A few months after Thomas and I started Old River Wolf Security, we had plenty of experience, a clear idea of the work we wanted to do, and exactly zero completed client engagements.
Around that time, I started attending Kyle Parish’s Tri-Cities Cybersecurity Meetup again. It is a good mix of developers, security practitioners, business owners, students, and technology people who genuinely enjoy talking shop. That is where I met Steven Ayers from Sovereign Stack.
After our first conversation, Steven and I continued it over tacos at White Duck in Johnson City. White Duck is attached to Yee Haw Brewing, which means the title is technically accurate and not just me trying to be clever.
Over tacos we talked about web applications, cybersecurity, startups, AI, water utilities, business, family, and whatever else wandered into the conversation. Neither of us followed a plan because there was not one. Founders tend to do that.
Somewhere along the way, Steven described a system he was helping develop for SARE, the Sustainable Agriculture Research and Education program administered through the University of Maryland. As I learned more, the importance of what it supported became clearer.
Neither of us needed a spreadsheet to recognize that the environment mattered. When a system sits in the middle of important work, taking a closer look is not paranoia. It is responsibility.
A few conversations later, Steven asked whether ORWSec would perform a Web Exposure Assessment.
What impressed me was not that he wanted a review. It was when he wanted it. The system was still being developed. Most reviews happen after deployment, after somebody has committed to a direction, and after dependencies and assumptions have started piling up.
Steven wanted another set of eyes while the information could still influence decisions.
At some point during the engagement, I found myself thinking about beavers.
Beaver dams start with beavers swimming in your waters. Running off a beaver that just showed up in your patch of river is a lot easier than clearing a dam once it has been built.
That is not really a story about beavers. It is a story about timing. A beaver is not necessarily a problem. A beaver dam can be.
Web applications are not much different. Features get added. Assumptions get made. Systems connect to other systems. Then somebody discovers a concern and realizes a whole pile of decisions has already been built on top of it.
Steven’s decision was straightforward: get another perspective while options still existed.
ORWSec performed a focused Web Exposure Assessment of the staging environment. We stayed within scope, documented our observations, reviewed everything in person, and delivered the report, supporting evidence, and raw session data.
The findings remain confidential because that is where they belong. The important part is not what we found. It is that somebody cared enough to look before the system was finished.
When the assessment and procurement process were complete and the report had been delivered, ORWSec had completed its first client engagement.
Every company gets a first client. Ours happened because a developer asked a good question at the right time.
My grandfather, Dr. John Butler, used to say, “I’m after the long dime, not the short nickel.” The older I get, the more I realize he was not talking about money.
The invoice matters. The engagement matters. Doing good work matters. But the long dime is the people, their trust, and the relationships we build.
This story started with a meetup, moved to tacos, turned into an assessment, and ended with ORWSec’s first successful engagement.
That is a pretty good start.