after the maintenance window. A second message, sent two days later,
recommended disabling the account until the bank could verify the
permissions.
Neither warning had reached the board.
Instead, the internal ticket had been marked resolved by Martin Vale. A
note attached to the ticket stated that the risk was accepted because
the vendor’s maintenance schedule could not be delayed without affecting
a major technology migration.
Elena read the messages twice.
“Did you see these warnings?” she asked.
Martin stood near the door, flanked by the bank’s general counsel and an
internal investigator. “I saw a summary. The vendor told us the issue
was addressed.”
“The email says the route was still open.”
“I was told the remaining exposure was limited.”
“By whom?”
Martin hesitated. That pause told the room more than his previous
explanations had.
The internal investigator opened a second set of records. It showed that
Martin had received payments from a consulting company that had been
retained by Palisade Systems. The payments had been described as
advisory fees, but Martin had not disclosed them to the bank’s
compliance office.
Marcus looked as though he had been struck.
“Are you telling me our security chief received undisclosed money from a
vendor whose system he approved?”
Martin’s voice sharpened. “The payments were for independent consulting
work. They had nothing to do with this attack.”
“Then you should have disclosed them,” the general counsel said. “And
you should have reported the warnings rather than closing the ticket.”
Martin looked around the room, searching for someone willing to defend
him. No one did.
Elena did not claim that the payments proved he had planned the attack.
That was for investigators to establish. But the connection was serious,
and it explained why the warnings had been treated as an inconvenience
rather than a security concern.
“The technical evidence must be preserved,” she said. “The financial
records must be reviewed separately, and the bank needs to notify the
appropriate authorities. Do not use my report as a substitute for an
independent investigation.”
Marcus nodded slowly. “We will.”
Martin was escorted to another office while the investigation continued.
He was not arrested in the boardroom, and no one announced that the
mystery had been solved. The facts were serious enough without turning
suspicion into a verdict before the evidence had been reviewed.
For Elena, the important point was simpler: the bank had a security
failure, an undisclosed conflict of interest, and a process that allowed
a senior employee to dismiss warnings without independent scrutiny.
Fixing one software route would not fix those failures.
------------------------------------------------------------------------
By early afternoon, the immediate threat had been contained. The
suspicious service account was disabled, the questionable transfers
remained frozen, and the response team had created verified copies of
the relevant logs. The bank still needed a full forensic review to
determine what information had been accessed, but the attackers no
longer had the same path through the network.
Marcus asked Elena to remain for a private conversation.
“I owe you an apology,” he said when the others had left. “Three years
ago, we dismissed your concerns because we thought we could buy a
cheaper solution. Today, you came here to conduct an ordinary
transaction, and one of our employees treated you as if you had no
business being here.”
“Those are two separate failures,” Elena replied. “Both came from people
deciding they already knew what they were looking at.”
Marcus accepted the criticism without arguing. “We need Aegis. Not just
for today. We need a full review of our security architecture, and we
need a long-term plan that does not depend on a single vendor’s
promises.”
“Then you need an independent review, not a secret arrangement that
allows the bank to say it is protected before it has been tested.”
“We can put that in the contract.”
“You can put it in the contract, and then you can follow it. I will not
help you hide a breach from regulators or clients. I will not allow the
bank to use Aegis as a public-relations shield while leaving the same
management structure in place.”
Marcus looked at her for a long moment. He was accustomed to
negotiations in which the other party wanted a larger payment, a more
favorable clause, or a public acknowledgment of victory. Elena was
asking for controls that might expose his own institution to scrutiny.
“What would you require?” he asked.
“First, an independent forensic audit with direct access to the board’s
risk committee. Second, preservation of the evidence and notification to
regulators according to the law. Third, a review of every vendor account
with elevated permissions. Fourth, a protected channel for employees to
report security concerns without having their warnings buried by the
person responsible for the system.”
“And the commercial terms?”
“Aegis will charge its standard emergency-response rate. Any long-term
license will be negotiated separately, with clear limits on access and
independent testing. You will not receive exclusive ownership of our
core technology.”
Marcus glanced toward the city beyond the windows. “That will be
difficult to explain to some of our shareholders.”
“Then explain why it is necessary.”
He almost smiled, though the expression carried little humor. “You have
not changed.”
“I hope I have improved. But I have not changed that.”
Marcus agreed to the terms in principle and asked the general counsel to
draft a formal engagement. Elena insisted that the written agreement
specify what Aegis would and would not do. Her company would help secure
the network and assess the breach; it would not decide the bank’s legal
obligations or certify systems it had not examined.
When the meeting ended, Marcus walked her back toward the lobby.
“I want to make one thing clear,” he said. “Your check will be processed
correctly. Olivia will personally oversee the deposit.”
Elena stopped near the elevator.
“I don’t need the chief executive to oversee a deposit. I need your
employees to follow the same standards whether a customer wears a
thousand-dollar suit or a jacket from a discount store.”
Marcus lowered his eyes briefly. “You’re right.”
“Then start there.”
------------------------------------------------------------------------
Back at Counter Seven, Andrew had spent the afternoon replaying the
encounter in his mind. His manager had instructed him to document the
interaction and await a formal review. He had not been fired on the
spot, but his conduct would be examined alongside the bank’s
customer-service policies.
When Elena returned, Andrew stood before she reached the counter.
“Ms. Brooks,” he said, “I owe you a real apology. I assumed you couldn’t
possibly be the person represented by that check because of how you were
dressed. I treated my assumption as evidence, and then I laughed at you
in front of other customers.”
Elena looked at him without rescuing him from the discomfort.