2. Ghost in the Credential

The private meeting room on the forty-ninth floor was a cube of smoked glass and hush. Harrison Croft sat at the head of a table that could seat twenty but currently held only three—himself, Martin Cross, and an empty chair that was conspicuously angled toward the door. Harrison was a man whose face had been carved by decades of boardroom litigation, all sharp planes and a mouth that never fully closed, as if perpetually about to cross-examine.

“Sit, Martin. We have a narrow window before the auditor’s preliminary readout.”

Martin settled into the chair opposite Harrison, leaving the empty one between them. He placed his tablet on the table, screen-down, a gesture of submission that he knew Harrison would notice and misinterpret.

“I understand there’s been some unusual activity in the executive data tier,” Harrison began, folding his hands over a manila folder. “The board has retained ForenSight Analytics—they’re ex-NSB cyber division, very discreet, very expensive. Their lead examiner, a woman named Cora Vale, started her crawl at 6 a.m. She’s already flagged three anomalies.”

Martin kept his breathing steady. He had anticipated Cora Vale—her name appeared in a Palimpsest briefing six months ago as one of the few forensic specialists who could recover overwritten RAID stripes. But he had also prepared a contingency: a dead-man switch buried in Aegis’s root directory that would corrupt the timestamp rollback logs if anyone accessed them without his biometric authorization.

“Anomalies are the cost of doing business at scale,” Martin said, his voice a calm baritone. “Aegis processes thirty-seven million events a day. False positives are statistically inevitable.”

Harrison’s thin lips curved into something that was not a smile. “Cora doesn’t do false positives. She does probabilities. And she’s assigned a 78% probability that the midnight query on Diane Harlow’s medical record—the one that originated from a badge ID that matches Leo Park—was actually routed through a virtual machine that spoofed Leo’s credentials. She’s already isolated the VM’s network fingerprint. It matches a contractor known as ‘Palimpsest.’”

Martin did not flinch. Palimpsest had assured him that all contractual relationships were anonymized through a shell in the Seychelles. But assurance was not certainty, and certainty was a luxury he could no longer afford.

“That’s a serious accusation,” Martin replied, tilting his head slightly. “But it points to Leo, not to me. If Leo’s credentials were spoofed, then someone framed him. And if someone framed him, the same someone could have framed me. I suggest we let Cora finish her investigation before we draw conclusions.”

Harrison opened the manila folder and slid a single photograph across the table. It was a still from a security camera—grainy, low-res, but unmistakable. It showed Martin’s silhouette standing near the server rack on the thirty-second floor at 2:14 a.m. on the same night as the ADHD query. The timestamp on the photograph matched the query window.

Martin’s mind raced. He had indeed been on the thirty-second floor that night—but only because Palimpsest had asked him to physically insert a USB key into the backup controller, a task that was supposed to be invisible. The camera had been angled away from that rack according to the floor plan. Someone had moved the camera.

“I was there for a routine hardware check,” Martin said, his voice unwavering. “The operations team was testing a new cooling protocol. I can produce the maintenance log.”

“You already did,” Harrison said, pulling a second sheet from the folder. “Your maintenance log entry was filed at 2:17 a.m. But the camera’s metadata shows you were actually there at 2:14 and left at 2:19. The log says 2:15 to 2:20. A three-minute discrepancy, Martin. That’s the difference between a routine check and a data exfiltration window.”

Martin felt the floor tilt slightly. He had not filed that log. Palimpsest had promised to backdate it. But Palimpsest had apparently backdated it to the wrong time—or worse, had deliberately inserted the discrepancy to create leverage.

“I can explain the discrepancy,” Martin said, buying time. “The building’s time server was resynced that night after a power flicker. I recall a memo about it.”

Harrison leaned back. “We’ll see. Cora is currently cross-referencing every time server log for the past ninety days. If there was a resync, she’ll find it. If there wasn’t, she’ll find that too.”

The door slid open, and a woman walked in—medium height, gray-streaked hair pulled into a severe bun, wire-rimmed glasses that caught the overhead light like tiny interrogation lamps. She carried a ruggedized laptop under one arm and a thermos that smelled of black coffee.

“Cora Vale,” Harrison announced. “Meet Martin Cross, director of operations.”

