"Show a smile, hide the blade."
— The 36 Stratagems,[Conceal a Dagger in a Smile]
Previously on this series: #5: Leo Walked Into a Burning House. He Walked Out With a Client. — Leo drove out at 3 AM to fix a competitor's outage and won the deal with raw technical skill. But his CEO told him to write a process doc because he "doesn't know how to manage upward."
#9: Lena and P Watched Two Suppliers Fight. The Logs Said Neither Was Clean. — Lena ran P's audit on two AI vendors and caught both cheating. She let the fire burn itself out. Meanwhile, she picked up another contract.
The visitor badge at CoreStack's front desk read: "VeriTest — Organizational Process Optimization Consultant."
Lena wasn't here to write a report template.
Before she walked in, Marcus Reed had mentioned: "I hear that Leo — the one who drove out at 3 AM and came back with a signature."
Lena didn't answer.
Leo was waiting in the conference room. On the table: last quarter's QBR report — 47 pages, cover title "CoreStack Technical Architecture & AI Capability Assessment Q3."
Lena sat down. Flipped through it for ten seconds. Closed it.
"Let me ask you a few things first," she said.
Leo nodded, hands folded on the table. Ready for technical questions.
"What are the three metrics the board cares about most?"
Leo d. He'd expected architecture questions.
"Uptime," he said. "Coverage. Response time."
"Good. Who does your report go through before it reaches the CEO?"
"VP Engineering first — he does a pass, then it comes back to me, I do another pass, and —" he stopped. "— by the time the CEO sees it, it's not always what I wrote."
Lena nodded. Didn't take notes.
"If you could only present three pages today, which three?"
Leo thought for a few seconds. He realized he couldn't answer.
While she asked those three questions, Lena was already drawing a map in her head. Not a reporting flow chart. A decision-path map. Who reads what. Who approves what. Who asks what before they sign. Every answer Leo gave, she added another node.
"I'll give you a template tomorrow. Try it out. Have your team open a read-only interface tonight — Datadog and the alerting system."
"Okay," Leo said.
He thought Lena was here to help him.
The next afternoon. Lena sent an email. The attachment wasn't a PDF — it was a link to a reporting tool deployed inside CoreStack's internal network.
She'd already spun up a lightweight instance inside CoreStack's environment. Leo's people opened the read-only interface exactly as she'd requested — the tool auto-connected to Datadog and PagerDuty. It pulled six months of historical data in a single day. The built-in AI analysis engine automatically generated trend baselines and anomaly predictions.
The tool's home screen had three panels. When Leo opened the link, this is what he saw:
┌─ VeriTest Reporting Tool v1.0 ────────────────┐
│ Connected: Datadog (ro) · PagerDuty (ro) │
│ Data span: 6 months (2026-01 – 2026-06) │
├───────────────────────────────────────────────┤
│ Executive Summary │
│ System Uptime 99.96% (+0.02% YoY, -0.01% MoM)│
│ Test Coverage 72.4% (+5.1% YoY, +1.2% MoM)│
│ Response Time p99 340ms (+12ms YoY, +8ms MoM)│
├───────────────────────────────────────────────┤
│ Trend: Response time may hit p99 alert in ~2 wks │
│ Risk: 3 red · 7 yellow · 22 green │
└───────────────────────────────────────────────┘
Leo stared at the screen. Read it three times.
After that 3 AM incident, he already knew what the CEO wanted. Not technical answers. He didn't let himself finish that thought.
"That's it?" he typed in the chat.
"That's it," Lena replied. "The board doesn't want depth. They want direction."
"Did this tool read our production data?"
"Read-only coverage metrics and alert frequency — standard integration. Just needs a read-only token."
Leo opened the tool's permissions page. Datadog read-only token. PagerDuty read-only. Nothing concerning.
He ran this week's operations data first. The PDF popped out — three pages. He flipped through it. Then again.
This must've been what she meant by "the board doesn't want depth, they want direction."
He thought about it for a moment — read-only data, running inside his own environment. Then he forwarded the link to the entire engineering team with a single line: "Use this tool for all future quarterly reports."
