into a resolved answer.", "action_titles": "Most titles are topic labels such as Slide 2, \"Monthly Incident Metrics\", while insights sit in callouts rather than headlines.", "mece_structure": "The structure moves from monthly/YTD metrics to threat actors, ransom demands, controls, and firm overview, with overlap across ransomware/threat actor analysis and gaps such as controls #1-5 in Slides 2-9.", "closing_strength": "The deck closes with a capability overview and contact details on Slides 9-10 rather than a clear recommendation, decision, or next-step sequence.", "evidence_quality": "Trend and ransom claims are backed by charts and data points on Slides 2-6, though the underwriting controls and Booz Allen overview on Slides 7-9 are more asserted than evidenced.", "clarity_of_thesis": "The first five slides signal a ransomware and threat-actor incident update, but no declarative central argument appears in Slides 1-5.", "production_quality": "Production is serviceable but weakened by low action-title density, dense dashboards, an uneven shift from analytics to marketing, and unclear footnote/source discipline across Slides 2-10.", "visual_storytelling": "The chart choices generally match the metrics on Slides 2-6, but dense dashboards, large legends, and list-heavy control slides reduce visual hierarchy." }, "slidesAnalyzed": 10 }, "review": { "backend": null, "verdict": "A short analytical IR briefing with strong quantified callouts but no story arc — use the data slides as a content example, not the structure, since it lacks opening thesis, MECE pillars, and a recommendation close.", "reviewedAt": "2026-04-24 17:18:14+00", "slidesSeen": 10, "suggestions": [ "Rewrite every topic title as a declarative insight sentence — e.g. p.2 'December flipped the mix: Insider Threat and DDoS up, Ransomware down'; p.5 'One 9-digit demand skews Q4 — median demand still rising'", "Add a thesis slide at p.2 that answers 'so what for underwriters?' in one sentence and previews the 3-4 evidence pillars, then use section dividers for Volume / Actors / Economics / Controls", "Replace the p.9 firm overview with a synthesis slide stating the recommended underwriting action (e.g. which controls to price, which actor families to exclude), and move Booz Allen credentials to an appendix" ], "closingScore": 35, "openingScore": 30, "topStrengths": [ "Quantified callouts carry real insight density (p.3 ransomware 30-50% share, p.5 9-digit demand skew, p.2 December mix shift)", "Named threat-actor specificity on p.4 (Akira, Blacksuit, RansomHub, etc.) gives credibility and recency", "Reasonable MECE-ish coverage of the IR landscape: volume → trend → actors → economics → controls" ], "topWeaknesses": [ "No thesis or SCQA setup in the first 3 slides — reader is dropped into p.2 KPIs with no stakes", "Action titles are nouns, not sentences: p.2 'Monthly Incident Metrics', p.3 'Incident YTD Trends', p.5-6 'Ransom Demand By Threat Actors'", "Closing slides (p.9 firm overview, p.10 contact card) substitute marketing for a recommendation or next-steps synthesis", "Security-controls section (p.7-8) is labeled '#6 to #10' — implies a missing #1-5 half and breaks MECE" ], "narrativeScore": 45, "pillarCritique": "There are no explicit section dividers; the deck flows as a flat sequence of analytical slides with a topic shift at p.7 into security controls and then a firm overview at p.9, reading as topic dumps rather than MECE pillars.", "closingCritique": "The close is a firm-credentials slide (p.9 'Booz Allen Overview') followed by a contact/signup card (p.10) — there is no synthesized recommendation or explicit call to action on what the audience should DO about the insights. It ends in marketing, not resolution.", "openingCritique": "Slide 1 is a bare title card and slides 2-4 jump straight into monthly metrics and YTD trends with no thesis, no stakes, and no answer-first framing. A reader has no idea what the deck is arguing until they reverse-engineer it from the callouts.", "extractionSeconds": 46.313335, "narrativeCritique": "The deck reads as an analytical data dump (metrics → trends → threat actors → ransom tables → controls) with no Situation/Complication framing up front and no synthesizing recommendation. The arc is essentially A→A→A with a bolt-on firm overview at p.9 — missing Setup and Resolution acts.", "titleQualityScore": 40, "titleQualityCritique": "Titles are almost entirely topic labels, not insights: 'Monthly Incident Metrics' (p.2), 'Incident YTD Trends' (p.3), 'Ransom Demand By Threat Actors' (p.5). The callouts contain the real insights (e.g. the 9-digit ransom skew on p.5) but none of it is lifted into the action title." }, "activistThesis": null, "pitchdeck": { "metadata": null, "profile": null }, "slides": [ { "page": 1, "type": "setup", "function": "front_matter", "imagePath": "https://imgproxy.kitesheet.com/dgDYs3CNy98RqcINjDvZ-B_qgbWjyC7HyxmoJ-wSmms/rs:fit:1200:1200:0/q:82/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy83MmI4OGY2MzU3ODNjZTMzL3AwMDEuanBn", "rawType": "cover", "block": null, "metadata": { "slideType": "cover", "slideTypeCanon": { "name": "Cover", "slug": "cover", "status": "active", "canonId": "019de52d-05f2-729d-9f93-e0504f0a2410", "version": 1, "description": null }, "function": "front_matter", "functionCanon": { "name": "Front matter", "slug": "front_matter", "status": "active", "canonId": "019de52d-133d-73f0-9e26-201eda96b098", "version": 1, "description": null }, "density": "balanced", "densityScore": 35, "componentCount": 6, "textChars": 296, "nDataPoints": 0, "notes": null, "elementsJson": [ "headline_text", "subtitle_text", "paragraph", "photo", "infographic" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:12:02.782+00", "seconds": 2.897, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5e88-73ef-bd57-cf13ce8ed1d4/1", "deck": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4", "deckAnchor": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4#slide-1", "deckJson": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4.json" }, "components": [ { "bbox": { "h": 0.08, "w": 0.35, "x": 0.07, "y": 0.67 }, "kind": "disclaimer", "text": "Disclaimer: The content of this document is for informational purposes only. Booz Allen Hamilton is not responsible for your reliance on, or implementation of the guidance described in this document.", "attrs": null, "canon": { "kind": { "name": "Disclaimer", "slug": "disclaimer", "status": "active", "canonId": "91173477-d91f-4024-bbaf-d4f93e3f82dc", "version": 1, "description": "Legal/cautionary text that occupies most of the body of its slide." