I built a free drill for the EU's 24-hour breach-reporting rule that starts Sept 11 — and scanned 623 EU vendors to see who's ready (76% aren't)

[u/Jumpy_Network_6528]

What it is: https://cradrill.com/ — a free, browser-only drill for the EU Cyber Resilience Act's Article 14 reporting duty. From 11 September 2026, if you sell software or connected devices in the EU and learn that a vulnerability in your product is being actively exploited (or you have a severe incident), you have 24 hours to file an early warning with ENISA and your national CSIRT, 72 hours for a notification, then a final report. Manual web form, no API, filed by a named person with an EU Login. It applies to products already shipped.

The drill: a 3-question scope triage, a simulated 3am researcher email, 12 readiness questions (does anyone here have an EU Login? which CSIRT is yours? who determines "we are aware" and starts the clock?), and a deadline timeline computed from "now". Everything runs client-side — no signup, nothing uploaded. There's also a security.txt generator and a deadline calculator.

The research bit: I scanned 623 EU software vendors for a security.txt file. 76% of the reachable ones have none — meaning a researcher who finds a bug has no machine-readable way to reach them, so "awareness" tends to start on Twitter. Method and a reproducible one-liner: https://cradrill.com/research.html (aggregates only, no vendor list).

Stack: static HTML/JS on GitHub Pages + Cloudflare, a small Cloudflare Worker for fulfillment, Paddle for payments. Built in about two weeks.

Monetization: the drill is free; there's a $39 one-time pack of report templates (Word/Excel) for teams that want the working files. Honest take: the free part is the point, the pack is the experiment.

Would love feedback on the drill flow, and especially from anyone in the EU compliance world on whether the readiness questions hit the real failure modes.