In the opening of Episode 11 of CIA, a man with a wary expression makes his way down the street. He arrives at the designated meeting spot with Amir, but the latter is nowhere to be found. He heads to his place, only to find him dead. He quickly leaves, calling his wife and telling her that he is going dark because the Forbidden Eye has taken out Amir. After the call, he throws away his phone.
Meanwhile, Colin shows Bill his investigation board and explains that Sara is just a means of access to Pyramid. He needed her to get close enough to use the spyware that Kinski gave him. He believes Sarah is clean and has no idea about the dark-side business Pyramid is up to. He also believes that Toni found out about Pyramid's dark business and was killed for it. Now, they just need to find out who ordered the hit. Bill offers to take the USB to Ian at the FBI.
Later, Colin spends the night with a stressed Sarah, who just got suspended because someone used her key card to break into the company. Apparently, the thief stole an expensive bottle of scotch from the boss's office. Colin assures her everything will blow over. However, we all know he is the mysterious man who broke into Pyramid.
The following morning, he gets a call from Sandy's wife, who is worried about him. She doesn't know that her husband and Colin are spies. She says that Sandy has been restless, paranoid, and worried since retiring from the State Department.
Colin brings the case to Nikki, who believes Sandy might be suffering from old age and will show up soon. We learn that Sandy was the one who recruited Colin. Bill convinces Nikki to let them look into the case.
They start by tracing Sandy's phone, which leads them to Amir's place. They find the place freshly cleaned, which raises their suspicions. Following Sandy's old lesson, Colin tries to track him down using traditional spycraft techniques.
This leads them to the old school library, where they follow the clues Sandy left behind. It turns out that one of Sandy's latest trainees, Nora, got there first. She agrees to talk to them after Colin introduces himself. According to her, Sandy was working on an operation to find out who had been targeting his old Libyan assets. She refuses to believe that Sandy is retired. They also refuse to bring her into the CIA to help them track Sandy.
She agrees to give them Sandy's journal. Apparently, Sandy only wrote the word 'Forbidden Eye' in Arabic; the rest is in code. Nikki asks Kevin to check what that means, and he reports that it could be an alias for an emerging threat in Libya. However, they realize that even without concrete evidence, they can't tell how whoever killed the old Libyan assets found out about them.
Colin and Bill make their way back to the office, their mission to decipher the code and unravel the mystery surrounding Sandy's disappearance. Nikki's uncertainty about Sandy's safety and her disapproval of his recruitment of retired assets like Nora create tension between her and Colin. Colin, sensing there's more to Nikki's hesitation, confronts her, reminding her of the perils of paranoia that often lead to the downfall of old agents.
The duo visits Sandy's wife, Anne, once again to search for any clue her husband might have left behind. Bill suggests telling her the truth, but Colin reminds him that it's not their place to do so. Anne believes her husband has been working for the State Department for fifty years. They find a key in the baking powder and ask Zeebto to identify it. He tells them it's an Abloy made by a Finnish lockmaker. After checking Sandy's financials, Zeebto sends them to another listed address in his records, where they find Nora, barely clinging to life. They spot a man who escapes through the window, but Bill manages to shoot him, forcing him to flee with a shoulder wound. Unfortunately, Nora doesn't survive.
Despite this setback, Nikki and Colin refuse to let Counter Terror help. Zeebto manages to uncover how Nora and Sandy communicated on an app called Channel Vault. Nikki shares this information with Bill, who is surprised but quickly recovers. They wonder if someone else used the back door to Ayn al-Haram to take down Sandy and his team. They use the back door to track Sandy's location and discover he's hiding in a cabin in the woods. It turns out he found the man who killed Nora and gave him LSD. They agree to give the man time before questioning him. Bill sends a picture of the man to the team, and they discover he's Omar, a member of the Libyan army. Colin shares the list of his other assets, and the CIA rushes to keep them safe.
Meanwhile, Colin informs Sandy of Nora's death, expressing his remorse for getting her involved in this mess. He feels that he lost his discipline, which led to the death of his old assets. Once the man comes to his senses, he reveals that he's not Ayn al-Haram but that the word has a double meaning - it can also mean 'eye of the pyramid.' They realize they're all searching for the same mole in Pyramid.
Sandy's heart beats fast as he longs to continue his role in the investigation. However, Colin turns down his request, sending him home with the advice to tell Anne the truth. Sandy, filled with gratitude, leaves, reminding them of the high stakes involved in their mission.
Bill contacts Ian to inquire about the progress with the Pyramid files. Ian explains that the files are compartmentalized, and he hasn't determined who accessed which one yet. He identifies Nikki, Zeeb, and Kevin as suspects. Colin suggests they eliminate Nikki from the list, but Ian and Bill disagree.
Bill proposes a plan: they'll tell the three suspects that they have a source who will drop the identity of the mole at a specific time and place. They'll use a sting operation with three differently colored strollers to see which one is intercepted. Meanwhile, Ian tracks their phones.
The suspects become uneasy, but Ian texts that Kevin is heading towards Forest Hill. Colin realizes he's going to Sarah's place and rushes there to find Kevin holding Sarah at gunpoint. It turns out Kevin was onto them and wanted their help to leave the country. Sarah is shocked to discover Colin's true identity.
As Colin tries to distract Kevin, a fight ensues. Bill arrives just as Colin stabs Kevin. He stays behind to give Kevin first aid while Colin checks on Sarah. She's angry and confused, asking who he really is. He tells her the truth, and she figures everything out. She claims he only used her, and he admits it, clarifying that he never fell in love with her.
Later at the office, Nikki says Kevin will pull through, and they hope to find out who he was working with. Colin apologizes to Nikki for investigating her, and she understands his decision. They receive a call that Kevin is awake and rush to the hospital. They get there to find him asleep again—apparently, a doctor gave him something to help him sleep.
As they rush to secure the CCTV footage, Kevin passes away. Colin is shocked to see Toni impersonating a doctor to get into Kevin's room.