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:02.782+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "904f16d3-540e-4a84-beb1-888b146d789c", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.1, "x": 0.07, "y": 0.0086 }, "kind": "image", "text": "Booz Allen", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Logo", "slug": "logo", "status": "active", "canonId": "019de52c-fdaf-743d-94c4-d7c6a0e55302", "version": 1, "description": null }, "framework": null }, "subkind": "logo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:02.782+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "06e4072e-45db-4415-8442-d1dffd1bf5c3", "parentComponentId": null }, { "bbox": { "h": 1, "w": 0.6, "x": 0.4, "y": 0 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Photo", "slug": "photo", "status": "active", "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875", "version": 1, "description": null }, "framework": null }, "subkind": "photo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:02.782+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "27f3b6a9-9785-43f5-8f04-9d6c406671f3", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.35, "x": 0.07, "y": 0.61 }, "kind": "paragraph", "text": "BASED ON INCIDENT DATA AS OF END OF DECEMBER 2024", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:02.782+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "dafcf2db-3497-4d91-be3e-a1562b6ec3b1", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.2, "x": 0.07, "y": 0.53 }, "kind": "paragraph", "text": "JANUARY 2025", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:02.782+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e2b48e81-27c4-4dea-ac87-2ac5fd63dfb7", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.35, "x": 0.07, "y": 0.15 }, "kind": "title", "text": "INCIDENT RESPONSE INSIGHTS", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:02.782+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "700df0cc-5ade-4ec1-a070-b028ebc94ac4", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Slide recipe: Cover", "slug": "cover-slide", "status": "active", "bestFor": null, "canonId": "019df269-2a08-767d-9128-e7431e6fe8a3", "version": 1, "bodyDocId": "019df269-29e5-7738-b5fa-6892e5dc8e65", "description": "The first ten seconds. Build it deliberately.", "familyLabel": "slide-recipe", "categoryName": "Slide", "categorySlug": "slide" }, "agent": "designer", "layer": "slide", "agents": [ "designer" ], "matchId": "dffc3ab3-09fa-4b4a-8318-9149ab22b8b2", "evidence": "INCIDENT RESPONSE INSIGHTS", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 21:44:31.137819+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 1, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 2, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 1, "name": "Current Situation", "beatId": "997c097e-28be-4a56-9ffb-e83c8f65cd81", "matchId": "62eb898a-b450-4eab-9006-9f7a52772e74", "beatType": { "name": "What Is", "slug": "sparkline-what-is-1", "status": "active", "canonId": "019dd9b8-25d5-7468-8649-454886d75343", "version": 1, "description": null }, "evidence": "The deck begins with a cover slide and KPI dashboards", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "thumbSrc": "https://imgproxy.kitesheet.com/pv8A1GtpBXSQRmtQp-R0bp80Mc6iA7Y_fUp28SjudW8/rs:fit:480:480:0/q:78/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy83MmI4OGY2MzU3ODNjZTMzL3AwMDEuanBn", "imagePathAlt": "https://imgproxy.kitesheet.com/qX89HBL5cQun7CM9S01pvHOElNDZT-iYWlKOiJu2GOE/rs:fit:1200:1200:0/q:82/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy83MmI4OGY2MzU3ODNjZTMzL3AwMDEucG5n", "thumbSrcAlt": "https://imgproxy.kitesheet.com/SOqb02XBXnGUCC9T2A-1CvIMDR0mnALNLDwUDiumP_M/rs:fit:480:480:0/q:78/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy83MmI4OGY2MzU3ODNjZTMzL3AwMDEucG5n" }, { "page": 2, "type": "analysis", "title": "The slide uses donut charts and 100% stacked bar charts to visualize composition and trends.", "function": "summarize", "rawType": "kpi_dashboard", "block": null, "metadata": { "slideType": "kpi_dashboard", "slideTypeCanon": { "name": "KPI dashboard", "slug": "kpi_dashboard", "status": "active", "canonId": "019de52d-0be5-7295-af4d-b850fe7b7e65", "version": 1, "description": null }, "function": "summarize", "functionCanon": { "name": "Summarize", "slug": "summarize", "status": "active", "canonId": "019de52d-1541-704f-b86f-bf7b75056373", "version": 1, "description": null }, "density": "dense", "densityScore": 72, "componentCount": 8, "textChars": 616, "nDataPoints": 32, "notes": "The slide uses donut charts and 100% stacked bar charts to visualize composition and trends.", "elementsJson": [ "donut_chart", "bar_chart_100pct", "paragraph", "kpi_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:12:02.674+00", "seconds": 2.537, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5e88-73ef-bd57-cf13ce8ed1d4/2", "deck": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4", "deckAnchor": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4#slide-2", "deckJson": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "In December, we saw a marked increase in Insider Threats, DDoS and Sensitive Data Loss incidents, but a decrease in Ransomware, Email Compromise, Network Intrusion and Unauthorized Access compared to the previous month.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 15:28:22+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-1042-7629-9bdf-5cdd337a942f", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.25, "x": 0.35, "y": 0.55 }, "kind": "chart", "text": "Incidents Types Monthly Trends", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Stacked bar chart (100%)", "slug": "bar-stacked-100pct", "status": "active", "canonId": "019de52c-ff14-71b8-8d88-860f8d7da84b", "version": 1, "description": null }, "framework": null }, "subkind": "bar-stacked-100pct", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:02.674+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9779dc03-26e0-40fd-a8d5-1bf02155ce39", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.25, "x": 0.65, "y": 0.55 }, "kind": "chart", "text": "Incidents Industry Monthly Trends", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Stacked bar chart (100%)", "slug": "bar-stacked-100pct", "status": "active", "canonId": "019de52c-ff14-71b8-8d88-860f8d7da84b", "version": 1, "description": null }, "framework": null }, "subkind": "bar-stacked-100pct", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:02.674+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b98bfb90-21f5-40ba-8f1c-0ff73026ea61", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.25, "x": 0.35, "y": 0.05 }, "kind": "chart", "text": "Incidents by Types - December 2024", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Donut chart", "slug": "donut", "status": "active", "canonId": "019de52d-0006-752c-9528-0fef476b8004", "version": 1, "description": null }, "framework": null }, "subkind": "donut", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:02.674+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "89d0a5fb-8219-44f0-82be-1473b1495213", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.25, "x": 0.65, "y": 0.05 }, "kind": "chart", "text": "Incidents by Industry - December 2024", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Donut chart", "slug": "donut", "status": "active", "canonId": "019de52d-0006-752c-9528-0fef476b8004", "version": 1, "description": null }, "framework": null }, "subkind": "donut", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:02.674+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e71b8bcf-5b95-422c-8656-3839f81dc354", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Incident volume: 43%", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 15:28:22+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-1042-7629-9bdf-60bab06c3bb0", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.15, "x": 0.15, "y": 0.28 }, "kind": "paragraph", "text": "In December, we saw a marked increase in Insider Threats, DDoS and Sensitive Data Loss incidents, but a decrease in Ransomware, Email Compromise, Network Intrusion and Unauthorized Access compared to the previous month.