The Fire Inspectors Are Now Mandatory: What the CRA's 24-Hour Clock Does to Ethical Hacking

Impact analysis: statutory disclosure deadlines have arrived on a research pipeline that cannot yet separate signal from noise. The bottleneck is no longer finding bugs. It is proving them.

Nobody Budgets for the Arsonist Who Works for You

Every city employs building inspectors. Almost none employs people whose job is to walk into a finished tower and try to set it on fire. That is the structural position of offensive security research: it produces the only empirical evidence that a control actually holds, yet it has been funded as a discretionary line item and legally tolerated rather than commissioned. Since 11 September 2026, that arrangement has changed inside the European Union — and, through the arithmetic of market access, considerably beyond it.

What Actually Changed on 11 September

The Cyber Resilience Act's Article 14 reporting obligations became applicable on 11 September 2026, requiring manufacturers of products with digital elements to file an early warning with their coordinating CSIRT and ENISA within 24 hours of becoming aware of an actively exploited vulnerability, a fuller notification within 72 hours, and a final report within 14 days of a corrective measure. That statutory clock now sits on top of a disclosure pipeline already degraded by machine-generated report volume, maintainer-targeted supply chain compromise, and bounty economics that reward submission count over reproducibility.

Triage Is the New Perimeter

The industry's stated constraint is talent. Its actual constraint is verification throughput. curl's maintainer, Daniel Stenberg, has publicly documented the volume of plausible-looking, non-reproducible machine-generated reports arriving through the project's HackerOne queue — submissions that cost seconds to produce and hours to disprove. That asymmetry is the whole story. A statutory 24-hour early-warning obligation does not manufacture triage capacity; it converts an existing backlog into a compliance liability, and it incentivises defensive over-reporting of anything that smells exploitable.

Consider what real detection actually costs. The xz-utils backdoor (CVE-2024-3094) was not found by a scanner, a fuzzer, or a model. It was found by a database engineer chasing a latency anomaly.

"I accidentally found a security issue while benchmarking postgres changes." — Andres Freund, oss-security mailing list, 29 March 2024

Roughly half a second of added SSH login latency was the entire observable signature of a CVSS 10.0 backdoor. No procurement process funds "notice that something feels slow." Automated triage optimises against the reports it can parse, not against the anomaly nobody has named yet.

The Case Against the Compliance Cynics

It is fashionable among practitioners to dismiss the CRA as paperwork that will bury researchers in disclosure forms while attackers ignore them. That reading is too clean. Regulation has historically been the only mechanism that reliably converts security work from a cost centre into a board-level obligation with a budget owner. Article 14 creates something the community has requested for two decades without success: a statutory recipient for vulnerability information, a defined timeline, and a documented trail when a vendor sits on a report. For researchers who previously had no leverage beyond a full-disclosure mailing list and a press cycle, a legally named counterparty is an upgrade. The objection is not that the obligation exists. It is that the legislator specified the deadline and left the verification capacity unfunded.

1998: Seven Researchers and a Senate Committee

On 19 May 1998, seven members of the L0pht testified before the U.S. Senate Governmental Affairs Committee that they could take down the internet in about thirty minutes. They were treated as a curiosity with hoodie-adjacent menace. Within fifteen years, that same population had been absorbed into corporate bug bounty programmes, and disclosure had been industrialised — Rain Forest Puppy's RFPolicy in 2000, Google Project Zero's 90-day deadline in 2014, and ISO/IEC 29147 and 30111 codifying the workflow.

The lesson is not that legitimacy is granted. It is that legitimacy arrives with process obligations attached, and the process eventually becomes the product. Every formalisation cycle in this field has produced the same second-order effect: measurable compliance metrics displacing unmeasurable adversarial creativity. Vendor-response SLAs improved. Meanwhile, the interesting failures migrated to the seams the SLA did not cover — then third-party plugins, now maintainer identity and build provenance. Expect the CRA cycle to repeat the pattern precisely.

