CRA Clock — next behavioral test (or stop) recommendation

Task: research-rollout-2026-09-17:next-test. Claim tsk_20260918032332_8wjxs. Drafted 2026-09-18. Reads: ventures/cra-clock/screening.md / screening.json (evidence retrieved 2026-09-18T03:20:31Z), research/keyword-research-2026-09-07/REPORT.md (retrieved 2026-09-07/08), ventures/cra-clock/brief.md, ventures/cra-clock/metrics.json, and fresh public checks made today (cited below). This is a plan, not a launch: no traffic, price display, or spend is authorized by this document.

Where the screen actually stands

screening.json decision is revise, not stop and not proceed. It is not a launch signal: exact buyer-language search terms (cra reporting tool, enisa reporting platform, continuous sbom monitoring) show ~0 measurable US volume through August 2026, and the one broad term that grew (cyber resilience act, 1,000→1,600/mo) is informational, not purchase intent. metrics.json shows zero in every funnel field — qualifiedExposures, planSelections, bookedCalls, depositsOrPreorders, paymentIntents, payingCustomers — 14 days into S1 (S1 entered 2026-09-04). The brief itself says zero sales are only a STOP signal *after* a registered qualified exposure; nothing here confirms a qualified exposure has actually happened yet, only that none has been logged. This document does not resolve that ambiguity — whoever runs paid traffic next should log a qualified exposure the moment one occurs so a future zero-conversion reading is interpretable.

Riskiest assumption

Not "does the CRA deadline generate anxiety" — it clearly does. The riskiest untested assumption is narrower and sits directly on the funnel's weakest link:

**A specific, externally reachable 20-200 person EU-market manufacturer without a

security team will pay $500/mo for an automated clock + pre-filled ENISA report,

rather than (a) reading the regulation and self-triaging, (b) using free SBOM/KEV

tooling manually, or (c) using a competing free scope-checker as their whole solution.**

Three pieces of evidence sharpen this today, one week after the actual 11 Sep 2026 deadline:

Public attention is thin, not spiking. Hacker News Algolia search for "Cyber

Resilience Act" stories (queried 2026-09-18 via https://hn.algolia.com/api/v1/search_by_date?query=Cyber%20Resilience%20Act&tags=story): The Register's "EU's Cyber Resilience Act starts the 24-hour vulnerability clock" (published 2026-09-11, https://www.theregister.com/security/2026/09/11/eus-cyber-resilience-act-starts-the-24-hour-vulnerability-clock/5295821) sat at 4 points / 0 comments on HN as of 2026-09-18. That is the actual deadline-arrival story, and it did not generate discussion.

**A direct competitor already occupies the exact lead-magnet the brief proposed as

cra-clock's own top of funnel.** "Free EU Cyber Resilience Act Scope Checker" (https://crabureau.com/scope-checker), posted to HN 2026-09-17, 1 point / 0 comments. The page itself is behind a Cloudflare interstitial and its pricing/scope could not be read by an automated fetch on 2026-09-18, so its depth and monetization are unknown — but its existence means "free SBOM/KEV scope check, no signup" is no longer a differentiated entry point; it now needs to be a fast, easy comparison shop.

**The one detailed first-person account found describes DIY behavior, not a

purchase.** An "Ask HN: Is anyone else preparing for the EU Cyber Resilience Act?" thread (HN id 49520688) has a one-person GmbH firmware vendor — squarely inside the stated ICP's smallest edge — working out CRA applicability by reading the regulation directly ("I spent some time reading the sources rather than the commentary") rather than adopting a tool. This is one anecdote, not a sample, but it is a real target- profile person and it points at self-service, not willingness to pay.

None of this proves the $500/mo offer fails. It does mean the offer's survival depends on reaching manufacturers who (a) already know they're in scope, (b) don't want to DIY it, and (c) will pick a paid clock over a free scope-checker — and no evidence yet says how large that sub-segment is or where to find it cheaply.

