Surface Area

I already knew I was going to take the job.

There’s no version of this where I walked in undecided, and I’ve been in this room long enough not to pretend otherwise. I made the decision at approximately midnight, sitting in the dark of the loft with the servers humming and the city’s ambient light coming in through the north windows. The analysis was complete. The conversation with Slash had gone the way it had gone. The word NIGHTGLASS was sitting in my notes document next to a question mark. Every indicator available to me was pointing at something I couldn’t fully articulate and hadn’t taken seriously enough yet to call what it was.

And I was going to take the job anyway.

I could tell you I went in with my eyes open. I could tell you I had a plan. Both of those things have a certain technical accuracy, I did go in eyes open, and I did have a plan, and the plan was to keep the surface area small and watch for the thing they wouldn’t explain and not commit to anything I couldn’t take back. What that plan left out was the possibility that the thing they wouldn’t explain would present itself as an asset. That the person across the table would turn out to be someone I found, and here I want to use a word precisely, convincing.

I have made worse mistakes. But few of them felt this good going in.

---

The meeting location came through an encrypted channel they’d set up in the reply, which was a reasonable security gesture that I noted as a data point: Meridian Group’s public face was a registered business address and a clean corporate website with the studied minimalism of a company that isn’t trying to attract attention. Their actual operational face knew how to spin up an ephemeral encrypted drop with a twenty-four-hour expiry. These two things existed in the same company and described two entirely different organizations wearing the same name.

The building was on Fifth, east of the 110, in the pocket of Bunker Hill that had survived the reconstruction with its bones intact and its sense of purpose slightly rearranged. The neighborhood had been financial services before the Fall, which gave it the architectural vocabulary of serious money, stone and glass, modest signage, the visual grammar of buildings that didn’t need to advertise because their tenants already knew where to find them. Most of those tenants were gone now, replaced by the reconstruction economy’s equivalent: Compact contractors, private infrastructure firms, the small and nimble organizations that had moved into the vacuum left by the large ones that hadn’t survived. The towers still dominated the skyline above, glass and steel, the city’s old forward-lean, but at street level Bunker Hill was quieter than it looked from a distance, and the quieter version was more honest.

The company name by the buzzer, Meridian Group, was in half-inch letters. I’d looked it up already, the same search I’d run the night their email arrived. Clean registration, eighteen months old, three linked entities with legitimate surface areas and a subcontracting structure that would take a week to fully trace. The name at the buzzer matched the documentation exactly. Exactly the kind of corporate architecture that communicates nothing to see here by being too clean to look at directly.

I walked around the block once. I pressed the buzzer.

---

The woman who came down to meet me was not what the setting had led me to expect, which was either a positive sign or a very sophisticated version of a negative one.

She was maybe mid-thirties. Her physicality was economical, the bearing of a woman who has already measured every room she walks into before she appears to have looked around it. Dark shirt, dark trousers, no lanyard, no logo, nothing announcing rank or organization. She moved like someone who was done performing things for rooms.

She extended her hand. “Cade,” she said.

Not Mr. Voss, which is what the email had used. Cade. Mr. Ashfield had told them how he went. The choice to open on that register said something about the approach they were taking.

I shook her hand. “Hey.”

“Lena Holt.” She held the door. “Come up.”

The interior matched the exterior’s commitment to functionality. Exposed conduit, clean walls, the smell of a building that has housed server equipment long enough that the ventilation has given up pretending otherwise. One flight up, a conference room: a table, four chairs, a window facing a blank wall, a water carafe. No presentation screens. No marketing materials. No corporate biography designed to reassure me the company was legitimate.

Good, I thought, despite myself. That’s a good sign.

I sat down and noted that I was noting good signs and reminded myself to apply the same attention to the bad ones.

She poured two glasses of water. “I’d rather not waste your time with the version of this meeting where we pretend we’re getting to know each other,” she said. “Mr. Ashfield gave us a thorough introduction. I’ll give you the same.”

“Go ahead,” I said.

“We have a product in late development. Network infrastructure management software, monitoring, access control, anomaly detection across distributed node architectures. Before it goes into production, we need a genuine penetration test. Not a compliance audit. Someone who will actually find what the internal team missed because they built it and can no longer see what they built.”

“What made Mr. Ashfield’s recommendation relevant to that?” I said.

It was the question I’d walked in with. Not suspicious, just the gap in the chain I wanted filled before I ran any models on the rest of it.