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:02.674+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b003c51a-ba3c-4a8b-bfe2-3aafff1b960b", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.15, "x": 0.15, "y": 0.18 }, "kind": "title", "text": "Monthly Incident Metrics", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:02.674+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8c80239b-c0fb-43fa-814e-1e5ac13318db", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 2, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 1, "name": "Current Situation", "beatId": "997c097e-28be-4a56-9ffb-e83c8f65cd81", "matchId": "62eb898a-b450-4eab-9006-9f7a52772e74", "beatType": { "name": "What Is", "slug": "sparkline-what-is-1", "status": "active", "canonId": "019dd9b8-25d5-7468-8649-454886d75343", "version": 1, "description": null }, "evidence": "The deck begins with a cover slide and KPI dashboards", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [ { "to": 3, "from": 2, "loop": { "name": "51_voice_of_customer", "slug": "51-voice-of-customer", "status": "active", "bestFor": "Product strategy, customer experience, market research", "canonId": "019dd956-7aaf-750b-950b-af0df38f5266", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "What Customers Say (Verbatim) -> The Pattern Across Voices -> The Insight -> The Response", "description": "Let customer quotes and feedback drive the narrative and validate the insight", "familyLabel": null }, "matchId": "13990092-445c-4248-90f8-d23c56a6a58f", "evidence": "Slides 2-3 provide KPI dashboards and YTD trends", "position": 0, "objective": "Understand current incident response metrics", "confidence": 0.6, "extraction": { "at": "2026-07-16 21:17:56.551328+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 3, "type": "analysis", "title": "The slide uses 100% stacked bar charts to show composition over time.", "function": "analyze_data", "rawType": "kpi_dashboard", "block": null, "metadata": { "slideType": "kpi_dashboard", "slideTypeCanon": { "name": "KPI dashboard", "slug": "kpi_dashboard", "status": "active", "canonId": "019de52d-0be5-7295-af4d-b850fe7b7e65", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "dense", "densityScore": 67, "componentCount": 7, "textChars": 703, "nDataPoints": 24, "notes": "The slide uses 100% stacked bar charts to show composition over time.", "elementsJson": [ "bar_chart_100pct", "bar_chart_100pct", "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:12:03.519+00", "seconds": 2.944, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5e88-73ef-bd57-cf13ce8ed1d4/3", "deck": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4", "deckAnchor": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4#slide-3", "deckJson": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Ransomware matters have dominated our case load and have been between ~30% to ~50% of the total incident volume, followed by Email Compromise making up ~10% to ~40% of the total incident volume.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 15:28:23+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-1042-7629-9be0-120ad1da6820", "parentComponentId": null }, { "bbox": { "h": 0.7, "w": 0.28, "x": 0.68, "y": 0.1 }, "kind": "chart", "text": "Incidents by Industry – 2024 YTD", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Stacked bar chart (100%)", "slug": "bar-stacked-100pct", "status": "active", "canonId": "019de52c-ff14-71b8-8d88-860f8d7da84b", "version": 1, "description": null }, "framework": null }, "subkind": "bar-stacked-100pct", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:03.519+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ad0aac9f-815b-4746-aebf-2a2e6e378867", "parentComponentId": null }, { "bbox": { "h": 0.7, "w": 0.28, "x": 0.38, "y": 0.1 }, "kind": "chart", "text": "Incidents by Types – 2024 YTD", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Stacked bar chart (100%)", "slug": "bar-stacked-100pct", "status": "active", "canonId": "019de52c-ff14-71b8-8d88-860f8d7da84b", "version": 1, "description": null }, "framework": null }, "subkind": "bar-stacked-100pct", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:03.519+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c6d47342-9902-4a8f-9c3a-d04eb4aa420f", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Incident volume", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 15:28:23+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-1042-7629-9be0-16f05761c8f9", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.2, "x": 0.15, "y": 0.28 }, "kind": "paragraph", "text": "For 2024 overall, Ransomware matters have dominated our case load and have been between ~30% to ~50% of the total incident volume, followed by Email Compromise making up ~10% to ~40% of the total incident volume.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:03.519+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "93a34c9e-aa3b-4a07-a510-7ad9c5db75ba", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.2, "x": 0.15, "y": 0.62 }, "kind": "paragraph", "text": "The top five most impacted sectors are consistently across Manufacturing, Financial Services, Construction, Healthcare and Legal organizations, making up between ~50% to ~70% of our caseload each month.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:03.519+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a495dad8-3bc6-41b9-9116-c3352af9cfc1", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.15, "x": 0.15, "y": 0.18 }, "kind": "title", "text": "Incident YTD Trends", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:03.519+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6639e9e6-5002-41c3-a2be-7098d8cd36dc", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 4, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 3, "name": "Threat Actor Trends", "beatId": "eaade8c6-1657-4aff-be26-9eaef86a8739", "matchId": "62eb898a-b450-4eab-9006-9f7a52772e74", "beatType": { "name": "What Is", "slug": "sparkline-what-is-3", "status": "active", "canonId": "019dd9b8-2701-72ba-a477-4121f4fb5d33", "version": 1, "description": null }, "evidence": "Slides 3-4 show industry trends and threat actor YTD trends", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [ { "to": 3, "from": 2, "loop": { "name": "51_voice_of_customer", "slug": "51-voice-of-customer", "status": "active", "bestFor": "Product strategy, customer experience, market research", "canonId": "019dd956-7aaf-750b-950b-af0df38f5266", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "What Customers Say (Verbatim) -> The Pattern Across Voices -> The Insight -> The Response", "description": "Let customer quotes and feedback drive the narrative and validate the insight", "familyLabel": null }, "matchId": "13990092-445c-4248-90f8-d23c56a6a58f", "evidence": "Slides 2-3 provide KPI dashboards and YTD trends", "position": 0, "objective": "Understand current incident response metrics", "confidence": 0.6, "extraction": { "at": "2026-07-16 21:17:56.551328+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 4, "type": "analysis", "title": "The chart uses a large color-coded legend to represent dozens of distinct threat actor groups.", "function": "analyze_data", "rawType": "industry_trends", "block": null, "metadata": { "slideType": "industry_trends", "slideTypeCanon": { "name": "Industry trends", "slug": "industry_trends", "status": "active", "canonId": "019de52d-0b1d-7705-a0e0-c663199cd1fa", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "dense", "densityScore": 58, "componentCount": 6, "textChars": 606, "nDataPoints": 120, "notes": "The chart uses a large color-coded legend to represent dozens of distinct threat actor groups.", "elementsJson": [ "headline_text", "paragraph", "bar_chart_100pct", "icon_grid" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:12:03.491+00", "seconds": 2.89, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5e88-73ef-bd57-cf13ce8ed1d4/4", "deck": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4", "deckAnchor": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4#slide-4", "deckJson": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "In Q4 2024, we observed Akira, Blacksuit, RansomHub, Black Basta Group Akira, Play Ransomware Group, Rhysida, CLOP and Frag Threat Actor Groups dominate the Ransomware landscape.