The sky above Reykjavík was the color of a fresh bruise, heavy with the promise of a spring storm. Inside a modest, well-lit office overlooking the harbor, Stina Jónsdóttir was trying to save the world. Or, at least, the part of it she was responsible for.

Later that evening, Stina walked over to Lars’s desk. The storm outside had finally broken, lashing rain against the windows.

On the attacker’s screen, a simple, infuriating message appeared: Access blocked. Security key required.

She reached out and tapped the YubiKey. "That’s not a security device, Lars. That’s a bouncer. And it doesn't care how good your fake ID is. It only lets you in if you have the secret handshake."

Stina’s heart seized. She saw the credentials land in the attacker’s server. She saw the bot start to move, trying to replay the session. She saw the attacker attempt to log in from an IP address in Minsk.

Back in the office, Lars’s phone buzzed. It wasn't a text. It was his authenticator app, screaming: "New login attempt from Minsk. Approve or Deny?"

This was the moment. The moment where most companies failed.

"You almost gave me a heart attack," she said.