Hermes Decision Engine Methodology (HDEM): Multi-Objective Remediation Arbitration

Interactive Decision Engine Workbench

Evaluate the 5-dimensional evaluation tensor, simulate prescriptive arbitration across benchmark cases, or generate compliance audit trails:

Real-Time Decision Arbitration Workbench

Select a benchmark case or calibrate the 5 operational dimensions of your infrastructure to instantly generate the prescriptive directive, target SLA, and auditable rationale.

1. Load Benchmark Threat Scenario:

👑 Asset Criticality (C_asset) Tier 0 (Crown Jewels)

🌐 Network Reachability (E_reach) Public Internet

💣 Exploit Weaponization (W_exploit) CISA KEV (In The Wild)

⚡ Patch Disruption Penalty (K_disrupt) Severe Outage

🛡️ Compensatory Control Feasibility (F_fallback) WAF / eBPF Ready

PRESCRIPTIVE OPERATIONAL DIRECTIVE:

🛡️ MITIGATE

⏱️ SLA Cible : < 4 Heures

Secondary Contingency Plan: PATCH (en fenêtre de maintenance)

Prescriptive Urgency Score (PUS): 89 / 100

Cost of Uncontrolled Inaction: CRITIQUE (Compromission d'identité)

💡 Deterministic Decision Rationale:

The asset is Tier 0 (Crown Jewel) and the threat is actively weaponized (CISA KEV). However, immediate patching imposes severe downtime during an operational freeze. Because an immediate compensatory WAF/eBPF filter is available, MITIGATE is prescribed within < 4 hours, safely deferring the vendor PATCH to the scheduled maintenance window.

🛠️ Associated Remediation Playbook:

rmmod ebt_snat || modprobe -r ebt_snat

Formal Taxonomy of the 6 Operational Directives

Hermes repudiates naive 'patch everything immediately' dogma. The 6 directives mathematically govern the trade-off between security, availability, and engineering overhead.

📦 PATCH ⏱️ < 24 Hours (Critical) / < 7 Days (High)

Immediate Vendor Patching

Deploy official vendor security updates, backports, or hotfixes to eliminate underlying vulnerability permanently.

🎯 Trigger Condition: Vendor patch verified stable AND (Exploit in KEV OR Public PoC with reachable attack surface).

⚖️ Operational Tradeoff: Requires service restart or maintenance window; potential regression risk.

⏪ Rollback Risk: Low to Moderate.

🛡️ MITIGATE ⏱️ < 4 Hours

Compensatory Defensive Mitigation

Deploy external perimeter controls (WAF virtual patch, eBPF socket drop, ingress firewall rules, or feature toggle) to block exploitation without touching underlying codebase.

🎯 Trigger Condition: Active zero-day without vendor patch OR high patch disruption during strict operational freeze.

⚖️ Operational Tradeoff: Risk of false positives on non-standard client traffic; maintenance overhead of rule lifecycle.

⏪ Rollback Risk: Very Low (Instantaneous rule disablement).

🔒 ISOLATE ⏱️ < 1 Hour (Urgent)

Perimeter & Network Quarantine

Sever untrusted network access, move asset to isolated quarantine VLAN, drop default routing, or confine execution inside an ephemeral microVM sandbox.

🎯 Trigger Condition: Unauthenticated RCE under active wild exploitation on critical asset where no patch or WAF mitigation exists.

⚖️ Operational Tradeoff: Temporary functional impairment of external integrations or service reachability.

⏪ Rollback Risk: Instantaneous (Route restoration).

🔄 REPLACE ⏱️ < 30 Days

Architectural Deprecation & Replacement

Decommission and replace unmaintained, abandonware, or structurally defective components with hardened modern alternatives.

🎯 Trigger Condition: Component is End-of-Life (EOL), unpatched for > 90 days, or architecturally unsecurable.

⚖️ Operational Tradeoff: Substantial migration engineering effort and regression testing cycles.

⏪ Rollback Risk: High (Multi-system architectural migration).

📋 ACCEPT ⏱️ Quarterly Review Cycle

Formalized Risk Acceptance

Document and formalize conscious business risk acceptance when vulnerability is unreachable, purely theoretical, or remediation cost exceeds maximum potential loss.

🎯 Trigger Condition: HTS < 40 AND Exploitability is Theoretical AND Network Reachability is zero (air-gapped / unexposed).

⚖️ Operational Tradeoff: Zero immediate operational expenditure; residual compliance audit tracking.

⏪ Rollback Risk: Zero.

👁️ MONITOR ⏱️ < 48 Hours

Enhanced Telemetry & Threat Hunting

Deploy targeted SIEM detection rules, Canary tokens, and auditd/Sysmon probes to detect early exploitation attempts without altering production code.

🎯 Trigger Condition: Newly disclosed CVE with high theoretical severity but zero in-the-wild weaponization or weaponized exploit circulating on specialized darknet channels.

