The dwell times chart - it looks like the "All" figure is a combination of the other two, but what you're seeing is an average in every case, which obscures the count of the number of cases. So for example in 2017, the average dwell time for a breach which was reported externally was 1088 and for internally reported was 320.5. The fact that the average of "all" is 498 means there are far fewer external reports than internal ones (the average is closer to the internal figure). You can imagine if there was 1 external and 10 internal reports then the "all" average would be (1088+3205)/11 = 390.27. So the position of the "all" figure between the other two just gives an indication of how heavily weight the number of reports was for each category. (For 2017 the ratio is about 3:10 external:internal)
