{
  "docId": "019dd923-5de0-76bd-a166-0ebac6399c4f",
  "docSlug": "994e80d75408a4b6",
  "documentTitle": "INCIDENT RESPONSE INSIGHTS",
  "authorId": "misc",
  "authorName": "Booz Allen",
  "documentKindSlug": "consulting-deck",
  "documentKindLabel": "Consulting deck",
  "sourceTypeSlug": "strategy_consulting",
  "sourceTypeLabel": "Strategy consulting",
  "presentationDate": null,
  "orientation": "landscape",
  "aspectRatio": 1.778,
  "pageNumber": 3,
  "pageCount": 10,
  "prevPage": 2,
  "nextPage": 4,
  "slideType": "kpi_dashboard",
  "function": "analyze_data",
  "density": "dense",
  "nDataPoints": 24,
  "notes": "The slide uses 100% stacked bar charts to show composition over time.",
  "elementsJson": [
    "bar_chart_100pct",
    "bar_chart_100pct",
    "paragraph",
    "logo_grid"
  ],
  "metadataConfidence": 1,
  "imagePath": null,
  "slideHref": "/slides/019dd923-5de0-76bd-a166-0ebac6399c4f/3",
  "deckHref": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f",
  "deckJsonHref": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f.json",
  "deckAnchorHref": "/decks/019dd923-5de0-76bd-a166-0ebac6399c4f#slide-3",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "Ransomware matters have dominated our case load and have been between ~30% to ~50% of the total incident volume, followed by Email Compromise making up ~10% to ~40% of the total incident volume.",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd951-f389-7267-bc9f-3b4b0888be0c",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.7,
        "w": 0.28,
        "x": 0.38,
        "y": 0.1
      },
      "kind": "chart",
      "text": "Incidents by Types – 2024 YTD",
      "attrs": null,
      "subkind": "bar-stacked-100pct",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "3a4a1b88-6432-4c67-8444-e9346f95e64d",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.7,
        "w": 0.28,
        "x": 0.68,
        "y": 0.1
      },
      "kind": "chart",
      "text": "Incidents by Industry – 2024 YTD",
      "attrs": null,
      "subkind": "bar-stacked-100pct",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "87bd20b9-ba0e-49a5-bb4a-efe729806fff",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": null,
      "kind": "metric",
      "text": "Incident volume distribution",
      "attrs": null,
      "subkind": "primary",
      "toolName": "Quantification",
      "toolSlug": "quantification",
      "confidence": null,
      "componentId": "019dd951-f389-7267-bc9f-3fb1fb46f500",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.2,
        "w": 0.2,
        "x": 0.15,
        "y": 0.62
      },
      "kind": "paragraph",
      "text": "The top five most impacted sectors are consistently across Manufacturing, Financial Services, Construction, Healthcare and Legal organizations, making up between ~50% to ~70% of our caseload each month.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "71bc3ee3-9fd4-4774-a171-bbf2ca2956bb",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.2,
        "w": 0.2,
        "x": 0.15,
        "y": 0.28
      },
      "kind": "paragraph",
      "text": "For 2024 overall, Ransomware matters have dominated our case load and have been between ~30% to ~50% of the total incident volume, followed by Email Compromise making up ~10% to ~40% of the total incident volume.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "d789fa1d-0d24-41ff-9883-4ab78e68ee51",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.05,
        "w": 0.15,
        "x": 0.15,
        "y": 0.18
      },
      "kind": "title",
      "text": "Incident YTD Trends",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "1631a096-5886-4cea-83d7-55567e507d97",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 4,
      "from": 1,
      "beatId": "a763e876-23f9-4df3-9ba8-d06c3d4c89a9",
      "arcName": "The Sparkline",
      "arcSlug": "sparkline",
      "beatName": "Current State",
      "beatSlug": "sparkline-what-is-1",
      "evidence": "Monthly Incident Metrics, Incident YTD Trends, Threat Actor YTD Trends",
      "position": 0,
      "confidence": 0.8,
      "parentBeatName": "Setup",
      "parentBeatSlug": "setup"
    }
  ],
  "loops": [],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}