She set the carafe down. “He spoke highly of your capability with vulnerability research, especially in client-server applications. He described a firmware security engagement you completed recently. Hardcoded remote access key in a consumer device platform. Kernel-level privilege escalation via an unpatched su vulnerability. Factory reset as the remediation vector, coordinated disclosure.” She said all of this with the flat acknowledgment of someone reading from notes she’d already committed to memory. “He said the write-up documented methodology, not just findings. That’s what we’re looking for.”

I listened to the description of the Nestfield work as if hearing it from the outside for the first time. It was accurate. It was also the description of an auditor, not an attacker, the framing of legitimate security research rather than exploit development. Slash had positioned me exactly as you’d position a contractor you were placing in a professional context. The work was the same. The vocabulary was different.

“It was a good project.” I answered.

“Our security research team agreed. It mirrors our architecture at a larger scale.” She pressed her fingertips together in front of her mouth, the only motion she allowed herself, and considered me. “What impressed us was how quickly it was resolved. Forty-eight-hour turn-around for a critical disclosure with 9.8 CVSS. Mr. Ashfield had mentioned at least six others you responsibly disclosed in the past six months that were under NDA. I respect the need for discretion, of course, but I admit I’m curious how you managed so many in so little time.”

Curious. I sat with that. I described the outline. “Mainly remote code execution in consumer platforms with compiled binaries.” I held back a moment. In here I wasn’t the name behind the terminal; I was a face and a body in a room that ran on disclosure. “The genetic algorithm I use to fuzz for mishandled input brings the flaws to the surface. Two years of work. It’s…” I chose the word. “…effective.”

She nodded. “That’s good. Unconventional methods from unconventional engineers are what this project calls for.”

“You have engineers,” I said. My skepticism fought me for that moment.

“Excellent engineers. But they have the blind spots of people who built the system, they cannot imagine what they didn’t build.” She looked at me without any particular affect. “You don’t have those blind spots. That’s the job.”

“What’s the access scope?”

“Network architecture. Application codebase. Full infrastructure schematic. You will be open to anything a sophisticated attacker with initial access might attempt to pivot from.” She folded her hands on the table. “We want to know if the software does what it says and nothing it doesn’t say.”

Nothing it doesn’t say. The phrase landed with the weight of knowing exactly what you’re observing when you say it.

“Okay.” I knew I would say it before I walked in the door.

She slid a card across the table. I opened it. The figure was handwritten, nothing digital before this moment. Ɲ40,000, denominated in NoC, to be paid upon receipt of the final deliverable, a full report. I sat with the number, with what it would solve for the next six months. Whoever set this number had done their research and had decided not to low-ball a contractor they expected to find something real.

“Two weeks,” she said. “One report with status updates to be given at the close of each day of progress. You’ll be paid at the close of the engagement, regardless of findings. You keep your analysis and your methodology, the NDA covers the product’s internal architecture only.”

That last clause was the tell. Bug bounty contracts muzzle methodology. What she was describing was a contract designed to buy a service, not extract value and silence the person who generated it. It was the contract of an organization that intended to work with contractors more than once.

That fact, by itself, should have bothered me more than it did.

“I’ll review the full NDA,” I said.

“Of course.” She stood, the meeting had reached exactly the length it needed to reach. “One more thing.”

She said it like the thing you planned to say last.

“We know you have other ongoing work, research, things in motion. We’re not asking you to pause any of it.” She held the door. “The NDA covers our infrastructure only. Whatever you’re working on independently stays yours. We pay for quality, not time. As Ashfield put it, I expect your results to speak for themselves.”

The corner of my mouth moved before I could stop it. I hadn’t expected that. “He’s very generous.”

“Pleasure meeting you, Cade,” she said as she extended her hand as I stood from the chair.

“Thank you.” I took her hand and shook it. “You too.”

I walked out past her and down the stairs. I felt her eyes on me as I went.

Whatever you’re working on independently. Not the scope, not the deliverables, she’d been precise about those. Whatever you’re working on. Phrasing that knew something was running and was choosing, in this moment, not to name it. What she’d left unsaid sat in the space between the sentences and did exactly as much work as it needed to.

Outside, the Bunker Hill sun came back in full. The city noise returned like a curtain dropping.

I stood on the sidewalk for a moment with the folded card in my pocket and the NDA in my bag.

That was a good meeting, I thought.

That’s the problem.

