Private beta for UK and Irish makers, from January 2027
When an exploit drops, the CRA gives you 24 hours.
Since 11 September 2026, makers of connected products sold in the EU must warn ENISA within 24 hours of learning that a vulnerability in their product is being actively exploited. Wardhour watches every component you ship, hour by hour, and hands you the warning already drafted.
Free for 3 months for the first 10 makers.
left to send the early warning
An example incident
- 0:00 Our alert reaches you. Your 24 hours start.
- 1:30 The early-warning draft is ready for you to check.
- 24:00 The last moment to submit it to ENISA.
A watch on every component, every hour
Most of what you ship is other people’s code: open-source libraries, vendor SDKs, the components inside your firmware. Any one of them can land on an exploited list on a Sunday night, and on a small team nobody is paid to read advisories.
Wardhour checks the components of every product you sell, every hour, and writes each check in a log you can show to anyone who asks.
Watch log
| Time | Entry | State |
|---|---|---|
| 07:00 | Hourly check of every component in every product. | All quiet |
| 08:00 | Hourly check: an open-source XML parser, version 2.5.0, is now listed as actively exploited. It ships in Hub Mini and Gateway G2. | Exploited |
| 08:02 | Alert sent to your team by email and text message. Your 24 hours start. | Clock started |
| 09:32 | Early-warning draft ready, with the affected products and the vendor’s fix status filled in. | Draft ready |
| 10:40 | You submit the early warning on ENISA’s Single Reporting Platform. The 72-hour notification is next. | Submitted |
Four steps, three of them ours
- You
Send your component lists
A software bill of materials for each product, or the package manifests and firmware build lists we can turn into one. We never need your source code.
- Us
We check them every hour
Against the EU Vulnerability Database and the known-exploited lists, around the clock, weekends included.
- Us
You get one clear alert
Which component, which products, how serious it is and how long you have, in plain language, by email and text message.
- Us
We draft the reports
The 24-hour early warning, the 72-hour notification and the notice to your users, ready for you to check and submit.
Next on the list: the CRA technical file you’ll need for the CE mark by December 2027.
The CRA is already running
- 10 Dec 2024
The CRA enters into force
Regulation (EU) 2024/2847, with a three-year run-in.
- 11 Sep 2026
Reporting starts
Actively exploited vulnerabilities and severe incidents go to ENISA, including for products already on sale.
- Today
49 days into reporting, 407 days until the full CRA.
- 11 Dec 2027
The full CRA applies
Products need the essential requirements and a technical file to carry the CE mark.
Once you know about an actively exploited vulnerability, three reports follow
24hours
Early warning
That the vulnerability exists, is being exploited, and where your product is sold.
72hours
Notification
What is affected, how serious it is, and what you and your users can do about it.
14days
Final report
At the latest 14 days after a fix or mitigation is available.
All three go through ENISA’s Single Reporting Platform, to your national CSIRT and ENISA at once. Fines for breaching the CRA’s essential requirements reach €15 million or 2.5% of worldwide turnover (Regulation (EU) 2024/2847, Article 64).
Built for makers without a security team
Wardhour is for companies of roughly 10 to 250 people that build connected devices, embedded systems or commercially sold software, and sell into the EU. If you already run a security team with its own tooling, you probably don’t need us.
Connected devices
Smart home hubs, trackers, wearables and connected appliances.
Embedded equipment
Controllers, gateways, industrial sensors and anything else with firmware.
Commercial software
Desktop and mobile apps you sell, with or without hardware.
Join the beta
We’re looking for 10 makers to use Wardhour from January 2027 and tell us what’s missing.
- Cost
- Free for 3 months. After that, beta makers pay half price for their first year. Plans will start at £129 a month (€149 in the EU).
- What we ask
- A component list for each product, and a short call once a month to hear what’s working.
- Your data
- Component lists only, never source code. We sign a confidentiality agreement before anything is shared.
Questions
Does the CRA apply to us?
If you sell a product with software in it, or software itself, on the EU market, it very likely does. That includes UK and Irish makers selling into the EU. Pure SaaS, non-commercial open source, medical devices and cars mostly sit outside it.
Do you submit the report for us?
No. The law puts the duty on the manufacturer, so you submit through ENISA’s Single Reporting Platform. We prepare the drafts so that takes minutes, not a scramble.
Do you need our source code?
No. We work from a list of the components in each product: a software bill of materials, or the manifests and build lists we can turn into one.
Is Wardhour live yet?
Not yet. It’s in private beta with a small group of makers from January 2027.
What will it cost?
Free for 3 months during the beta. After that, plans start at £129 a month (€149 in the EU), and beta makers pay half price for their first year.
Where is Wardhour based?
We are based in Istanbul, Türkiye, and built for UK and EU makers and EU rules.
How did you get my email address?
From your company’s listing in a public trade-show exhibitor list or business directory. If you’d rather not hear from us, reply "no thanks" or email hello@wardhour.com and we’ll remove you straight away.