⚖️ Operational Tradeoff: SIEM ingestion bandwidth and SOC analyst triage load.

⏪ Rollback Risk: Negligible.

Prescriptive Remediation Playbook Library

Turn-key technical recipes for WAF, Linux kernel, SDN micro-segmentation, and container isolation ready for incident execution.

PLAY-01-EBPF-DROP ⚙️ Linux Kernel XDP / TC

eBPF Sub-Millisecond Kernel Socket Drop

Directive: MITIGATE

Implementation snippet:

SEC("xdp") int xdp_drop_cve(struct xdp_md *ctx) { void *data = (void *)(long)ctx->data; void *data_end = (void *)(long)ctx->data_end; struct ethhdr *eth = data; if ((void *)(eth + 1) > data_end) return XDP_PASS; if (eth->h_proto == bpf_htons(ETH_P_IP)) { struct iphdr *ip = (void *)(eth + 1); if ((void *)(ip + 1) > data_end) return XDP_PASS; if (ip->protocol == IPPROTO_TCP) { struct tcphdr *tcp = (void *)(ip + 1); if ((void *)(tcp + 1) > data_end) return XDP_PASS; if (tcp->dest == bpf_htons(7001)) return XDP_DROP; } } return XDP_PASS; }

✅ Verification command:

bpftool prog show name xdp_drop_cve && bpftool net list

PLAY-02-WAF-VIRTUAL-PATCH ⚙️ Reverse Proxy / WAF

ModSecurity / Coraza Virtual Regex Patch

Directive: MITIGATE

Implementation snippet:

SecRule REQUEST_URI "@rx (?:/api/v1/reset_password|/guest/provision)" "id:100901,phase:2,deny,status:403,log,msg:'Hermes Virtual Patch: Malformed Account Provisioning Replay'"

✅ Verification command:

curl -ik -X POST https://target/api/v1/reset_password -d 'malformed' | grep 403

PLAY-03-VLAN-QUARANTINE ⚙️ Software-Defined Network (SDN) / Calico / Cilium

Automated Micro-Segmentation Quarantine

Directive: ISOLATE

Implementation snippet:

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: emergency-isolate-asset
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: vulnerable-workload
  ingress: []
  egress: []

✅ Verification command:

cilium endpoint list | grep vulnerable-workload

PLAY-04-MODULE-UNLOAD ⚙️ Host OS Modprobe

Vulnerable Kernel Module Dynamic Blacklist

Directive: MITIGATE

Implementation snippet:

rmmod ebt_snat || modprobe -r ebt_snat && echo 'install ebt_snat /bin/true' > /etc/modprobe.d/cve-2026-53266-mitigation.conf

✅ Verification command:

lsmod | grep ebt_snat || echo 'Module successfully unmapped'

PLAY-05-DECOMMISSION-WORKFLOW ⚙️ Infrastructure as Code (Terraform / Helm)

Graceful Sunset & Architecture Replacement

Directive: REPLACE

Implementation snippet:

resource "kubernetes_deployment" "legacy_workload" {
  metadata {
    annotations = {
      "hermes.codex/deprecated" = "true"
      "hermes.codex/sunset-date" = "2026-10-15"
    }
  }
  spec {
    replicas = 0
  }
}

✅ Verification command:

kubectl get deployments -A -l hermes.codex/deprecated=true

PLAY-06-AUDITD-PROBE ⚙️ Linux auditd

High-Fidelity Kernel Syscall Audit Probe

Directive: MONITOR

Implementation snippet:

auditctl -a always,exit -F arch=b64 -S setsockopt -F a2=0x2710 -k cve_2026_ebtables_exploit
auditctl -a always,exit -F arch=b64 -S sendmsg -F a0=3 -k cve_2025_afalg_race

✅ Verification command:

ausearch -k cve_2026_ebtables_exploit --raw

Decision Audit Trail & Regulatory Compliance Justification (NIS2 / DORA)

Regulatory authorities mandate auditable proof when vulnerabilities are mitigated or isolated rather than immediately patched. Generate your verifiable defense declaration.

📜 HERMES DECISION AUDIT MANIFEST

{
  "audit_version": "1.0",
  "engine": "Hermes Decision Engine V3.0",
  "timestamp": "2026-09-18T18:00:00Z",
  "compliance_frameworks": ["NIS2-Art21", "DORA-Art9", "ISO27001-A.12.6.1"],
  "evaluation_context": {
    "threat_id": "CVE-2026-83021",
    "asset_criticality": "TIER_0 (Crown Jewels)",
    "network_reachability": "DMZ_PROXY",
    "exploit_weaponization": "CISA_KEV_WILD",
    "disruption_penalty": "SEVERE_OUTAGE (Operational Freeze)",
    "compensatory_fallback": "IMMEDIATE_WAF (Port 7001 eBPF Filter)"
  },
  "arbitration_result": {
    "primary_directive": "MITIGATE",
    "target_sla": "< 4 Hours",
    "secondary_contingency": "PATCH (Next Scheduled Maintenance Window)",
    "prescriptive_urgency_score": 89,
    "formal_justification": "Compensatory defensive control deployed to prevent active exploitation without incurring catastrophic operational downtime during active freeze window."
  }
}

1. The Core Failure of Classical Vulnerability Prioritization

Traditional vulnerability management relies on monotonic severity ranking: vulnerabilities are sorted by static CVSS base scores, and engineering teams are instructed to patch everything above threshold X within an arbitrary calendar window (e.g. 14 days for Critical, 30 days for High).

