You pin the annual report note beside the intern's post and stare at the overlap until your eyes ache. Here is what you have so far: the intern's social media post suggests Isabella delays risk alerts on purpose (the "marshmallow" metaphor). The annual report footnote confirms that "non-standard observation periods" happened during the past fiscal year. Both point to the same conclusion: someone at Blackridge is pausing the alert system when positions are losing money. That is suggestive. Maybe even strong. But it is still only one bridge between public language and private practice. Blackridge's compliance team could dismiss the intern as gossip and the footnote as standard wording. If this matters enough to build the ransomware attack around, you need another angle. Another piece of evidence that cannot be argued away as "interpretation." You feel the hunger for certainty like a thirst. You also recognise it as dangerous: certainty is what makes people sloppy. You step back from the board, rub your face, and accept the uncomfortable truth that you are not finished, you are only finally asking the right question. - **Assemble the Paper Trail Board**: Organize what you have so far. [[Cybercrime/The_Phisherman/Paper Trail Board|Assemble the Paper Trail Board]] - **Seek independent proof**: You need more evidence. [[Need Independent Proof|You may need more evidence. Let's seek independent proof]]