PatchClock Rule: Adopt Only When a Client Ships PHP Into the EU and Has No Security Owner
Should our agency add PatchClock to a client engagement, and at which plan, given the client's product count, team size, and exposure to EU Cyber Resilience Act deadlines? Scope PatchClock to clients with EU-market PHP or npm products and no security owner, price it as a compliance retainer, and start each engagement on the smallest plan that covers their product count.
By InnovaAI ResearchPublished
“Should our agency add PatchClock to a client engagement, and at which plan, given the client's product count, team size, and exposure to EU Cyber Resilience Act deadlines?”
Scope PatchClock to clients with EU-market PHP or npm products and no security owner, price it as a compliance retainer, and start each engagement on the smallest plan that covers their product count.
Agencies buy the Agency plan up front for a single client, or pitch PatchClock to US-only and non-software clients where the CRA deadlines never apply, then carry an unused 20-product allowance and a retainer the client cannot justify.
PatchClock does a narrow job that general GRC platforms do not: it regenerates CycloneDX SBOMs from Composer and npm lock files on every tagged release, alerts on CVEs against locked versions, and drafts Article 14 reports against the 24-hour, 72-hour, and 14-day clocks. The Agency plan at 79 € per month covering 20 products and 15 team members makes a resold compliance retainer viable across 3-5 mid-market clients per seat, while Solo at 19 € per month (15.83 € annual) and the founding member offer at 15.83 € per month for 3 products and 5 people keep single-product engagements cheap to open. The verdict is explicit that this fits agencies whose clients face active CRA pressure, not US-only or non-software verticals.
- •The client ships PHP or npm software into the EU market and has at least one tagged release cadence that produces composer.lock or package-lock.json files
- •The client has no internal security engineer, so CVE triage and Article 14 incident drafting would otherwise land on agency delivery staff
- •The client portfolio fits inside the Agency plan at 79 € per month for 20 products and 15 team members, meaning 3-5 mid-market clients per seat
- •The client needs a public support period page and security.txt on their own domain, not just an internal compliance dashboard
- •A single-product vendor can start on Solo at 19 € per month (15.83 € annual) with 2 team members before committing to a retainer
More on PatchClock
- StrategyWhy PatchClock Turns CRA Deadlines Into Agency Retainer Revenue
- ConceptPatchClock Retainer Ladder
- Decision FrameworkPatchClock: Buy vs Skip (PHP Vendors Shipping Into the EU)
- Failure PatternThe PatchClock SBOM Theater Trap: Agencies Publishing CycloneDX Files Nobody Reads
- Implementation BlueprintPatchClock CRA Compliance Retainer Build (7-10 days)
- Operating ProcedurePatchClock Client Release Onboarding (Delivery)