Why record when we became aware? Isn't it safer not to know?

Q: Why record when we became aware? Isn't it safer not to know?

No: not recording it doesn't make you safer, it makes you undefended. Whoever told you about the vulnerability or incident almost always has their own timestamped record of when, so your awareness is rarely a secret only you hold, and deniability only works if every single person who saw it stays quiet forever. The penalty for not reporting is far larger than the cost of reporting, and without your own record you can't prove you were on time either, so a regulator investigating later has to assume the worst date against you.

When Grype, Trivy or Dependency-Track turns up something in your product that's actually being exploited, craclock works out whether you have to report it, prepares the report, and keeps the proof of when you knew and what you filed. You submit it yourself: a filing is a legal statement by you, not by a tool, so craclock hands you the finished text instead of sending it for you.

Say it plainly

A company that has genuinely decided to stay silent, and can keep everyone who knows quiet indefinitely, does not need this product. craclock is for the company that has already decided to comply and wants that to be cheap and provable, not for the company still deciding whether to comply at all.

Awareness is rarely a secret you control alone

The vulnerability or incident that starts your clock almost never originates with you. A researcher emails you, a customer opens a ticket, a scanner in your own CI flags it, a threat-intel report names your product. Every one of those has its own timestamp, on a system you don’t control: the researcher’s disclosure platform, the customer’s support system, your own CI logs, the intel vendor’s report date. Not writing your own awareness date down doesn’t erase theirs. It just means the timeline a regulator eventually reconstructs is built entirely from evidence you didn’t choose, with your own account missing from it.

Deniability requires everyone to stay quiet, forever

For “we never officially knew” to hold up, every person who saw the report, every engineer in the Slack thread, every support agent who read the ticket, has to stay silent about it permanently, including if they leave the company, get laid off, or are deposed in an unrelated lawsuit. That is a lot of people to trust with a decision that carries fines up to €15 million or 2.5% of global turnover if it unravels. A written record, by contrast, is a decision made once, by one person, on purpose.

The comparison that actually matters

Article 64(2) of Regulation (EU) 2024/2847 sets administrative fines of up to EUR 15,000,000, or 2.5% of an undertaking’s total worldwide annual turnover for the preceding financial year, whichever is higher, for non-compliance with the obligations in Articles 13 and 14, the same articles that require reporting an actively exploited vulnerability or severe incident. The cost of filing is: recording a timestamp, and pasting prepared text into a form. Weighed against each other, the asymmetry is not close.

Unsettled: microenterprises and small enterprises are exempt from this specific fine only for missing the 24-hour early warning deadline. Missing the 72-hour notification, the final report, or not reporting at all isn’t covered; the exemption is narrow.

Not having a record doesn’t protect you either

If you’re ever asked when you knew, and you have no record, you are not left in a neutral position. You are left arguing your own memory against whatever timestamped evidence the other side has: the researcher’s disclosure date, the customer’s ticket, the scanner’s log. A regulator reconstructing the timeline has no reason to give you the benefit of the doubt on a date that determines whether you filed on time, and every reason to use the earliest date the evidence supports. Recording awareness the moment it happens is the only way the date on record is the one you’d actually choose.