Yuki found the name on a Wednesday morning, and she found it the way she found most things: by looking at what other people had decided wasn't worth looking at.
The published paper had a byline: Dr. Felix Hartmann, Senior Analyst, Meridian Capital Group. Not the same Meridian as Marcus's investor — a coincidence of naming that Priya had already flagged as a potential confusion risk. The paper cited Threadline's methodology in language precise enough to indicate familiarity with internal documentation. That was the known problem.
What Yuki had found was the revision history.
The trade publication used a standard content management system — the kind that logged document revisions in metadata that was technically public but practically invisible because nobody thought to look at it. Yuki had looked at it. The paper had been revised four times before publication. The third revision had added a co-author field that the fourth revision had removed. In the removed field, partially recoverable from the diff: a partial name. Eight characters. *V. Sorokin.*
She brought it to Marcus without comment and set the printed metadata on his desk.
He read it. Read it again.
"Where does the name resolve?" he said.
"Partially." Yuki sat. "There are three individuals with the surname Sorokin and a first initial V in publicly accessible professional databases in the financial data space. One is a retired academic. One is a junior analyst at a London quant firm, twenty-four years old, no prior publications." She paused. "The third is Viktor Sorokin. Forty-one. Founded a data analytics firm called Vektor Systems in 2019. Based in Zurich, with offices in Singapore and Dubai."
"What does Vektor Systems do?"
"Officially: alternative data solutions for institutional investors. Financial signal extraction, supply chain analytics, procurement intelligence." She looked at him. "Their public product descriptions are three to four years behind Threadline's current capability. But their client list, from what's visible, includes several sovereign wealth funds and at least two institutions with documented ties to Eastern European capital networks."
Marcus absorbed this. "The IP paper was their reconnaissance."
"That's my read. They're not a competitor trying to catch up. They're an actor trying to understand what we can do before deciding what to do about it."
"About us or with us?"
Yuki was quiet for a moment. "The methodology in the paper was described accurately but incompletely. The disambiguation confidence scoring was represented in a way that overstates our false positive rate by about thirty percent." She looked at him steadily. "That's not a mistake. That's a deliberate misrepresentation in a published document."
"So anyone reading the paper would believe our tool is less accurate than it is."
"Yes. Which benefits someone trying to position themselves as a more accurate alternative." She paused. "Or trying to make us look less threatening to people who might otherwise take us seriously."
Marcus thought about the eleven entities in the classified layer. He thought about Warren's description of principals with sophisticated operational security. He thought about a Zurich-based data firm with sovereign wealth fund clients and ties to Eastern European capital.
He thought about whether Vektor Systems and the principals were the same thing or merely aligned.
"Pull everything public on Sorokin," he said. "Professional history, corporate filings, conference appearances, publications. Don't go beyond public sources yet."
"Already started," Yuki said. "There's one more thing."
He waited.
"Sorokin gave a presentation at a data analytics conference in Amsterdam fourteen months ago. I found the slide deck published on the conference archive." She opened her laptop and turned it. "Slide eleven."
Marcus looked at the slide. It was a capability comparison chart — several named products benchmarked against an unnamed internal system Sorokin's firm was apparently developing. The named products included several established players in the alternative data space.
And Threadline. Listed by name, fourteen months ago, at a time when Threadline had two customers and had not yet closed its Series A.
"He's been watching us since before the Monitor stories," Marcus said.
"Since before you closed funding," Yuki said. "He knew what you were building before most of the market did."
Marcus sat back. He thought about the intrusion in October — the endpoint probing that had been attributed to a document handling error. He thought about the Argus graph and the managed rotation and the congressional recess alignment. He thought about fourteen months of someone watching from Zurich while he built and pitched and raised and hired.
"How good is Vektor's actual product?" he said.
"Unclear. Their public-facing demos show capability that is genuine but not exceptional. Their internal capability — I don't know." Yuki closed the laptop. "But a firm that knew to watch Threadline fourteen months ago is not operating on guesswork. They have good intelligence or good instincts or both."
Marcus nodded. He thought about what the right response was — not emotionally, but architecturally. Someone had been mapping him. The correct counter was not to panic, not to confront, not to disappear. The correct counter was to understand the shape of what they knew and didn't know, and to use the gap.
"Keep this between us and Priya for now," he said. "Not because Jin and Amir can't handle it — they can. But I need a few days to think about how this changes the picture before I change the team's picture."
Yuki looked at him. "Understood." She stood. At the door: "Marcus. Sorokin has been watching you for fourteen months. That's a long time to be watched without knowing."
"I know."
"It means he thinks you're important enough to watch carefully." She paused. "That's worth something."
She left.
Marcus sat with the metadata printout on his desk and thought about what it meant to have an enemy who had been paying attention longer than you had.
The System updated at the edge of his vision:
---
**Institutional Mapping** *(active — new entity flagged)*
*Viktor Sorokin / Vektor Systems: threat classification pending full assessment.*
**Strategic Foresight Lv. 2 → Lv. 3** *(adversarial actor identified from indirect evidence; pattern projected forward)*
**Fourth Gate: 38% complete.**
---
He looked at the numbers for a moment. Then he picked up the phone and called Warren.