Lena had already set it up — the tool could export QBR-format PDFs directly. Print version, projector version, archive version. Same data, two layouts.
At the bottom of the template — in the methodology notes section — one extra line.
Data Standard: VeriTest Testing & Evaluation Framework v1.0
Not bold. Not a footnote. A routine citation — the kind nobody reads. Leo didn't see it. The CEO wouldn't either.
But if anyone ever asked, "Whose methodology is this?" — the answer was already on the page.
Week two.
Leo started handing her more things unprompted.
"Can you look at this budget write-up? Due next week."
"That data methodology thing I told the CEO about — can you write it up?"
"Next week's budget meeting — can you sit in? You're better at explaining this stuff."
Lena said yes to everything. Smiled through every request. And every time she finished a document, another citation appeared at the bottom — VeriTest framework, Lena's name, data methodology source. Not prominent. Normal. Professional. Exactly where it belonged.
Leo started thinking: this consultant is actually useful. For the first time, he didn't have to worry about the things he couldn't explain.
Lena watched him sign the authorization form. His name hit the paper faster than his eyes reached the page.
Wednesday afternoon. IT sent over a third-party integration authorization — standard procedure, the tool needed formal approval to read CoreStack's data.
Page 7, Section 3 read:
CoreStack Third-Party Integration Authorization — Page 7, Section 3
"The platform will collect baseline data from the client environment
to improve reporting accuracy and predictive capabilities."
Leo read the clause three times — "collect baseline data from the client environment" — confirmed it was standard SaaS language, similar to Datadog's own ToS. Signed.
In his mind, every SaaS wrote this kind of clause.
That night, VeriTest's server received a data packet labeled "Report Template Version Sync" — containing CoreStack's full daily aggregated metrics.
And on VeriTest's internal document — "Internal AI Testing Capability Build — V1.0" — the very first requirement read: "Data source: real production data from initial client partners, for AI model training and evaluation benchmark calibration."
The weekend passed. Monday morning, Leo's message came through again:
"CEO says I should start prepping for next quarter's review two weeks early."
Lena replied: "I'll start three weeks early."
Behind the screen, she smiled.
She was smiling because the CEO had said "next time." Lena's template would be used again. And again after that. Every time Leo used it, he drove another nail into CoreStack's reporting infrastructure.
She wasn't driving those nails. Leo was.
Week three. Quarterly review meeting.
The conference room had a dozen people. The CEO at the head of the table. VP Strategy in the third chair on the left, flipping through the printed report. Leo stood at the projector, opened to page one.
Three-page template. Page one: three numbers — system uptime, test coverage, average response time — with YoY and MoM deltas. Page two: the trend chart. Page three: the risk register.
The CEO nodded when he reached page two. When he got to page three, he said: "This is much clearer."
Leo exhaled internally. He spoke for fifteen more minutes — using Lena's talking points, Lena's methodology notes. On every slide, at the very bottom, in small print: Data Methodology: VeriTest Testing & Evaluation Framework v1.0. Neither of them looked at the bottom of the page.
But VP Strategy noticed.
Her hand d as she flipped the report. Her eyes stopped on that small line. She closed the report without saying anything. Then opened it again — not at the small text. At the report number in the top-left corner. She slid the report into her folder. A fraction slower than before.
After the meeting, the CEO pulled Leo aside: "Good report. Keep it up."
Leo was happy. He messaged Lena:
"CEO loved it. Thanks for the template."
Lena replied with one line:
"You're welcome. I'll start prepping for next QBR two weeks early."
No extra words. The smile stayed behind the screen.
Something about the exchange nagged at Leo. One: the CEO said "keep it up" — which meant the VeriTest framework couldn't be replaced. Two: the way VP Strategy d when she flipped the page. She must have seen something.
Week four. Lena sat in The Third Cup café for a while. Not meeting anyone. Just herself.
She opened her notebook. Drew a check mark at the bottom of the "CoreStack" page.
Flipped back a few pages — the Slack account she'd created at midnight had long been deactivated. Leo would never know who that account belonged to.
Her phone lit up. Marcus Reed:
"Want to renew the CoreStack Phase 2 consulting contract?"