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 15:28:23+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-1042-7629-9bdf-ea1f80ffc326", "parentComponentId": null }, { "bbox": { "h": 0.65, "w": 0.7, "x": 0.25, "y": 0.05 }, "kind": "chart", "text": "Threat Actors 2024 YTD", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Stacked bar chart (100%)", "slug": "bar-stacked-100pct", "status": "active", "canonId": "019de52c-ff14-71b8-8d88-860f8d7da84b", "version": 1, "description": null }, "framework": null }, "subkind": "bar-stacked-100pct", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:03.491+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5a6826ac-6cc8-4395-8cd1-c93fae13aee4", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.7, "x": 0.25, "y": 0.7 }, "kind": "list", "text": "Legend of threat actor groups", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:03.491+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d1f40f5a-f2b2-493a-ad81-24e571f22c6c", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Threat actor activity frequency", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 15:28:23+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-1042-7629-9bdf-ecb8fefcd5bf", "parentComponentId": null }, { "bbox": { "h": 0.3, "w": 0.2, "x": 0.15, "y": 0.28 }, "kind": "paragraph", "text": "In Q4 2024, we observed Akira, Blacksuit, RansomHub, Black Basta Group Akira, Play Ransomware Group, Rhysida, CLOP and Frag Threat Actor Groups dominate the Ransomware landscape. Additionally, in Q4 2024, we observed a few new Threat Actor groups such as CLOP, Schrodingercat, Abyss Locker and Cactus impacting our clients.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:03.491+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a76a3d7c-fb19-4882-833c-7a11e9e3f20c", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.2, "x": 0.15, "y": 0.18 }, "kind": "title", "text": "Threat Actor YTD Trends", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:03.491+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cd4bcbca-2542-4182-ade6-fafa173a9572", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 4, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 3, "name": "Threat Actor Trends", "beatId": "eaade8c6-1657-4aff-be26-9eaef86a8739", "matchId": "62eb898a-b450-4eab-9006-9f7a52772e74", "beatType": { "name": "What Is", "slug": "sparkline-what-is-3", "status": "active", "canonId": "019dd9b8-2701-72ba-a477-4121f4fb5d33", "version": 1, "description": null }, "evidence": "Slides 3-4 show industry trends and threat actor YTD trends", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 5, "type": "analysis", "title": "The slide uses horizontal bar charts to compare ransom amounts across two quarters.", "function": "analyze_data", "rawType": "data_table", "block": null, "metadata": { "slideType": "data_table", "slideTypeCanon": { "name": "Data table", "slug": "data_table", "status": "active", "canonId": "019de52d-0bbd-71b9-9918-417f904abbf8", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "dense", "densityScore": 66, "componentCount": 7, "textChars": 644, "nDataPoints": 26, "notes": "The slide uses horizontal bar charts to compare ransom amounts across two quarters.", "elementsJson": [ "bar_chart_horizontal", "bar_chart_horizontal", "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:12:03.362+00", "seconds": 2.493, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5e88-73ef-bd57-cf13ce8ed1d4/5", "deck": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4", "deckAnchor": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4#slide-5", "deckJson": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "The ransom demand data for Q4 is heavily skewed by a threat actor making a 9-digit ransom demand for a single matter.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 15:28:28+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-1043-7233-b236-8d408564844e", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.75, "x": 0.2, "y": 0.05 }, "kind": "chart", "text": "2024 Q4 (October, November, December) ransom demands", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Horizontal bar chart", "slug": "bar-horizontal", "status": "active", "canonId": "019de52c-fec4-7221-986b-1cb5f5e84b1f", "version": 1, "description": null }, "framework": null }, "subkind": "bar-horizontal", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:03.362+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6f6ed395-8cb0-46cd-bf5f-e7ed5ce2c874", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.75, "x": 0.2, "y": 0.5 }, "kind": "chart", "text": "2024 Q3 (July, August, September) ransom demands", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Horizontal bar chart", "slug": "bar-horizontal", "status": "active", "canonId": "019de52c-fec4-7221-986b-1cb5f5e84b1f", "version": 1, "description": null }, "framework": null }, "subkind": "bar-horizontal", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:03.362+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ad74a991-978f-473d-94d1-e3cce219e7b0", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Ransom Demand: $131,270,000", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 15:28:28+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-1043-7233-b236-93dd2b217743", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.15, "x": 0.05, "y": 0.55 }, "kind": "paragraph", "text": "In Q3 2024, Play Ransomware Group, FOG, RansomHub, Rhysida, Blacksuit and Akira have led on ransom demands.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:03.362+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0b2e534a-5c7c-43de-874a-2bf227c642eb", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.15, "x": 0.05, "y": 0.25 }, "kind": "paragraph", "text": "In Q42024, Blacksuit, RansomHub, Black Basta Group, Akira, Frag, Cactus Play Ransomware Group, Abyss Locker and Monti have led on ransom demands. The ransom demand data for Q4 is heavily skewed by a threat actor making a 9-digit ransom demand for a single matter.