I walked down Fifth toward the station. The Bunker Hill heat was a different quality than the city below, something to do with the elevation and the concrete, with how the blocks up here channeled it. I had the NDA in my bag and the folded card in my pocket and nothing I could do with either for the next twenty minutes except carry them.

The Metro A Line platform was half-full. I got on and stood and watched Bunker Hill recede out the window as the train dropped toward the Civic Center. I did not look at the NDA again. I had already read it twice on the stairs. I knew what it said.

What I was doing on the train was the more difficult thing, which was running the math on both tracks simultaneously and trying to keep them from touching.

Track one: a pentest engagement for a distributed infrastructure management company, Ɲ40,000 across two weeks, legitimate access to a network architecture I had not yet seen in full. A contract with a clean NDA that left me my methodology. A client who knew I had other ongoing work and had chosen not to ask about it.

Track two: a Dark Cypher Tier Two challenge on a node infrastructure I had been probing for six days, with a certificate metadata field that contained a word that had just appeared in the legal boilerplate of track one.

The surface area rule. Don’t let either track know about the other. Stay on both.

Whatever you’re working on independently stays yours. She’d saved it for the door. We know you have two tracks. We have decided to be comfortable with that. You are under no obligation to confirm what the second one is.

Which meant they had guessed. Or known. Or both.

The train came up from underground and the city returned in full. I got off at the WAIT stop and walked the six blocks east with the folded card still in my pocket and both problems sitting in my head on their separate rails, parallel, not yet touching, the space between them exactly the width of a decision I hadn’t made yet.

---

[15:16:22]  WEST ABBEY INSTITUTE OF TECHNOLOGY — PALISADES QUAD / PHYSICS EXTERIOR
            CAM_31_QUAD_SOUTH
            SUBJECT_7741-F / CALLOWAY, CASSANDRA M. — seated
            SUBJECT_8814-F / REYES, SAMANTHA A. — seated, adjacent
            Interaction flag: STANDARD_SOCIAL — non-notable
            Directional audio: NOT PROVISIONED (public exterior)
            Flag: NOMINAL

There was a table on the south side of the physics building that took afternoon shade without asking anything of the people who used it, and the two women at it had used it often enough that neither had needed to suggest it. Two coffees. One coffee had already been going cold. The network logged the temperature of the air and not the fact of the coffee, because the coffee was not a public safety concern.

The taller one, CALLOWAY, CASSANDRA M., the records would say, Unit 2B, third-year, no active flags, was being told things she already knew.

“That’s great!” A pause. “The Uppsala team is already getting the same results you expected from their first run of the degradation test, and yet you’re not happy.”

“It’s one test.”

“It’s one test that went the way you said it would.”

“That’s not the same as confirmed.” She turned the cup a quarter turn on the table and did not drink from it. The system had no field for a person refusing to let herself hope. It recorded a stationary hand.

“It’s enough confirmation that they gave you the preliminary findings at all!” Sam pressed. “If they didn’t think it was worth looking at, much less tell you the results, they probably wouldn’t have said anything.”

Cass sat silently, still twisting the cup on the table by the lid one quarter turn per grasp.

“Fine,” Sam said. “Be that way, now back to the guy.”

“There isn’t a back to the guy. I told you everything in the gym.”

“You told me the facts. You didn’t tell me what you thought about them.” Sam said it the way she read a result off a chart. “You stayed up until one-fifteen.”

“Because the problem was interesting.”

“The problem that got interesting the same night the man in your laundry room asked you a question. He’s the variable in your world of constants, Cass. I’m only naming the variable.”

“He’s a neighbor.”

“Third floor neighbor.”

“Yes, Sam. I know where people live in my own building. Why is that relevant?”

She did. She knew the floor and the unit and that he took the stairs, and that was more than a person keeps about someone she has only noticed.

“Because you keep saying it like it’s his name so you don’t have to tell me his name.” Sam answered, sipping her coffee with a half-smirk behind the cup.

Cass leaned back. Looked up. Sighed. Looked down.

“Because his name doesn’t matter.”

“Cass, my love. Names that don’t matter are not names that people keep to themselves.” The silence as a response from Cass left Sam with the confirmation she needed for her own personal victory over the conversation. She folded her laptop, the latches clicked, the thing she did when she had decided to say the thing she’d been holding, and did not know she did.

“You know, Cass, I think this is a symptom of a bigger problem. Can I be honest with you?”

Cass rolled her eyes and waved her hand. “You’re already going to anyway.”

