Time to identify by identification method

Summary

Figure 14 slide: a stacked MTTI/MTTC horizontal bar chart by identification method, with an inset photograph at far left and a single column of body copy.

Visual description

White slide with standard chrome. At the far left, a small rectangular photograph shows a person with braided hair and glasses working at a desktop in front of server racks, lightly desaturated. To its right a single body column opens with a bold lead-in ("Figure 14. Data breaches disclosed by the attacker also took the longest time to identify and contain.") flowing into regular text. The right third is a soft gray rounded panel holding a stacked horizontal bar chart titled "Time to identify and contain a breach by how the breach was identified": three rows (By disclosure from the attacker 320, By a benign third party 273, By the organization's security teams and tools 241), each a purple MTTI segment plus a navy MTTC segment with day counts inside and a bold total at the right. Axis 0 to 350, MTTI/MTTC legend below.

Key takeaway

Slipping a single small, desaturated photograph into an otherwise all-data layout to add a human note without breaking the restrained color system. The chart device is the same purple/navy stacked bar used elsewhere, so the deck stays internally consistent page to page.

Reuse notes

The inset photo is a low-cost way to warm up a dense analytics page; keep it small and tonally muted so it does not fight the chart. Reuse the consistent stacked-bar-on-gray-panel module whenever a metric splits into identify plus contain time across categories.