Keyword demand and economics screen

7 September 2026 (Los Angeles); API retrievals are dated 8 September in UTC.

Decision

Revise both offers before buying traffic. CRA Clock deserves the next focused research pass; neither venture has earned a proceed decision yet.

This first pass cost $0.72 of the authorized $10. Eight paid requests returned 207 seed-keyword/market rows (69 seed terms in three countries) and 50 discovery rows. All responses are cached. A repeated live-command request was served from the saved cache with no additional charge. $9.28 remains unspent; there is no need to consume the allowance to finish this report.

• CRA Clock: there is measurable, growing interest in the Cyber Resilience Act and a larger adjacent SBOM category. That does not establish demand for a $500/month reporting-clock service. The exact reporting and monitoring terms are small or unavailable, and generic SBOM functionality faces capable alternatives.
• Accessibility Drift: there is measurable demand for accessibility and procurement documentation. The proposed PR-drift/history tool is not clearly what those searchers want. Audit and VPAT-service searches should not be counted as demand for an automated evidence dashboard.
• Economics: plausible retention and service-cost assumptions can make individual customers profitable, but the sampled commercial terms do not yet provide a convincing customer-acquisition path to a meaningful annual contribution. We need evidence about the reachable buyer population and channel conversion, not a larger headline TAM.

What we measured

Google Search, English language, in the US, UK and Germany. US and UK companies can sell into the EU, but their presence in these search results does not prove they are in scope for either offer. German-language searches and the other EU countries were not measured. No Instagram or TikTok data was purchased; these are B2B hypotheses for which search was the first channel to examine.

The volume calls requested September 2024 through August 2026. Returned nonempty monthly histories end in July 2026, generally 23 months. August and the September reporting deadline are not observed. The table uses the provider's approximate monthly-average search_volume field; it is not a count of unique buyers or this month's traffic.

Null means unavailable, not zero. Zero is preserved as a separate value in the saved observations. CPC is an advertiser-cost estimate in USD, not our measured cost per click or cost per customer. Bid percentiles and CPC are different statistics.

Demand quality and durability

CRA Clock

The head term cyber resilience act reports 1,300 searches/month in the US, 1,300 in the UK and 6,600 in Germany under English targeting. These are information/awareness searches, not 9,200 qualified prospects. For the US, comparable September-July windows averaged 846 searches/month in 2024-25 and 1,169 in 2025-26, up about 38%. That is evidence of growing topic interest before the deadline, not proof that it persists after the deadline.

The European Commission says reporting obligations start on 11 September 2026 and main obligations on 11 December 2027. This supports a multi-year compliance context; the claim that the reporting duty was already live in an older brief was incorrect. Individual product scope and manufacturer awareness still require domain validation. Reporting obligations, implementation guidance.

SBOM software has 170/40/110 monthly searches across the three sampled markets, while SBOM monitoring has 10 in each. Discovery added US phrases such as sbom management tool (50/month) and sbom management software (20/month). However, OWASP Dependency-Track already provides continuous SBOM analysis and vulnerability-related workflows. The differentiation must be the reporting/response job, not merely monitoring a bill of materials. Dependency-Track.

Durability hypothesis: maintaining shipping products could create repeated work; a one-off deadline-readiness purchase might not. Verify who owns the workflow, how often a reportable event occurs, what they do today, and whether they would pay monthly between events. Do not infer a recurring subscription from a recurring legal obligation.

Accessibility Drift

Accessibility monitoring reports 170/20/10 monthly searches; accessibility questionnaire only 10 in each. Accessibility regression testing, accessibility github action and continuous accessibility testing returned no volume data in all three markets. That is a weak direct-search signal, not proof those workflows have no users.

The US VPAT head term is much larger (5,400/month), but includes templates, explanations, vendor documents and services. Discovery included vpat assessment (30/month) and vpat audit (70/month). These could indicate a need for expert procurement evidence rather than a PR trend report. Deque markets site-wide monitoring/reporting and expert audit/VPAT support, so the competitive gap is unproven. W3C says human evaluation is needed to determine accessibility conformance; automated checking alone cannot do that. Deque Axe Monitor, W3C evaluation guidance.

Durability hypothesis: ongoing product changes and repeat procurement requests could support retention. A buyer who only needs one VPAT by Friday might leave after delivery. We must test whether they need ongoing evidence tracking and whether it replaces enough work to justify a subscription.

Data quality checks

• Google can group close keyword variants. The ideas call returned cyber resilience act and cyberresilience act with identical 1,300 US volume and $10.38 CPC. They are not two independent demand pools. Accessibility testing automation and automated accessibility testing also share metrics. We did not add variants or discovery rows into TAM.
• Keyword suggestions are noisy: accessibility seeds produced unrelated database access management and privileged-session terms. These were excluded from opportunity conclusions. Acronym-only CRA queries can refer to other meanings and need SERP/buyer-intent validation before use.
• US vpat services returned 720/month and $470.53 CPC, alongside low/high top-of-page bid estimates of $7.26/$89.55. Its comparable historical averages jump from 35 to 766/month. Treat this as an anomaly requiring confirmation, not a dependable forecast. This run did not independently verify it through Google Ads or observed ads.
• Provider estimates are rounded, may be grouped, and can lag. Complete raw histories, nulls, targeting and provenance remain available for review. The API documentation explains combined volumes and unavailable data. Metric definitions.

Economic sensitivity model

These are illustrative assumptions, not estimates of total market size or measured customer economics. Proposed prices come from the venture briefs ($500/month CRA; $350/month accessibility); they have not been validated here. We use a single representative commercial phrase for each idea across three countries: sbom software = 320 monthly searches; accessibility monitoring = 200. This avoids adding close variants, but excludes other keywords and channels, and repeated searches can still be from the same person.

The modeled annual acquisition funnel is:

annual search events x relevant-buyer fraction x ad impression share x click-through rate x click-to-paying-customer conversion.

We assume conservative/base/optimistic values of 25%/50%/75% relevance, 10%/25%/50% impression share, 3%/5%/8% CTR and 0.5%/2%/5% paid conversion. Conversion is incremental new customers per click, so repeat visits must reduce it. These fractions are not observed. CPC is $40/$25/$15, with $200/$100/$50 acquisition labor per new customer. Base CPC is a scenario choice informed by the sampled SBOM and monitoring estimates; it is not an API-computed average.

Monthly service costs are CRA $180/$100/$50 and accessibility $150/$75/$35, including assumed hosting, tooling and human service/support. Expected paid lifetimes are CRA 12/24/36 months and accessibility 6/18/30 months. No retention measurement exists. Stress the human-service cost before pursuing expert-heavy offers.

Fractional customer counts are expected values, not a forecast that a fraction of a person purchases. Year one assumes those new customers start at midyear, pay for six months and incur acquisition costs that year; fixed overhead and tax are excluded. Lifetime contribution is kept separate from annual revenue and ARR. See analysis.json for every input and calculation.

As a concrete CAC sensitivity, the US sbom software CPC of $30.63 implies $1,531.50 advertising CAC at a hypothetical 2% paid conversion; accessibility monitoring at $26.81 implies $1,340.50. Add acquisition labor to both. Conversion of 0.5% would quadruple those advertising CAC estimates.

How many customers would make this worthwhile?

Use $50,000 annual contribution per venture as an explicit comparison benchmark, not a newly approved business target. At base assumptions, a mature business needs about 13 active CRA customers or 21 active accessibility customers to reach it after replacement acquisition costs. This uses annual contribution per active customer = 12 x monthly contribution - (12 / lifetime months) x CAC, with steady replacement and no growth. It excludes fixed overhead.

At the same base funnel, that requires approximately 4,334 monthly search events for CRA or 9,334 for accessibility of equivalent assumed quality, compared with the sampled anchor's 320 and 200. These are required-demand calculations, not claims that such demand exists. Broad informational searches cannot simply be substituted at the same conversion rate.

TAM and reachable market share remain unknown. Search data cannot tell us how many distinct qualified manufacturers or SaaS procurement buyers exist. The next screen must enumerate a credible initial buyer population and compare the required active customers against it on a matching period/basis. Other channels, localized queries or a different offer could change the result.

Next steps

• CRA first: revise and investigate the reporting workflow. Examine actual search results for full Cyber Resilience Act terms and the SBOM-management terms discovered here; exclude acronym ambiguity. Identify the responsible buyer, existing reporting tools and recurring workload. Verify product scope and required human involvement before estimating service cost.
• Accessibility: resolve the offer/trigger mismatch. Obtain examples of procurement evidence buyers accept and determine whether ongoing drift tracking is useful after the initial request. Do not sell automated scans as conformance certification or assume that VPAT-service demand transfers to a dashboard.
• Complete the reachable-market and retention assumptions before ads. A small set of identifiable likely buyers, evidence of current spending and a credible repeat-use mechanism would be more valuable now than hundreds more keyword variants. The next behavioral experiment should test the selected offer at an approved price; no campaign was launched or funded by this research authorization.

Both screening recommendations remain REVISE. No venture stages or measured customer metrics were changed. The API integration is working locally; that is separate from deployment to the VPS.

Cost and evidence index

Four calls per venture, $0.36 each, recorded as SaaS research spend in the existing ledger. No ad spend. Every call cost the provider-reported $0.09; cached replay cost $0.00. Pricing was checked against DataForSEO's published live rate.

The requests directory contains exact input files. request-manifest.json indexes receipts; observations.json retains all results including duplicates and nulls; analysis.json contains the report calculations. Run node research/keyword-research-2026-09-07/analyze.mjs to regenerate this report offline without API calls.