Cora did not offer a handshake. She set her laptop on the table, opened it, and began typing without looking up. “I’ve been through the first layer of the Aegis audit. Two things demand immediate attention. One: the medical record query attributed to Leo Park was indeed a spoof, using a virtual machine with a MAC address that traces to a known anonymizing service. Two: the same virtual machine was used to inject a fake performance review into Diane Harlow’s file—a review that claims she mismanaged a $4 million hedging position in Q3. That review has already been circulated to the compensation committee.”

Martin kept his face a mask. He had not known about the fake performance review. Palimpsest had acted unilaterally, escalating the war without his permission. That was the danger of employing a ghost—they had their own agendas.

“That performance review is false,” Martin said, with genuine conviction. “Diane’s hedging record is impeccable. I reviewed it myself.”

Cora looked up, her eyes pale gray and unnervingly still. “I know it’s false. Because I recovered the original version from an archived backup that wasn’t overwritten. The fake was inserted at 3:01 a.m. yesterday—twenty minutes after Leo Park was admitted to the hospital. So unless Leo hacked the system while unconscious in an ambulance, someone else is running this operation.”

The silence stretched like a wire under tension. Martin understood that Cora Vale was not his enemy—yet. She was a neutral instrument, a scalpel that cut both ways. If he could redirect her attention to a third party, he might survive.

“What about the auditor’s own access?” Martin asked, shifting the frame. “Who authorized the forensic engagement? And who chose ForenSight? Because I know for a fact that the board’s standard protocol is to use Internal Audit first, not an outside firm. This smells like a preemptive strike by someone with a personal stake.”

Harrison’s jaw tightened. Martin had touched a nerve. The board was not monolithic; there were factions, loyalties, secret alliances. If Harrison had hired ForenSight without consulting the full committee, that was a vulnerability.

“The engagement was authorized by the governance committee,” Harrison said, too quickly. “With my signature.”

“And whose recommendation?” Martin pressed. “Because I recall that Diane Harlow’s uncle is a partner at a firm that competes with ForenSight. If she wanted to discredit you, Harrison, she would have recommended a competitor—not ForenSight. So who actually pushed for ForenSight?”

Cora Vale answered, her voice flat. “The recommendation came from Leo Park’s assistant—a woman named Sara Ng. She submitted a proposal three weeks ago, citing ForenSight’s work on the Morrison data breach. The proposal was approved by Harrison without a second vote.”

Martin filed that detail away. Sara Ng—a quiet, efficient woman who had been Leo’s right hand for six years. If she had planted the proposal, it meant Leo had been preparing for a forensic fight well before the succession race began. Leo was not the naive spreadsheet-prayer that Martin had assumed. He was a strategist.

“Sara Ng is not a board member,” Martin observed. “She’s administrative staff. Yet she influenced a high-level forensic procurement. That’s either a sign of Leo’s foresight—or of someone else using her as a proxy.”

Cora closed her laptop and looked directly at Martin. “I don’t care about office politics. I care about data integrity. And I can tell you, with 93% confidence, that the spoofing VM was operated from a device that was physically inside this building—not remotely. The latency patterns are consistent with an internal network connection, not a VPN. So whoever did this was in the building between 1:30 a.m. and 3:30 a.m. yesterday.”

Martin thought of his own movements that night. He had left at 10 p.m., taken the subway home, and had an alibi—his building’s concierge, a retired police officer who logged every entry and exit. He had not returned until 7:30 a.m. That alibi was verifiable. But Palimpsest had a physical presence in Veridian—a small office in the industrial district, staffed by a rotating crew of techs who had keys to the building’s maintenance tunnels. If Palimpsest had sent an operative inside, Martin could claim ignorance.

“I was not in the building after 10 p.m.,” Martin said. “Check the concierge logs at The Ellison—that’s my residence. I have a doorman with a badge scanner.”

Cora nodded and made a note. “We’ll verify. But in the meantime, I need your full cooperation. That means handing over your personal device—this tablet—and any secondary devices, including your home workstation.”

Martin hesitated for exactly half a second—long enough for Cora to notice, but not long enough to be damning. He slid the tablet across the table. “It’s encrypted. You’ll need my biometric to unlock it. But I’ll give that willingly, because I have nothing to hide.”