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:03.362+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cb2d47e5-ea91-415e-b4e9-03bd1b51dd27", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.15, "x": 0.05, "y": 0.18 }, "kind": "title", "text": "Ransom Demand By Threat Actors", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:03.362+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2da28a86-f4d6-41e4-b8ca-ae5a59eeddd6", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 6, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 5, "name": "Problem & Complication", "beatId": "4acdfd36-78d5-49a0-8202-4da7ca3af4fc", "matchId": "62eb898a-b450-4eab-9006-9f7a52772e74", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "Slides 5-6 present data tables on ransom demand by threat actors", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [ { "to": 6, "from": 5, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "092d7f4b-4dd7-4f30-9c0a-1f27000e04ea", "evidence": "Slides 5-6 present data tables on ransom demand", "position": 1, "objective": "Analyze ransom demand by threat actors", "confidence": 0.6, "extraction": { "at": "2026-07-16 21:17:56.587596+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 6, "type": "analysis", "title": "The slide uses horizontal bar charts to visualize the magnitude of ransom demands for different threat groups in two separate quarters.", "function": "analyze_data", "rawType": "data_table", "block": null, "metadata": { "slideType": "data_table", "slideTypeCanon": { "name": "Data table", "slug": "data_table", "status": "active", "canonId": "019de52d-0bbd-71b9-9918-417f904abbf8", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "dense", "densityScore": 50, "componentCount": 6, "textChars": 450, "nDataPoints": 18, "notes": "The slide uses horizontal bar charts to visualize the magnitude of ransom demands for different threat groups in two separate quarters.", "elementsJson": [ "bar_chart_horizontal", "bar_chart_horizontal" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:12:04.127+00", "seconds": 3.073, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5e88-73ef-bd57-cf13ce8ed1d4/6", "deck": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4", "deckAnchor": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4#slide-6", "deckJson": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "In Q2 2024, RansomHub, Medusa, Rhysida, and Radar and Dispossessor Team led on ransom demands.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 15:28:23+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-1042-7629-9bdf-c5c1a22ef5f1", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.8, "x": 0.18, "y": 0.05 }, "kind": "chart", "text": "2024 Q2 (April, May, June) ransom demands by actor", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Horizontal bar chart", "slug": "bar-horizontal", "status": "active", "canonId": "019de52c-fec4-7221-986b-1cb5f5e84b1f", "version": 1, "description": null }, "framework": null }, "subkind": "bar-horizontal", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:04.127+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7d45459e-a541-4547-87f2-f64108e31021", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.8, "x": 0.18, "y": 0.52 }, "kind": "chart", "text": "2024 Q1 (January, February, March) ransom demands by actor", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Horizontal bar chart", "slug": "bar-horizontal", "status": "active", "canonId": "019de52c-fec4-7221-986b-1cb5f5e84b1f", "version": 1, "description": null }, "framework": null }, "subkind": "bar-horizontal", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:04.127+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8ed006e4-7ea8-4285-ba71-f61d24b270ee", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Ransom Demand: $30,000,000", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 15:28:23+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-1042-7629-9bdf-c9273ab104a8", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.15, "x": 0.15, "y": 0.28 }, "kind": "paragraph", "text": "In Q2 2024, RansomHub, Medusa, Rhysida, and Radar and Dispossessor Team led on ransom demands. For Q1 2024, Play Ransomware Group, Lockbit, Akira and Ransomhouse led on ransom demands.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:04.127+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a21f5f93-8d16-43e3-a9c8-09fedba3bb78", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.15, "x": 0.15, "y": 0.18 }, "kind": "title", "text": "Ransom Demand By Threat Actors (cont.)", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:04.127+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7d2ff87f-0a41-4ec5-b884-d8b2260fe0d8", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 6, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 5, "name": "Problem & Complication", "beatId": "4acdfd36-78d5-49a0-8202-4da7ca3af4fc", "matchId": "62eb898a-b450-4eab-9006-9f7a52772e74", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "Slides 5-6 present data tables on ransom demand by threat actors", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [ { "to": 6, "from": 5, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "092d7f4b-4dd7-4f30-9c0a-1f27000e04ea", "evidence": "Slides 5-6 present data tables on ransom demand", "position": 1, "objective": "Analyze ransom demand by threat actors", "confidence": 0.6, "extraction": { "at": "2026-07-16 21:17:56.587596+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 7, "type": "setup", "title": "Part of a series; continues from a previous slide covering controls #1-5.", "function": "present_solution", "rawType": "initiative_list", "block": null, "metadata": { "slideType": "initiative_list", "slideTypeCanon": { "name": "Initiative list", "slug": "initiative_list", "status": "active", "canonId": "019de52d-0caf-770e-9b91-b99239121f50", "version": 1, "description": null }, "function": "present_solution", "functionCanon": { "name": "Present solution", "slug": "present_solution", "status": "active", "canonId": "019de52d-15b8-71da-bd23-2b767850cbce", "version": 1, "description": null }, "density": "balanced", "densityScore": 39, "componentCount": 5, "textChars": 575, "nDataPoints": 0, "notes": "Part of a series; continues from a previous slide covering controls #1-5.", "elementsJson": [ "bullet_list" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:12:07.176+00", "seconds": 5.946, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5e88-73ef-bd57-cf13ce8ed1d4/7", "deck": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4", "deckAnchor": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4#slide-7", "deckJson": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4.json" }, "components": [ { "bbox": { "h": 0.35, "w": 0.35, "x": 0.2, "y": 0.08 }, "kind": "list", "text": "6) Password and End-User Account Management: Emphasizes active user management, strong password policies, and group privilege control.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:07.176+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2858fa6e-626c-420e-8836-a0b8cd87af0c", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.35, "x": 0.6, "y": 0.5 }, "kind": "list", "text": "8) Backups: Advises on both onsite and offsite storage to protect against encryption or deletion by threat actors.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:07.176+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3bf51c8f-e031-4f48-b152-61e66eccee39", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.35, "x": 0.2, "y": 0.6 }, "kind": "list", "text": "7) Event Logging: Recommends SIEM solutions, proper log preservation, and recording detailed session information.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:07.176+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5a309067-caa4-4527-91ee-2272afac6d0f", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.15, "x": 0.02, "y": 0.18 }, "kind": "paragraph", "text": "IR Update Summary: Read on for a summary of our Incident Response team's recent observations alongside insights from across the cybersecurity community.