The remediation took three weeks.
During those three weeks, the Depth project was paused. Not shut down — paused, with a small team conducting the access review in a sequestered environment. Marcus participated in the review for four days, working alongside a security specialist he had not met before who was thorough and professional and asked very good technical questions.
At the end of the four days, the review confirmed what Marcus's analysis had indicated: the production semantic layer was clean. The test environment had been the only compromised surface, and the relay server modification had been sufficiently subtle that it had not generated any alerts in the facility's existing monitoring systems.
The existing monitoring systems were, in Marcus's assessment, inadequate. He wrote this conclusion in a two-page memo that he sent to Elaine through Marsh, knowing that it would be uncomfortable for someone and not particularly caring.
Elaine sent back a one-line reply: *Memo received. Recommendation under review.*
Davies was removed from the project. Marcus was not told what happened to Davies beyond this — whether an arrest, a quiet administrative action, or something else — and he did not ask. The working group's internal security team was Elaine's domain and he had delivered what he had to deliver.
What concerned him more than Davies was the pre-existing nature of the penetration. If the access channel had been built in anticipation of the Depth project's scope, then the principal network had a source of intelligence inside the project's planning layer — someone who had known, before Marcus was involved, that a capability of this kind was being developed.
That source might still be active. Davies had been the technical arm of the operation. Someone else had known to put Davies in place.
He raised this with Elaine in a brief call.
"Yes," she said. "We know." And then: "Leave that one to us."
He heard what she wasn't saying: this is beyond your scope. He accepted it, for now, because he had delivered what he could deliver and pushing further into an active counterintelligence operation without authorization was a different category of action than building monitoring tools inside his own architecture.
He went back to Threadline.
---
The team had been patient during the three weeks. Jin and Amir had used the time to make progress on the supply chain intelligence product — the monitoring layer was largely complete, and Amir had built something he was genuinely proud of, which was visible in the specific quality of his silence when he showed it to Marcus. Priya had closed two more compliance customers. Yuki had written a sixteen-page threat assessment of the competitive landscape that was, Marcus thought, the best internal document the company had produced.
He read Yuki's threat assessment twice and held a meeting to discuss it.
"The near-term replication risk," Yuki had written, "is lower than previously estimated. The Threadline methodology requires a combination of domain knowledge and architectural intuition that is not easily reverse-engineered from outputs alone. The more significant risk is acquisition — a well-capitalized actor acquiring either Threadline directly or a key member of its team."
Marcus had read that sentence three times.
"The acquisition risk," he said at the meeting. "Yuki, talk me through your thinking."
She had been expecting the question. "The direct approach failed — Welch's proposal didn't get traction. The next logical move for a sophisticated actor is to attempt to acquire the capability rather than replicate it. Either by acquiring the company at a price that makes the founders difficult to refuse, or by approaching individual team members."
"Individual meaning which of us specifically?"
"You and me," she said, without hesitation. "You for the architecture. Me for the security layer." She paused. "Jin and Amir are excellent but their skills are more transferable — a sophisticated buyer would rebuild the team around you and me. The others would be collateral."
Jin looked at her. "That's a cold way to put it."
"It's accurate," she said. "I'd rather plan for what's real than what's comfortable."
Marcus looked at the table. "What's the counter?"
"For the company-level acquisition risk: make the company more expensive to acquire. Grow faster, raise Series B sooner, build customer lock-in that makes the revenue harder to carve out without the team." She paused. "For the individual approach: make sure everyone on this team knows it might come, knows what it would look like, and knows what to do when it does."
"Which is?" Priya said.
"Tell Marcus immediately. Don't engage, don't decline, don't do anything until Marcus knows."
Marcus looked at Yuki. She was twenty-three years old and she had just done a threat analysis that a seasoned corporate security professional would have been proud of.
"That's the protocol," Marcus said. "If anyone receives an approach that feels like it might be related to this — a recruitment email, a consulting offer, a social introduction that feels slightly off — bring it to me before you respond. Even if it seems benign."
He looked around the table. Four people nodding. The specific kind of nodding that was comprehension rather than compliance.
"One more thing," he said. "I want to give each of you something concrete." He looked at Priya first. "Priya — I want equity refresh agreements for everyone on this table. Including you. The current grants don't reflect what this company is worth now."
Priya looked at him. "I'll draw up the parameters."
"Generous parameters," he said. "This team built this. The equity should show it."
He looked at the table again. The faces of four people who had been told, first, that the world around them was more dangerous than they had known, and second, that the person responsible for their exposure was going to make it right in the only currency that was fully his to give.
The System updated at the edge of his vision:
---
**Strategic Foresight Lv. 3 → Lv. 4** *(multi-vector threat correctly characterized and systematically countered)*
**Fourth Gate: 79% complete.**
*Note: the architecture of trust includes material commitment. Continue.*
---
Material commitment. He thought about equity refresh agreements and about what it meant to put the company's cap table where the company's words were.
He thought the System was right.