29. The Six Hours
Domain: Incident Response POV: Sable Reading time: ~15 minutes
The breach of the eastern gear-chamber was the worst incident since the Shroud had first appeared at the Outer Ring — worse than the service door failure, worse than the poisoned shipment, worse than the automaton backdoor. A coordinated attack, executed by multiple agents working in parallel, that breached three separate barriers in the space of an hour and released a concentrated surge of Shroud-matter directly into the gear-trains that powered the Middle Ring.
By the time the SIEM generated the first alert — a boundary controller reporting anomalous pressure against the eastern wall — the Shroud had already penetrated the outer barrier. By the time Thread responded to the alert — three minutes, the fastest response the fellowship had ever managed — the second barrier had been breached and the third was failing. And by the time the council convened in emergency session, the gear-chamber was filling with gray-violet fog, and the gear-trains that powered the industrial district were beginning to seize.
Sable took command. Not because she had been appointed — the council had no formal chain of command for incidents of this magnitude — but because she was the one who had a plan, and the one who could execute it, and the one who understood that the next six hours would determine whether the city survived.
Hour One: Containment.
The first priority was to stop the Shroud from spreading. The gear-chamber’s internal segmentation — the walls within walls that Sable had insisted on during the architecture redesign — activated automatically when the boundary controllers detected the breach. The chamber was isolated from the adjacent systems: the automaton assembly lines, the water treatment facilities, the residential district above. The Shroud was trapped inside the gear-chamber, unable to spread laterally.
But the gear-trains themselves were still connected to the broader network — the mechanical linkages that transmitted power from the gear-chamber to the rest of the Middle Ring. Sable ordered those linkages severed. Not sealed — severed, physically disconnected, the brass couplings cut by emergency crews in full protective gear. The disruption cut power to three districts and stopped the automaton workforce cold. But it contained the Shroud. The damage was limited to the gear-chamber and the immediate vicinity, rather than cascading through the entire Middle Ring infrastructure.
Hour Two: Eradication.
The second priority was to remove the Shroud from the gear-chamber. The Shroud could not simply be vented — releasing it into the air would have spread the corruption beyond the containment zone. It had to be neutralized. Tessa and her engineers, working from a safe position outside the containment zone, deployed a series of counter-agents that Sable’s research had identified: chemical compounds, derived from the same cryptographic principles that protected the city’s communications, that destabilized the Shroud’s structure and caused it to dissipate. The process was slow — the Shroud was dense and concentrated, far more than any previous breach — but it was working. The gray-violet fog began to thin. The gear-trains, though damaged, were no longer actively corroding.
Hour Three: Recovery.
The third priority was to restore function. The gear-chamber itself was too damaged to operate — the Shroud had corroded dozens of gears and seized several of the main driveshafts — but the city could not afford to wait for full repairs. Wren, working with the engineers, activated the alternate power routes that had been designed during the supply chain crisis: secondary gear-trains, maintained in parallel with the primary ones, that could be brought online to provide partial power to the affected districts. The alternate routes were not sufficient for full operation — the automata ran at reduced capacity, the assembly lines moved at half speed — but they were sufficient to prevent a complete collapse. The city stumbled, limped, and continued to function.
Hour Four: Investigation.
The fourth priority was to understand what had happened. The SIEM’s logs provided the raw data: the sequence of alerts, the pattern of access requests, the communications between the agents who had executed the attack. Thread analyzed the data with the same patient intensity that Thread brought to everything, tracing the attack from its initial preparation — a series of seemingly innocuous supply requisitions, placed weeks in advance — through its execution. The agents had been inside the city for at least a month. They had been operating independently of Vale — not following his instructions but exploiting the chaos he had created. They were not ideologues; they were opportunists, seeking to profit from the crisis rather than advance any particular agenda.
Hour Five: Communication.
The fifth priority was to tell the city what had happened. Quill drafted the proclamation — a brief, factual account of the attack and the response, designed to inform without alarming. The proclamation acknowledged the severity of the incident — three barriers breached, a gear-chamber compromised, three districts on reduced power — but emphasized the effectiveness of the response. The Shroud had been contained. The gear-trains were being repaired. The alternate power routes were operating. The city was damaged but intact.
The proclamation was posted at every public square and read aloud by the gate-guards and the council representatives. The citizens — who had endured months of crisis and had learned to distinguish between panic and concern — received the news with the quiet, grim acceptance of people who had been living under siege for long enough that another breach, however severe, no longer felt like the end of the world.
Hour Six: Lessons Learned.
The sixth priority — and the one that Sable insisted on, even as the engineers were still working to repair the gear-chamber and the investigators were still analyzing the attack — was to document what had gone wrong and what needed to change.
The containment had worked — the segmentation had limited the damage, and the severed couplings had prevented a cascade. But the detection had been too slow: the SIEM’s alert had arrived three minutes after the first barrier was breached, and those three minutes had been enough for the Shroud to penetrate the second barrier. The detection rules needed to be more sensitive — tuned to detect the early signs of a coordinated attack, not just the individual events that comprised it.
The eradication had worked — the counter-agents had neutralized the Shroud — but the process had taken too long and required too much manual intervention. The counter-agent deployment needed to be automated, triggered by the containment system rather than dependent on human decision-making.
The recovery had worked — the alternate power routes had prevented a complete collapse — but the alternate routes themselves had been designed for a different kind of failure and had required significant improvisation to adapt to this one. The recovery procedures needed to be broader, covering more failure modes, tested against more scenarios.
“Every incident is a lesson,” Sable said to the council, at the conclusion of the six-hour response. “If we learn from it. The attack was severe, but it was not catastrophic, and the reason it was not catastrophic is that the defenses we built — the segmentation, the monitoring, the alternate routes — functioned as designed. They did not function perfectly. They never function perfectly. But they functioned well enough to contain the damage, eradicate the Shroud, and restore function before the city collapsed.”
“And the lessons?” Penric asked.
“The lessons will be incorporated into the next round of improvements. Better detection. Faster eradication. Broader recovery procedures. The incident response process does not end when the incident is over. It ends when the lessons have been learned and the defenses have been improved. And then it begins again with the next incident, and the one after that.”
She closed her logbook — the incident report, the analysis, the list of improvements — and looked at the map on the wall: the gear-chamber, still marked in red, but surrounded by the green indicators of the alternate power routes and the yellow indicators of the repair crews still working. The city had been attacked, and the city had survived. Not because it was invulnerable — it was not, and never would be — but because it had learned, over months of crisis, how to absorb an attack and recover from it. How to contain damage, eradicate threats, and restore function without losing the will to continue.
That was what incident response meant: not preventing every attack, but surviving every attack. Not avoiding failure, but learning from it. Not hoping that the next attack would never come, but preparing for it so thoroughly that when it arrived, the city would be ready.