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:07.176+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "16760fd3-e02f-4b68-89fa-50495cb09b5a", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.4, "x": 0.2, "y": 0.03 }, "kind": "title", "text": "Underwriting Focus Area – Top 10 Security Controls - #6 to #10", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:07.176+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2a59b1c0-241c-4dda-9ebf-507d8f6573e5", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 8, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 7, "name": "Solution & Approach", "beatId": "bd27ea9a-e6f5-4654-85e4-0ef70838c072", "matchId": "62eb898a-b450-4eab-9006-9f7a52772e74", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "Slides 7-8 list underwriting focus areas – top 10 security controls", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [ { "to": 8, "from": 7, "loop": { "name": "47_quick_win_big_bet", "slug": "47-quick-win-big-bet", "status": "active", "bestFor": "Transformation planning, 100-day plans, resource allocation", "canonId": "019dd956-790d-708d-983e-ef9bbc68f741", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Full List -> Quick Wins (Low effort, High impact) -> Big Bets (High effort, High impact) -> Sequenced Roadmap", "description": "Separate initiatives into immediate wins and longer-term strategic bets", "familyLabel": null }, "matchId": "3e012379-c218-4e95-9b42-73de08e48d72", "evidence": "Slides 7-8 list underwriting focus areas – top 10 security controls", "position": 2, "objective": "Identify top security controls for underwriting focus", "confidence": 0.6, "extraction": { "at": "2026-07-16 21:17:56.623872+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 8, "type": "setup", "title": "Part of a series on top 10 security controls for underwriting.", "function": "summarize", "rawType": "initiative_list", "block": null, "metadata": { "slideType": "initiative_list", "slideTypeCanon": { "name": "Initiative list", "slug": "initiative_list", "status": "active", "canonId": "019de52d-0caf-770e-9b91-b99239121f50", "version": 1, "description": null }, "function": "summarize", "functionCanon": { "name": "Summarize", "slug": "summarize", "status": "active", "canonId": "019de52d-1541-704f-b86f-bf7b75056373", "version": 1, "description": null }, "density": "dense", "densityScore": 54, "componentCount": 6, "textChars": 864, "nDataPoints": 0, "notes": "Part of a series on top 10 security controls for underwriting.", "elementsJson": [ "headline_text", "bullet_list", "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:12:04.514+00", "seconds": 2.743, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5e88-73ef-bd57-cf13ce8ed1d4/8", "deck": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4", "deckAnchor": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4#slide-8", "deckJson": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Immutable backups are preferred as they can not be deleted or changed.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 15:28:23+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-1042-7629-9be0-4e3ac3023fe0", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.35, "x": 0.2, "y": 0.12 }, "kind": "list", "text": "8) Backups (cont.)\nIf backups are stored offsite, check if the storage provider retains backups copies and if there are protections in-place to prevent deletion of the backups. Immutable backups are preferred.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:04.514+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2df188ff-c7df-4375-a684-9282cc9699e4", "parentComponentId": null }, { "bbox": { "h": 0.45, "w": 0.35, "x": 0.2, "y": 0.42 }, "kind": "list", "text": "9) Know your environment/Asset List/Software list/RMM & RDP Tools\nHave a network diagram and asset list. Review for unauthorized software. Only use approved RMM tools with MFA.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:04.514+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "31fbc466-9bbc-4d59-8de0-b605ceeb5300", "parentComponentId": null }, { "bbox": { "h": 0.65, "w": 0.35, "x": 0.6, "y": 0.2 }, "kind": "list", "text": "10) Incident Response Planning and Testing\nHave a written plan. Conduct testing and simulation. Ensure 24x7 contact info for decision makers. Preserve evidence for forensic investigation.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:04.514+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cb89b7f9-9f68-4268-a089-6276d9c40148", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.16, "x": 0.02, "y": 0.18 }, "kind": "paragraph", "text": "IR Update Summary: Read on for a summary of our Incident Response team's recent observations alongside insights from across the cybersecurity community.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:04.514+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3c3672c1-b47f-48bc-9b22-384436b32f8e", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.5, "x": 0.2, "y": 0.03 }, "kind": "title", "text": "Underwriting Focus Area – Top 10 Security Controls - #6 to #10 (cont.)", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:04.514+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7b0571fb-d51c-4055-ae1f-38431ce865b8", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 8, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 7, "name": "Solution & Approach", "beatId": "bd27ea9a-e6f5-4654-85e4-0ef70838c072", "matchId": "62eb898a-b450-4eab-9006-9f7a52772e74", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "Slides 7-8 list underwriting focus areas – top 10 security controls", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [ { "to": 8, "from": 7, "loop": { "name": "47_quick_win_big_bet", "slug": "47-quick-win-big-bet", "status": "active", "bestFor": "Transformation planning, 100-day plans, resource allocation", "canonId": "019dd956-790d-708d-983e-ef9bbc68f741", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Full List -> Quick Wins (Low effort, High impact) -> Big Bets (High effort, High impact) -> Sequenced Roadmap", "description": "Separate initiatives into immediate wins and longer-term strategic bets", "familyLabel": null }, "matchId": "3e012379-c218-4e95-9b42-73de08e48d72", "evidence": "Slides 7-8 list underwriting focus areas – top 10 security controls", "position": 2, "objective": "Identify top security controls for underwriting focus", "confidence": 0.6, "extraction": { "at": "2026-07-16 21:17:56.623872+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 9, "type": "setup", "title": "The slide uses a dark-themed layout with three main columns for capabilities and a bottom row for core value propositions.", "function": "summarize", "rawType": "executive_summary", "block": null, "metadata": { "slideType": "executive_summary", "slideTypeCanon": { "name": "Executive summary", "slug": "executive_summary", "status": "active", "canonId": "019de52d-06be-73ff-81b3-f99fe7f0025e", "version": 1, "description": null }, "function": "summarize", "functionCanon": { "name": "Summarize", "slug": "summarize", "status": "active", "canonId": "019de52d-1541-704f-b86f-bf7b75056373", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 93, "componentCount": 15, "textChars": 1501, "nDataPoints": 5, "notes": "The slide uses a dark-themed layout with three main columns for capabilities and a bottom row for core value propositions.", "elementsJson": [ "paragraph", "bullet_list", "big_number", "map" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:12:11.367+00", "seconds": 9.473, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5e88-73ef-bd57-cf13ce8ed1d4/9", "deck": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4", "deckAnchor": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4#slide-9", "deckJson": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Business insight meets cybersecurity innovation to reduce enterprise cyber risk, leveraging advanced tradecraft and a practitioner-led approach across a variety of industry sectors across the globe.