When the EU Cyber Resilience Act enters full application, manufacturers become legally accountable for the security of every product with digital elements they place on the European market. That accountability only functions if someone outside the manufacturer can actually check the claims being made. Regulators, procurers, and users all confront the same practical difficulty when they try: verifying what a binary really does, what it is composed of, without source access, vendor cooperation, or even the skills to know how to look under the hood.

Achilles emerged directly from that verification gap, as a runtime auditor that observes application behaviour while it happens, rather than trusting documentation about it. It records network endpoints contacted, filesystem and credential access, update mechanisms, and embedded third-party components, then turns those observations into structured, comparable evidence. Four distinct audiences shaped the design from the beginning: manufacturers validating their own conformity claims, market surveillance authorities checking products at scale with limited technical staff, downstream integrators performing supply chain due diligence, and even mere mortals concerned with the safety of their work.

During the talk I will walk through the architecture, examine what runtime evidence can and cannot prove, and explain the tamper-evident transparency log and changelog mining layer. Live audits of real desktop applications will demonstrate how findings map onto CRA essential requirements.