She wasted no time.

“You’re a third-year. You haven’t taken a full weekend since January. You canceled our plans on me twice this month for sequencing data, which—” Cass opened her mouth to say something, but Sam continued straight through it. “—that’s fine. I’m not upset about it. But you have no prospects, no fun, no people you see besides me, not that I’m not great, and you are thirty seconds from becoming a person everyone in your field calls brilliant but nobody actually knows. And I say that with nothing but love.”

“So your point is I’m a hermit?”

Then she stood, tucked the laptop under her arm, and offered the only finding she’d rate clinical-grade all afternoon.

“My point is: You need to get laid.”

Cass laughed once, hard, and the cold coffee was forgotten entirely. “Sam. That’s so—”

“That’s my clinical diagnosis.” Sam cut her off.

“You’re being—”

“Your friend.” Another interruption. “Who also happens to be right. I have a class to get to. Think about this, and text me tonight. Don’t stay up until one-fifteen again.”

She left. Cass didn’t.

She sat in the shade a while longer, and the system counted one stationary subject, dwell increasing, and had no category for the meaning of a person sitting still. Most of what Sam had said was true, and Cass knew it. The one thing Sam had gotten wrong was the variable she’d named and then, being Sam, assumed she’d already solved, and Cass let her keep the error, and did not correct the part of the diagnosis that had quietly stopped being accurate this week. She kept that part. The network had nowhere to put it, and neither, yet, did she.

[15:42:10]  SUBJECT_7741-F — TRANSIT · quad → administration building
            CAM_31 → CAM_44_ADMIN_LOBBY — handoff nominal
            Vendor transaction: 1× coffee (cart, Palisades quad)
            Flag: NOMINAL

She held a fresh coffee she didn’t especially want that she had bought from Paulo, who nodded as he always nodded, asking nothing back. She bought it and carried it inside because her hands felt better with something to hold. Second floor. The elevator bank at the end of the corridor. She pushed the call button.

The log would say that SUBJECT_7741-F had crossed the quad, bought a beverage, and waited for an elevator. It would not say that she’d been told the truth about her life at a shaded table and agreed with most of it despite every word of protest that said otherwise. It filed her as it had filed her before and would file her again, NOMINAL, BELOW THRESHOLD, a young woman of no particular interest, at the end of a corridor, forty seconds before the doors opened on the one thing the afternoon’s diagnosis had failed to account for.

---

I still had the card with Ɲ40,000 written on it in my pocket that I kept my hand on as if holding the card was like holding the value itself.

I was coming back through the WAIT administrative building at a quarter to four when the elevator opened on the second floor.

This is a thing the elevator does. I’ve been in this building for two years and I’ve filed it under unexplained minor infrastructure and never investigated further, which puts it in the same category as roughly sixty percent of WAIT’s mechanical situation. The doors open on two about thirty percent of the time regardless of what you pressed. I didn’t press two. The doors opened.

Cass was standing there with a canvas bag and a coffee from the cart on the Palisades quad, waiting for the elevator to take her the rest of the way down.

She looked up. I was already looking at her.

The doors held open for slightly too long, which is also a thing this elevator does.

She stepped in. “Hey.”

“Hey.”

The doors closed. We descended.

She had been on this side of campus recently enough that the coffee was still warm, I could smell it, which was either useful information or an embarrassing degree of noticing. I decided not to investigate which.

“Uppsala,” I said. “Did they write back?”

She looked at me sideways, recalibrating.

“This morning,” she said. “One of the junior researchers is already running the degradation test.”

“That’s fast.”

“The timing argument apparently landed.” She glanced at her coffee. “So, thank you.”

She said it to the coffee, not to me. It was a look I knew, the one you wear when you won’t let yourself be glad about a thing before it’s definitively yours. I knew it because I was wearing it too. I rubbed the edge of the card in my pocket.

“You had the data. I pointed at the thing you were already looking at.”

“That’s not nothing.” She said it with the precision of crediting accurately rather than generously. Not a compliment. A correction.

The elevator reached the lobby. The doors opened. We were in the ordinary geography of separate lives again. She stepped out ahead of me and I noticed, in the half-second before she turned toward the left exit, that the expression she was wearing was that of someone recently told something true she hasn’t finished processing yet. Not the Uppsala calculation, not the recalibration. Something more like a person who has been given an accurate diagnosis they haven’t decided what to do about.

I recognized it because I’d been wearing a version of it for the last forty minutes on the A Line.