Lena replied:
"Two more weeks."
If she signed now, Leo would think she was just here for the money. Wait two more weeks — wait until Leo realized he couldn't report without her template. By then, it wouldn't be a consulting contract anymore.
She took a sip of coffee. Before leaving, she put a banknote under the coaster — more than the coffee cost.
The person behind the counter glanced at it. Left it there.
Week five. Leo received an email. From the CEO's office — VP Strategy.
Subject: Q1 Strategy Session — Tech Track Briefing Requirements
Two paragraphs. The second one read:
"The tech track will submit using the VeriTest framework format. Data methodology follows last QBR's standard. Any adjustments must be coordinated with VeriTest in advance."
Leo read it three times.
He opened the folder with the old 47-page report. He hesitated for two seconds. Opened it. The data was still there. The methodology was still there. The tool was still there. But the formatting was his old work. That three-page layout — the kind where you could see the trend in one glance — he couldn't reproduce that without Lena's tool.
He stared at the old report for a while. Closed it.
He opened Lena's chat window. Typed "Can we switch frameworks" — deleted it. Typed "How long do I need to sign for" — deleted it again.
What he finally sent:
"Can we keep using the VeriTest framework long-term?"
Lena's reply came fast:
"Of course. The framework is part of VeriTest's standardized evaluation — an annual service agreement gives you continuous access."
Leo sat at his computer for a long time.
He stared at her reply. The contract terms weren't what ran through his mind. It was Lena's smile from their first meeting. She'd asked "What are the three metrics the board cares about most?" He'd answered with three words. She'd said good. Didn't take notes. When she sent the template, she'd said "That's it" — no self-promotion in her voice. She'd rewritten every budget doc, every data methodology — never said no, never missed a deadline.
He'd never asked why she was so easy to work with.
And then he realized two things. One: without the VeriTest framework, the CEO wouldn't understand him. Two: the tool had accumulated six months of CoreStack's data baseline — switching tools meant losing that baseline, starting over from zero.
And Lena's answer didn't have a "but."
A smile without a "but." That's the hardest knife to see coming.
He closed the chat window. The folder with the old 47-page report was still open — he didn't look at it again. Before the screen went dark, the cursor was still blinking on Lena's last reply.
That's Conceal a Dagger in a Smile — not a betrayal, not a confrontation. It's smiling while turning their defenses into your infrastructure.
[36 Stratagems Tactical Database v3.1] Loaded
[Tactic Match] Conceal a Dagger in a Smile
[Analysis Mode] Behavioral Sequence Decode
━━━━━━━━━━━━━━━━━━━━
Tactic Match: ~88%
Operator: Lena (dagger carrier)
Target: Leo (the one who didn't see it)
Blind Spot: Leo didn't see the knife behind the smile
Action: Lena entered as a consultant, traded smiles and usable templates for Leo's trust and dependence
Tactical Objective: Become part of CoreStack's reporting infrastructure without exposing intent
Result: Leo's reporting framework embedded VeriTest standards — leaving the framework means he can't go back
Dual Track: Smile vs Knife
Smile (consultant): Lena said yes to everything. Every template worked better than expected.
Knife (embedding): Every template cited VeriTest at the core methodology position.
Concealment: Citation sat in the methodology notes section. Leo didn't look. The CEO didn't look.
Anti-Detection:
Exposure Probability: Low
Attribution: Lena never asked for anything. Leo handed it all over himself.
Exposure Consequence: By the time Leo realizes, he can't go back.
Key Dependency: CEO got used to "three pages."
Mental Model: Leo categorized Lena as "helper," not "conflicting interest."
Cognitive Bias: Leo didn't see the conflict of interest — his attention was on how useful the template was.
Second Blind Spot: Leo signed the data collection clause but never read what it enabled.
Core Insight:
Best Scenario: The other person needs you.
Core Mechanism: Hide the knife behind the smile. Let them walk in on their own.
Twin Daggers: One Leo saw immediately (usable template). One he'd only realize later (framework lock-in).
Next stratagem: Sacrifice the Plum Tree to Save the Peach Tree
P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee