Regulatory compliance SaaS for small software makers selling into the EU: Cyber Resilience Act actively-exploited-vulnerability reporting readiness (24h · Oct 10, 2026
KEVClock
A countdown-and-drafting tool that tells small software makers when a known-exploited vulnerability hits their product, and prepares the EU Cyber Resilience Act report in time.
The problem
Small software vendors must report actively exploited vulnerabilities to ENISA within 24 hours of awareness but have no lightweight way to detect, clock, and draft the reports.
The wedge
A self-serve, per-product-priced tool that accepts any SBOM, runs the CRA deadline clocks, and drafts report text, beside whatever scanner the team already uses.
In the build queue
We haven't built this one yet
The full deep dive, build video, and MVP kickoff prompt land when KEVClock gets built in public.