The story ran six weeks later.
The State Financial Monitor published it on a Tuesday morning — twenty-two hundred words, fully documented, with a data visualization that Priya had helped their graphics team build from Threadline's output. By noon it had been picked up by three regional newspapers. By Thursday it had been picked up by two national outlets. By the following Monday, the state attorney general's office had announced a preliminary inquiry.
Marcus read the announcement on his phone while eating lunch at his desk. Jin was on the other side of the room arguing quietly with a particularly stubborn API authentication issue. Priya was in Chicago, working with the State Financial Monitor team on a second story.
He put the phone down and went back to the code.
The announcement was good. The announcement meant attention, and attention meant the product was real in a way that no pitch deck could fully demonstrate. He had already received four inbound inquiries from other journalism organizations in the week since the story published, and two from what appeared to be compliance officers at private companies. He'd passed all six to Sera, who was helping him think about the sales process.
What concerned him was a different kind of noise.
Three days after the story published, Marcus's crawler — which he still ran in the background as a monitoring tool — had flagged an anomalous traffic pattern against Threadline's public demo interface. Not heavy traffic. Careful traffic. A set of requests that looked like a systematic probe of the API's behavior without credentials — not an intrusion attempt, but an observation attempt. Someone mapping the system's response patterns without trying to break in.
He had logged the source IPs. They resolved to a commercial VPN provider. Dead end, on the surface.
But the *pattern* of the requests was specific. It wasn't random probing. It was structured — the kind of structure that suggested familiarity with API security testing methodology, which was a fairly narrow field. Someone who knew what they were doing had decided to quietly look at Threadline from the outside.
Marcus spent an evening building a honeypot layer — a set of false API endpoints that would give a probing actor a slightly misleading picture of the system's architecture while logging their behavior in detail. He pushed the honeypot to production without telling Jin, not because he didn't trust Jin, but because he didn't want to alarm him before he understood what he was dealing with.
He showed Priya, because Priya had a background in security-adjacent contexts that Jin lacked, and because she would think clearly about it.
"Someone's interested in knowing how you work," she said, looking at the traffic logs. "Not interested in breaking in. Interested in the methodology."
"That's my read."
"Could be a competitor."
"There are no direct competitors."
"Could be a journalist."
"Possible." He didn't think it was a journalist.
"Could be someone who doesn't want the tool to find things," Priya said.
Marcus looked at her. This was what he had been thinking since day two of monitoring the traffic, but it was clarifying to hear it said plainly.
"The story we published," he said. "Two of the four individuals in the network graph are still active in the procurement space. One of them has a law firm on retainer that has a reputation for aggressive pre-litigation pressure."
Priya was quiet for a moment. "Are you worried?"
"I'm prepared," Marcus said, which was a different thing.
He had already consulted with a lawyer — an IP and data attorney that Sera had recommended — and had documentation prepared establishing that everything Threadline ingested was publicly available government data and that the analytical methodology was protected proprietary software. He was not doing anything illegal. He was, however, making specific people's lives more complicated.
He had expected this. It was, in a way, evidence of product-market fit.
He also quietly strengthened the company's own security infrastructure over the following week, working mostly at night. He hardened the API gateway, implemented better monitoring, moved the core processing infrastructure to a more defensible cloud architecture. He did this carefully, methodically, and without involving a security consultant, because he did not yet want anyone outside the company to know the company was paying attention to threats.
The System updated during this work:
---
**Exploit Intuition Lv. 3 → Lv. 4** *(defensive architecture applied at scale)*
**Real-World Integration Lv. 0 → Lv. 1** *(UNLOCKED: technical systems actively affecting observable real-world outcomes)*
---
*Real-World Integration.* The domain that had been locked since the beginning.
He read the description again: *technical systems actively affecting observable real-world outcomes.* The attorney general's inquiry. That, presumably, was the trigger. His code had gone into the world and rearranged something in it.
He found that he did not know quite how to feel about that. He sat with the feeling for a while — something between satisfaction and sobriety — and then he went to bed.
---
The probing traffic stopped after ten days.
Marcus was not reassured by this. In his experience, things that stopped abruptly had not gone away. They had changed tactics.
He told no one and kept watching.