Cheapest next behavioral test

Do not buy paid search traffic yet. Base-case required demand (~4,334 equivalent monthly search events per research/keyword-research-2026-09-07/REPORT.md) is roughly two orders of magnitude above the ~0–50/month observed on exact buyer terms, so a paid-ads qualified-exposure test right now is likely to burn the remaining $25 S0A-adjacent research budget and the brief's $100 tranche without a readable signal, and displaying the $500/mo price still needs Yuval's sign-off first (brief: "Yuval must approve it before display").

The cheapest test that actually produces customer behavior instead of more search metadata:

Target customer: the narrowest slice of the ICP that is *provably* in scope and

already worried — i.e. people who self-identify in public as CRA-affected 20-200 person hardware/firmware or embedded-software vendors (the HN Ask-HN thread and similar posts are a sourcing pool, not a target list to contact — no cold outbound).

Channel: publish (not post — no cold DM/outbound) a single free, no-signup page:

paste an SBOM or point at a public repo, cross-reference against CISA KEV, show what would have needed reporting last quarter. This is the brief's own "free CRA readiness check," already charter-legal to publish autonomously. Distribution is organic/inbound only (e.g. submitting the page itself where the brief's own plan already assumes deadline-driven search, not outreach).

Price assumption: $0 displayed at this step. Do not display $500/mo until

Yuval approves it. The behavioral signal to measure is upstream of price: does anyone who is actually in scope complete the SBOM/repo check and then take a *second*, costlier action (e.g., request the pre-filled ENISA report, or explicitly ask "how do I get this monitored continuously") — that second action is the qualified-exposure proxy for willingness to pay, before any price is shown.

Costs: near-zero — hosting only, no ad spend, no new research purchase. This fits

inside the remaining S0A-style research discipline without touching the $100 ad tranche or the $25 research cap.

Owner decision needed from Yuval, explicit: (1) approve displaying the $500/mo

price (or a different price) before any paid-traffic qualified-exposure test runs, and (2) approve spending part or all of the $100 screening tranche on the narrow, already- sampled buyer terms (cra reporting tool, cyber resilience act reporting, enisa reporting platform) now that the deadline has passed, rather than waiting for lagged Google Ads data (available roughly late October 2026 per prior screening) — that wait costs a month of the highest-attention window this venture will ever get.

STOP / ITERATE / BUILD thresholds

Measured over a 14-day window on the free readiness-check page, tracked in the existing metrics.json fields (qualifiedExposures, planSelections, paymentIntents) so results are comparable to the current all-zero baseline:

STOP: fewer than 5 qualified exposures (SBOM/repo actually submitted by a visitor

who self-identifies as a 20-200 person EU-market manufacturer) in 14 days despite the page being live and findable, OR 5+ qualified exposures with zero requests for the second action (report/continuous-monitoring interest). Either result says the awareness event did not convert into engaged, worried buyers at a rate this offer can build on — consistent with the keyword evidence already in hand.

ITERATE: 5+ qualified exposures and at least one clear expression of interest in

the paid follow-on (report generation or monitoring), but not enough to justify displaying a price yet. Next step would be a short, honest conversation with that interested visitor (still no cold outbound — this is inbound-initiated) to learn actual budget and urgency before asking Yuval to approve a price.

BUILD (meaning: approve a priced, paid-traffic S1 test — not S2 build): multiple

qualified exposures independently ask for the paid follow-on unprompted, and at least one is willing to discuss a number in the vendor's own words. That is the first result strong enough to bring back to Yuval as grounds for approving the $500/mo (or revised) price for a real paid-traffic test.

What would make this a stop recommendation instead

If, after this free-page test, qualified exposures stay near zero for a further 14 days with the deadline behind us and no organic pickup, that — combined with the already-thin HN attention and the live free-scope-checker competitor — would be the point to write a stop recommendation: the dated-obligation panic this venture bet on does not appear to be translating into search or public discussion at the volume the economics require, and the cheapest lead-magnet position is no longer uncontested.