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 15:28:24+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-1042-7629-9be0-60fea1c37445", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.15, "x": 0.82, "y": 0.18 }, "kind": "image", "text": "Global map graphic", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Map", "slug": "map", "status": "active", "canonId": "019de52c-fe4d-77bd-b0a4-d72d58b9e5a4", "version": 1, "description": null }, "framework": null }, "subkind": "map", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:11.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c7729c19-693d-4b4c-a55d-124f02164dd3", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.15, "x": 0.41, "y": 0.42 }, "kind": "list", "text": "Financial Services, Health & Life Sciences, Energy & Utilities, Software & Hi-Tech, Manufacturing, Automotive & Airlines, Retail & Hospitality, Maritime & Transportation", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:11.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cd1c2670-3b19-48f9-8194-2899248d4abc", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.15, "x": 0.19, "y": 0.55 }, "kind": "metric", "text": "1,000+ Annual IR Engagements", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": null, "subkind": { "name": "Big number", "slug": "big-number", "status": "active", "canonId": "019de52c-fc70-70c8-b965-0584548a9204", "version": 1, "description": null }, "framework": null }, "subkind": "big-number", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:11.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "13996286-f22a-4871-9553-19de259388ec", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.15, "x": 0.19, "y": 0.43 }, "kind": "metric", "text": "6,441 Cyber Certifications", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": null, "subkind": { "name": "Big number", "slug": "big-number", "status": "active", "canonId": "019de52c-fc70-70c8-b965-0584548a9204", "version": 1, "description": null }, "framework": null }, "subkind": "big-number", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:11.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "46361df6-45e0-4f08-9302-ae17e8188139", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.15, "x": 0.19, "y": 0.47 }, "kind": "metric", "text": "2 NSA Accreditations", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": null, "subkind": { "name": "Big number", "slug": "big-number", "status": "active", "canonId": "019de52c-fc70-70c8-b965-0584548a9204", "version": 1, "description": null }, "framework": null }, "subkind": "big-number", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:11.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5bf903a7-75d6-4f1b-8c6d-657543c0bcfe", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.15, "x": 0.19, "y": 0.39 }, "kind": "metric", "text": "7,000+ Cyber Subject Matter Experts", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": null, "subkind": { "name": "Big number", "slug": "big-number", "status": "active", "canonId": "019de52c-fc70-70c8-b965-0584548a9204", "version": 1, "description": null }, "framework": null }, "subkind": "big-number", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:11.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d40d20d2-27cb-457f-a882-dca2e737dc37", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.15, "x": 0.19, "y": 0.51 }, "kind": "metric", "text": "4 CREST Certifications", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": null, "subkind": { "name": "Big number", "slug": "big-number", "status": "active", "canonId": "019de52c-fc70-70c8-b965-0584548a9204", "version": 1, "description": null }, "framework": null }, "subkind": "big-number", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:11.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e7d1cc1b-897c-48dc-8dcc-66eb3f0b23b3", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Cyber Subject Matter Experts: 7,000+", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 15:28:24+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-1042-7629-9be0-661c4d123661", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.2, "x": 0.34, "y": 0.73 }, "kind": "paragraph", "text": "Outcome Driven: A robust portfolio of cyber capabilities with a practitioner-led approach, rooted in a 110-year-old consulting heritage to solve complex challenges faced by the global private sector", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:11.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0cd77696-3679-47ab-b1f6-29e398fd7a79", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.35, "x": 0.62, "y": 0.44 }, "kind": "paragraph", "text": "Frost & Sullivan 3x consecutive \"Largest Global Supplier of Cybersecurity\"; Forrester Cybersecurity Incident Response Wave Strong Performer; Gartner Digital Forensics & Incident Response Market Guide; IDC Market Scape US Incident Response Leader", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:11.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "221c18b2-9e17-410d-ab3f-14870d7bcd47", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.15, "x": 0.05, "y": 0.28 }, "kind": "paragraph", "text": "Business insight meets cybersecurity innovation to reduce enterprise cyber risk, leveraging advanced tradecraft and a practitioner-led approach across a variety of industry sectors across the globe", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:11.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "563a7ff3-b03f-40ce-bcf1-4d51b49c7477", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.2, "x": 0.56, "y": 0.73 }, "kind": "paragraph", "text": "Technical Depth & Breadth: Expertise in building, enhancing, and scaling security across the enterprise from AI to Zero-Trust and everything in between", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:11.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e7469234-7b1d-494f-9d7e-091b9026634b", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.2, "x": 0.78, "y": 0.73 }, "kind": "paragraph", "text": "Adversary Informed: Real-time insights into criminal and nation-state adversaries to drive effective tactical and strategic decision-making", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:11.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f73c75ff-f5fa-4d18-b6f3-e42a5bf04219", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.15, "x": 0.05, "y": 0.18 }, "kind": "title", "text": "Booz Allen Overview", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:11.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "fa7e7361-1937-4766-9cf8-3f3487afc4fa", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Executive summary", "slug": "executive-summary", "status": "active", "bestFor": null, "canonId": "019dd9e1-4b63-72d5-9734-da757d91ca61", "version": 1, "bodyDocId": null, "description": "A condensed view of the entire argument on a single slide / block.