Whatever she’d been thinking about before the elevator opened was back in her expression and moving.

“Later,” she said.

“Yeah.”

She went left. I went right. The building let us go.

---

That evening, in the period between when the city went quiet and when the first delivery infrastructure began moving through the empty streets, I sat at my desk with two windows open.

Left monitor: the Dark Cypher Tier Two interface. The node I’d been working before the meeting, a lateral movement problem, filesystem permissions on a target that was trying to look like it wanted to be read and was lying about what it was. I’d made some progress this morning. In the node logs, someone had solved the same target six days ago, same methodology, slightly faster, slightly cleaner. Vanta. On the progress tracker, Vanta was in Tier Three. He’d finished Tier Two a week into the competition. While I was still working through lateral movement problems he was somewhere I hadn’t reached yet, running a race I was still trying to catch up to.

Right monitor: the NDA. I’d read it twice on the way home and twice more since sitting down. It was exactly what she’d described, tight on the product’s internal architecture, loose on everything else. The kind of document written by someone who understood that a contractor who can’t talk about their own methods is a contractor with a liability, not an asset. Two names in the legal structure. The first was the internal product designation, in the boilerplate specifying what the confidentiality terms covered, the product appeared by name. I’d seen that word before. I’d written it in my notes document next to a question mark the day prior, in a certificate metadata field from a Dark Cypher Tier Two dead drop.

The second appeared in the opening recitals, the standard language naming the parties and their corporate relationships. Meridian Group LLC, a wholly-owned subsidiary of Sigil Systems Inc. The company that had interviewed me. The company that had told me my credentials weren’t sufficient for a staff position. Now the ultimate parent of the contract I’d just been handed.

I sat with both of those.

The certificate I’d found in the Tier Two dead drop was generated on infrastructure belonging to the company whose NDA I was reading. The Dark Cypher competition’s Tier Two targets were hosted on, or neighboring, the same network I was being paid to pentest. Both tracks had the same infrastructure underneath them.

I ran this through twice. The math held both times.

The surface area rule has a corollary that nobody writes down because it’s too obvious to state: the moment you confirm that two tracks are actually one track, you have to decide whether you’re going to act on that knowledge or file it. Acting on it changes the surface area in ways you can’t fully predict. Filing it keeps the shape intact.

I filed it.

Then I set it aside.

I stayed with it a while longer.

The thing about running two parallel tracks, and I have done this, not often but enough, is that it requires a certain kind of honesty about which track you’re actually on. The moment you stop being honest about that, you lose the ability to protect either one. My current honest answer was: I didn’t know. I had gone into the meeting with the surface area rule in mind and I had come out of it with an NDA I was about to sign and a compensation figure I wasn’t going to pretend I wasn’t thinking about. I had also come out of it with an unpacked list of things that didn’t fit, which I had been adding to for four days now and which had crossed the threshold from items of note to pattern I cannot yet name.

The NIGHTGLASS certificate in a Tier Two target that had no business being there. Vanta seeding the competition and winning it simultaneously, bad game design if the prize is the point, deliberate selection if it isn’t. The question mark file in the dead drop that nobody left there by accident. Slash saying careful twice. A product description that was technically complete and named nothing. The handwritten figure. The NDA written by someone who expected to be negotiating with someone who knew exactly what they were signing.

Keep the surface area small. Stay on both tracks. Don’t let either one know about the other.

I considered the accept button. Ɲ40,000. Staged deliverables. A contract with clean terms from a client who had already told me, in the language of professional courtesy, that they knew I was running something else and had decided not to make it their problem. The Nestfield payout had covered a month. This made a serious dent in the student loan balance that had been sitting in the back of my head since I withdrew from MIT, with enough left over to stop counting for a while. The math of what that bought, in terms of time, in terms of what I stopped counting, was not a calculation I needed to make explicitly, because I had already made it on the train.

You already know how this ends. The contract’s in this building somewhere with a number on it, and you’ve read the parties clause the same as I did. So here’s the part the paperwork can’t show you: I saw it first. I sat at that desk and watched two tracks turn into one, and I understood exactly what that meant. Remember that when you decide what I am.

I clicked accept on the NDA.

Then I went back to Dark Cypher.

The city hummed outside. The servers hummed behind me. Two monitors, two problems, two versions of the same question, what is this thing I’m inside, each one asking it in a different language and neither one, yet, offering the answer.

I already knew I was going to have to find it for myself.