He pressed his thumb to the sensor, and the tablet chimed. Cora took it, placed it in a Faraday bag, and sealed it.

“One more thing,” Cora said, standing. “The coffee machine on the forty-seventh floor. Its internal maintenance log shows a five-minute gap in recording from 2:08 a.m. to 2:13 a.m. on the same night. That gap coincides with the precise window of the VM activation. I’ve seized the machine’s memory chip and sent it to a lab for physical extraction. If there’s a secondary recorder—or if someone tampered with the machine—we’ll know by tomorrow.”

Martin kept his face blank. The magnetic chip he had spotted that morning—the one that did not belong to the manufacturer—had been placed by someone else. Perhaps Palimpsest, perhaps a third party. But if the lab found traces of the toxin that had sent Leo to the hospital, the investigation would shift from digital espionage to attempted homicide. And Martin had no alibi for the toxin.

After Cora and Harrison left, Martin sat alone in the glass cube for ten minutes, staring at the empty chair. He retrieved his personal phone—a second device that was not on the company inventory—and texted Palimpsest through a scrambled signal: “Cora Vale has the coffee chip. Lab extraction in 24hrs. What was on that chip?”

The reply came three minutes later: “Not mine. I didn’t touch the machine. Someone else is playing.”

Martin’s stomach clenched. If Palimpsest had not placed the chip, then a fourth player had entered the game—someone who knew about the toxin, knew about the spoof, and knew about Martin’s backdoor. A player who had been watching from the shadows, waiting for the moment to strike.

He walked to the breakroom, now cordoned off with yellow tape and a “Do Not Enter” sign. Through the tape, he saw the coffee machine’s empty cavity—its motherboard removed, its power cable dangling. A forensic technician in a white suit was taking photographs of the surrounding countertop.

Martin turned away and headed for the stairwell. As he descended to the thirty-second floor, he passed Sara Ng—Leo’s assistant—who was standing by the vending machines, scrolling through her phone. She looked up and smiled, a thin, practiced expression.

“Mr. Cross. I heard about the audit. You must be very stressed.”

“I’m fine, Sara. How’s Leo?”

“Stable, but they’re running a toxicology screen. They found something unusual in his blood—a synthetic compound not commonly seen. The hospital has alerted the police.”

Martin felt the temperature drop. Police. That was beyond boardroom maneuvering. That was a different arena, one where his digital ghost tricks would be useless.

“That’s terrible,” he said, his voice perfectly modulated. “Please let me know if there’s anything I can do for him.”

Sara nodded, but her eyes held a gleam that Martin had never noticed before—a sharp, predatory intelligence. “Actually, there is something. Leo asked me to give you this before he collapsed.” She handed him a sealed envelope, identical to the one he had received earlier.

Inside was a single line, typed in the same font: “The chip on the coffee machine was placed by the person who knows your dead-man switch password. You have one hour to confess to the board, or that password gets published to the entire executive list.”

Martin folded the note and slid it into his pocket. Sara was already walking away, her heels clicking a steady rhythm.

He had underestimated everyone. Diane, Leo, Sara, even Palimpsest. The war of ghosts had become a war of flesh and bone, and the ground beneath him was crumbling faster than any timestamp rollback could fix.

He had one hour. And the only person who could save him was the one he had betrayed first—Diane Harlow.

He walked toward her office, his mind racing through probabilities, leverage points, and lies that might yet become truths. But when he reached her door, he found it locked and her chair empty. On her desk lay a sticky note with a single word: “Gone to the hospital. Visiting Leo. Don’t follow.”

Martin turned and looked down the corridor. The forensic auditor’s kit was being wheeled out of the server room, and Cora Vale was typing on her laptop, her face impassive. At the far end, Harrison Croft was on the phone, gesturing angrily.

And in the basement, a red light began to blink on the backup controller—the controller where Martin had inserted Palimpsest’s USB key. The key was supposed to be a data transmitter. But now, as the red light pulsed faster, Martin realized it was also a receiver.

Someone was downloading every file he had ever touched.

The hour was ticking. And the ghost had become the hunted.