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "f419cec8-6aa9-40e9-8624-473ed37dfb10", "evidence": "Booz Allen Overview", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 21:44:31.445685+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 9, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 9, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 9, "name": "Desire for Improvement", "beatId": "7f0c200f-402d-4914-a74c-0d1775791175", "matchId": "62eb898a-b450-4eab-9006-9f7a52772e74", "beatType": { "name": "Desire", "slug": "aida-desire", "status": "active", "canonId": "019dd9b8-11f0-704e-b2bb-fbb6a226467d", "version": 1, "description": null }, "evidence": "Slide 9 provides a Booz Allen overview, indicating a desire for improvement", "position": 4, "isPrimaryArc": true, "parentBeatType": { "name": "Evidence", "slug": "evidence", "status": "active", "canonId": "019dd9b8-03f9-772a-b84a-4f07b415b77a", "version": 1, "description": "A dedicated proof beat exists in only ~4 arcs (Gambit, Sequoia, AIDA, Monroes). Other arcs embed evidence inline within development." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 10, "type": "appendix", "function": "other", "rawType": "appendix", "block": null, "metadata": { "slideType": "appendix", "slideTypeCanon": { "name": "Appendix", "slug": "appendix", "status": "active", "canonId": "019de52d-0762-71f8-b564-89ab863301cc", "version": 1, "description": null }, "function": "other", "functionCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-15e1-75bc-99dc-07732380e2ce", "version": 1, "description": null }, "density": "dense", "densityScore": 61, "componentCount": 9, "textChars": 433, "nDataPoints": 0, "notes": null, "elementsJson": [ "headline_text", "paragraph", "screenshot", "headshot" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 18:12:07.401+00", "seconds": 5.399, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5e88-73ef-bd57-cf13ce8ed1d4/10", "deck": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4", "deckAnchor": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4#slide-10", "deckJson": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Signup to receive our IR update communications.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-24 15:28:22+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-1042-7629-9bdf-ac23c556832a", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.15, "x": 0.45, "y": 0.6 }, "kind": "image", "text": "Tony Gaidhane", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Headshot", "slug": "headshot", "status": "active", "canonId": "019de52c-fd5f-765c-9282-38b54f61bbbf", "version": 1, "description": null }, "framework": null }, "subkind": "headshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:07.401+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9e5a5d6e-2c5f-499e-a8af-56b1e6d44f43", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.15, "x": 0.05, "y": 0.6 }, "kind": "image", "text": "Brendan Rooney", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Headshot", "slug": "headshot", "status": "active", "canonId": "019de52c-fd5f-765c-9282-38b54f61bbbf", "version": 1, "description": null }, "framework": null }, "subkind": "headshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:07.401+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c1535cad-d129-4cee-b6a1-1b88d9815012", "parentComponentId": null }, { "bbox": { "h": 0.45, "w": 0.15, "x": 0.845, "y": 0.05 }, "kind": "image", "text": "Mobile signup page screenshot", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:07.401+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cdc4c0ca-0138-46a0-9b93-4c9ccd4b0f56", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.35, "x": 0.05, "y": 0.4 }, "kind": "paragraph", "text": "Email: incident@bah.com\nU.S. Hotline: +1 (888) 266-9478 “BOOZ-IRT”\nUK/EU Hotline: +44 (808) 296-8080", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:07.401+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9a3d5e2f-69fd-4889-8a49-1413a06ad64a", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.15, "x": 0.2, "y": 0.7 }, "kind": "paragraph", "text": "Brendan Rooney\nSenior Vice President\nGlobal Incident Response", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:07.401+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d9cf4c3f-787c-42f5-ba34-f6ffe34e4281", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.15, "x": 0.6, "y": 0.7 }, "kind": "paragraph", "text": "Tony Gaidhane\nVice President\nGlobal Incident Response", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:07.401+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e2c6fb33-8a18-47dc-889a-8d4abbd96adc", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.25, "x": 0.715, "y": 0.35 }, "kind": "paragraph", "text": "Signup to receive our IR update communications.\ninfo.boozallen.com/IR_Update_Signup", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:07.401+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e34373f6-fe3c-47fb-b6a6-3bb290c3312a", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.4, "x": 0.05, "y": 0.35 }, "kind": "title", "text": "INCIDENT RESPONSE CONTACT DETAILS", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 18:12:07.401+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1e512e6a-ae94-442a-83c5-2f25e9384990", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 10, "arc": { "name": "The Sparkline", "slug": "sparkline", "status": "active", "bestFor": "Keynotes, TED-style talks", "canonId": "019dd956-606e-720c-905a-42607ac0bf50", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "What Is -> What Could Be -> What Is -> What Could Be -> New Bliss", "description": null, "familyLabel": null }, "from": 10, "name": "Call to Action", "beatId": "75674ad3-8b08-47b6-8310-d7d866f49acc", "matchId": "62eb898a-b450-4eab-9006-9f7a52772e74", "beatType": { "name": "Action", "slug": "aida-action", "status": "active", "canonId": "019dd9b8-1285-74f0-8552-c04c08014586", "version": 1, "description": null }, "evidence": "Slide 10 provides incident response contact details, encouraging action", "position": 5, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true } ], "arcBeats": [ { "from": 1, "to": 2, "label": "Current Situation", "description": "The deck begins with a cover slide and KPI dashboards" }, { "from": 3, "to": 4, "label": "Threat Actor Trends", "description": "Slides 3-4 show industry trends and threat actor YTD trends" }, { "from": 5, "to": 6, "label": "Problem & Complication", "description": "Slides 5-6 present data tables on ransom demand by threat actors" }, { "from": 7, "to": 8, "label": "Solution & Approach", "description": "Slides 7-8 list underwriting focus areas – top 10 security controls" }, { "from": 9, "to": 9, "label": "Desire for Improvement", "description": "Slide 9 provides a Booz Allen overview, indicating a desire for improvement" }, { "from": 10, "to": 10, "label": "Call to Action", "description": "Slide 10 provides incident response contact details, encouraging action" } ], "loops": [ { "from": 2, "to": 3, "label": "Voice Of Customer", "description": "Understand current incident response metrics" }, { "from": 5, "to": 6, "label": "Mece Breakdown", "description": "Analyze ransom demand by threat actors" }, { "from": 7, "to": 8, "label": "Quick Win Big Bet", "description": "Identify top security controls for underwriting focus" } ] }