They have architectural knowledge. Silence on Brian's end. Not the good kind. How certain are you? I'm watching the request right now.

This isn't automated scanning. This is someone building a pathway into the core payment infrastructure. More silence. James could almost hear Brian's mental calculation. Weekend, family vacation, new CEO starting Monday.

The absolute worst possible timing for a security escalation. That might be a false alarm. Okay, listen. Document everything you're seeing. Screenshots, log exports, full timeline.

I'll escalate first thing Monday morning. But James, we cannot create alarm before Patricia Harrison's first day. The board is already questioning whether she can handle operations. If we trigger a security incident report and it turns out to be nothing, it's not nothing. I believe you.

But Monday morning, clean documentation, proper channels. Can you monitor it over the weekend and make sure it doesn't escalate? James looked at his laptop screen. The requests were still coming. Slow, steady, patient.

Yeah, I can monitor it. Good. Thank you. And James, I know you're careful about this stuff. Just make sure we're not overreacting to anomalous traffic that has a legitimate explanation.

The call ended. James sat in his apartment staring at the data streams. The word that stuck in his mind was legitimate. There was nothing legitimate about this. He checked the time again.

Emma's game was starting in 12 minutes. James closed the laptop, grabbed his keys, headed back to the soccer fields, but the pattern of requests kept cycling through his mind, the precision of it, the patience. Someone was building something, and they were doing it with knowledge that should have been inaccessible. Saturday afternoon bled into Saturday evening. James sat in the folding chair outside Emma's room.

She was asleep. Nightlight casting its steady amber glow. Stuffed elephant tucked under her arm the way it had been every night since she was three. His laptop was open on his knees. Remote access to the Aurelius monitoring systems.

The probing requests had continued. Still low frequency, still careful, James traced the access pattern deeper. The 2015 gateway sat at the edge of the current infrastructure, technically still in production, but largely bypassed by newer authentication systems. Maintaining it was one of those tasks that stayed on the to-do list perpetually because nobody wanted to risk breaking the small percentage of transactions that still routed through it. James knew that gateway.

He'd been part of the team that built it. Back when Aurelius was smaller. When architectural decisions were made in conference rooms with whiteboards instead of in Jira tickets with seven levels of approval. The gateway connected to the core payment cluster through a legacy API layer. That layer had been patched dozens of times over the years. hasty fixes during outages, temporary solutions that became permanent because proper refactoring never got prioritized.

And somewhere in those patches, someone had found a seam. James pulled up the architectural diagrams. The official documentation was 3 years out of date, but he had his own notes, handwritten schematics in a notebook he'd kept since his second year at the company, the real map of how everything connected. He compared his notes to the access pattern there. The attackers were targeting a specific API endpoint, one that technically required authentication, but had been configured with overly permissive error handling.

If you knew exactly how to format the request, you could bypass the token validation not easily. You'd need to understand the internal routing logic, know which headers to spoof, anticipate how the system would respond to edge cases. This wasn't script kitty exploitation. This was architectural knowledge. James checked the access logs again, looking for the source of that knowledge.

The API endpoint in question had been documented in exactly three places. The official architecture repository, the legacy system documentation that nobody read anymore, and a set of technical diagrams from 2014 when the infrastructure was being planned. Those diagrams had been created by the technical team at the time. Five engineers, two of them had left the company years ago. One had retired, one was James, and the fifth was Steven Reeves.

James stared at that name. Steven Reeves, now VP of operations, 14 years at Aurelius. Smooth, political, the kind of person who always seemed to know which meetings mattered and which initiatives would get executive attention. James had never trusted him. But distrust wasn't evidence.

He needed to verify, James pulled up the access logs for the architectural repository. Looking for who had downloaded those old diagrams recently. The logs showed regular access by the current infrastructure team. Expected, they referenced old documentation when troubleshooting legacy issues. But 6 weeks ago, there had been an unusual access pattern.

Someone had downloaded the complete 2014 architecture package. All the diagrams, all the specifications, everything, the user ID, Sreves Apenor. James felt something cold settle in his stomach. Steven Reeves had accessed highly detailed system architecture 6 weeks ago. And now someone with precise architectural knowledge was probing the exact vulnerabilities those diagrams would reveal.

Coincidence was possible. But James didn't believe in convenient coincidences when it came to security. This wasn't just an external attack. This was someone with inside knowledge. Potentially someone inside the company.

He checked the time. 10:30 p. m. Saturday night. Brian had said to wait until Monday. Follow proper channels.

Don't create alarm. But if this was what James suspected, waiting until Monday might be too late. He picked up his phone, started composing a message to Brian, stopped, deleted it. What was he going to say? that he thought the VP of operations might be involved in a security breach based on document access logs and timing correlation. That would sound paranoid, conspiratorial, the kind of accusation that ended careers if you were wrong.

James needed more evidence or he needed to make sure the threat couldn't materialize regardless of who was behind it. He made a decision. Tomorrow he'd come into the office, build temporary defensive measures, isolate the compromised gateway, create barriers that would contain any attempted breach. Not a permanent fix, but enough to buy time until Monday when he could brief the security team with complete information. James closed his laptop, checked on Emma one more time.

She was still asleep, peaceful, unaware that her father was about to spend his Sunday building walls around a system that might be under attack from the inside. Sunday morning, 8:00 a. m., James called Mrs. Williams, their neighbor, three doors down, retired elementary school teacher, had been watching Emma periodically since Linda died. The kind of dependable presence that made single parenthood slightly less impossible. Can you take Emma today?

Something came up at work. Mrs. Williams didn't ask questions she never did. Just confirmed she'd pick Emma up at 9:00 and keep through dinner. James packed Emma's overnight bag.

Extra clothes, homework, the stuffed elephant because separation anxiety was still a thing sometimes, even at 8 years old. Daddy has to fix something at work today. You're going to stay with Mrs. Williams. Emma looked up from her cereal.

The same evaluating expression she'd inherited from Linda. The one that meant she was processing more than she said. Is it important? Yeah, it's important. Okay.

No argument, no complaint, just acceptance. Which somehow made it worse. James dropped Emma at Mrs. Williams' apartment, then drove to the Aurelius building Sunday morning. The parking lot was nearly empty.

Weekend skeleton crew inside. Just enough staff to monitor the systems and respond to critical issues. James badged in, took the elevator to the third floor. The operation center was quiet. Two engineers at their stations, Michael Cooper and someone James didn't recognize.

Both looked up when he entered. Michael's expression registered surprise. James didn't expect to see you today. Got an alert. I need to check on.

Shouldn't take long. Not entirely true, but close enough. James settled at his primary console. Logged in, pulled up the monitoring dashboard. The probing requests were still active, slightly increased in frequency.

Still targeted at the same gateway endpoint, he opened a terminal window, started building isolation barriers. The challenge with defending a live production system was that you couldn't take it offline. Aurelius processed billions of dollars in transactions daily. Even a brief outage would cascade into catastrophic financial exposure. So, James had to work around it, build defenses without disrupting the flow.

He started by creating traffic redirect rules. Anything matching the attack pattern would be rerouted into a sandboxed monitoring environment. The requests would appear to succeed from the attacker's perspective, but they wouldn't actually reach the core infrastructure. Careful work. Each rule had to be precise enough to catch malicious traffic without accidentally blocking legitimate transactions.

James worked methodically, testing each rule against historical traffic patterns, confirming no false positives. By noon, he had the first layer of defense active, but it wasn't enough. The attackers had been patient, building their understanding over weeks. If James just blocked their current approach, they'd adapt, find another angle. He needed to identify what they were ultimately trying to reach.