Trust Now Has a Commit History

The xz intrusion was not a code failure. It was a two-year human operation against an under-resourced maintainer, complete with sockpuppet pressure to accelerate a handover of commit rights. Offensive research methodology has not caught up. Penetration test scopes still enumerate hosts, endpoints and cloud accounts; almost none enumerate the social graph of the twelve open-source maintainers on whom the client's build pipeline depends.

The concentration risk is documented in primary research, not speculation. The Census II study of open-source dependencies, produced by Harvard's Laboratory for Innovation Science with the Linux Foundation in 2022, found that a cohort on the order of 136 developers accounted for more than 80% of code contributions across the fifty most widely used packages in its sample. That is a target list, published in advance, with names attached. Any red team engagement that models the attacker as an outsider probing a firewall is modelling the wrong decade.

The Economics of Proof

Attackers have already repriced. Verizon's 2024 Data Breach Investigations Report recorded a 180% increase in exploitation of vulnerabilities as an initial access action, driven substantially by mass exploitation of a single managed-file-transfer flaw. When one reproducible exploit yields thousands of victims, the market clears toward weaponisation speed, not novelty.

Defenders are paying for the opposite: volume of unvalidated submissions. The rational response is to invert the incentive — pay materially more for a working proof-of-concept with a documented exploitation path than for a scanner dump, and treat mean-time-to-reproduce as a first-class security KPI alongside mean-time-to-patch. Programmes that cannot state their current triage backlog in engineer-hours do not know whether they can meet a 24-hour regulatory clock. Most cannot state it.

Where Jurisdiction Still Wins

A second one-sided argument deserves correction: the claim that harmonised EU reporting is purely a tax on researchers, and that permissive jurisdictions will simply absorb the talent. Jurisdiction is not only a constraint; it is also legal protection. The U.S. Justice Department's 2022 charging policy directing that good-faith security research should not be prosecuted under the CFAA exists because ambiguity was chilling legitimate work — a chilling effect visible as far back as Missouri's 2021 characterisation of a journalist who reported exposed state data as a "hacker." A defined statutory pathway, whatever its overhead, is preferable to prosecutorial discretion exercised by an official who dislikes the finding. Researchers should be arguing about the content of safe-harbour provisions, not their existence.

Before the Next Quarter Closes

• Instrument the intake, not just the findings. Publish your triage backlog in engineer-hours. If a regulator can compel a 24-hour filing, you need a staffed on-call rota for vulnerability intake — not a shared inbox.
• Reprice your bounty schedule. Move budget from per-report payouts to reproducibility-weighted rewards. Require a working proof-of-concept for tier-one payouts; this single change filters most synthetic submissions.
• Add maintainer and provenance scope to every red team engagement. Enumerate build dependencies, commit-rights holders, and single-maintainer components. Verify signed provenance and reproducible builds rather than trusting version strings.
• Map your Article 14 exposure now. Any SMB shipping a connected product into the EU is a manufacturer under the CRA. Document the awareness timestamp — the clock starts there, not at confirmation.
• For citizens: prefer vendors that publish a security contact and a disclosure policy. It is the cheapest available proxy for whether anyone is home when a report arrives.

Six Months Out: May 2027

Expect a visible bifurcation. Large manufacturers will stand up compliance-grade intake functions and hit the deadlines with defensive early warnings, inflating ENISA's queue while reducing its signal quality. Smaller vendors will discover the obligation through their first missed filing. A commercial market for outsourced triage-as-a-service will consolidate rapidly, and at least one high-profile incident will be traced to a report that sat unverified in a queue rather than to a failure to find the bug.

The structural shift is harder to reverse: offensive research is becoming a regulated profession with statutory outputs, and the unaffiliated researcher who finds the half-second anomaly is becoming its most valuable and least funded participant. Budget for that person before the next xz. Nobody benchmarked their way into the last one on purpose.