In real-world enterprise architectures, this paradigm fails catastrophically for three reasons:

The Availability-Security Paradox: Applying patches to Tier 0 infrastructure (identity providers, core databases, hypervisors) during business peaks introduces substantial operational downtime risks. In many incidents, rushed emergency patches have caused greater monetary losses than the targeted vulnerability.
The Reachability Null Hypothesis: A CVSS 10.0 unauthenticated RCE on a service that is air-gapped or bound to localhost has an effective reachability of zero. Elevating it to P0 emergency status diverts critical engineering bandwidth from weaponized flaws actively hitting perimeter DMZs.
The Zero-Day Blind Spot: When active exploitation precedes vendor patch availability, traditional patch-management frameworks offer zero prescriptive guidance. Security leaders require formal, auditable mandates for temporary mitigation (MITIGATE) or perimeter quarantine (ISOLATE).

graph TD
    Input["Multi-Source Threat Signal (KEV / HTS / EPSS)"] --> Engine["Hermes Decision Arbitration Engine"]

    Engine --> Obj1["Objective 1: Minimize Threat Exposure (Delta E)"]
    Engine --> Obj2["Objective 2: Minimize Disruption Cost (Delta K)"]
    Engine --> Obj3["Objective 3: Maximize Feasibility & SLA Compliance"]

    Obj1 --> Pareto["Pareto Frontier Utility Optimization"]
    Obj2 --> Pareto
    Obj3 --> Pareto

    Pareto --> D_Patch["PATCH (Vendor Update)"]
    Pareto --> D_Mitigate["MITIGATE (Compensatory Rule)"]
    Pareto --> D_Isolate["ISOLATE (Perimeter Quarantine)"]
    Pareto --> D_Replace["REPLACE (Component Sunset)"]
    Pareto --> D_Accept["ACCEPT (Documented Risk)"]
    Pareto --> D_Monitor["MONITOR (Enhanced Telemetry)"]

2. Mathematical Formalism: The Multi-Objective Utility Function

HDEM models the optimal prescriptive directive (D*) as the argument that maximizes the net operational security utility (U(D)):

D* = argmax_D in {PATCH, MITIGATE, ISOLATE, REPLACE, ACCEPT, MONITOR} [ U(D) ]

Where net utility U(D) is defined as:

U(D) = Delta_R(D) - Lambda_disrupt * K_disrupt(D) - Lambda_op * C_overhead(D)

Where:

Delta_R(D): Total risk reduction achieved by directive D. For PATCH and ISOLATE, Delta_R approaches 100% of the active threat vector. For MITIGATE, Delta_R depends on rule coverage (typically 80-95%).
K_disrupt(D): The operational disruption penalty (service downtime, transactional rollback, breaking API changes).
C_overhead(D): The ongoing engineering and operational maintenance cost of the control.
Lambda_disrupt & Lambda_op: Organization-specific weighting parameters calibrated to business risk tolerance.

3. Prescriptive Urgency Score (`PUS`) Formulation

Before arbitrating between specific implementation directives, HDEM computes the Prescriptive Urgency Score (PUS), a scalar between 0 and 100 representing the immediate imperative for defensive action:

PUS = min(100, (w_c * C_asset + w_r * E_reach + w_w * W_exploit) * 100)

Calibrated baseline weights:

w_c = 0.35 (Asset Criticality Factor, C_asset in [0.2, 1.0])
w_r = 0.35 (Network Reachability Factor, E_reach in [0.1, 1.0])
w_w = 0.30 (Exploit Weaponization Factor, W_exploit in [0.2, 1.0])

Decision Boundary Matrix:

PUS Range	Disruption ($K$)	Fallback ($F$)	Primary Directive	Target SLA	Secondary Contingency
80 - 100	High (`>= 0.7`)	Available (`>= 0.7`)	`MITIGATE`	< 4 Hours	`PATCH` (Scheduled Window)
80 - 100	High (`>= 0.7`)	None (`< 0.4`)	`ISOLATE`	< 1 Hour	`PATCH` (Post-Isolation)
80 - 100	Low (`< 0.7`)	Any	`PATCH`	< 12 Hours	`ISOLATE` (Fallback)
50 - 79	High (`>= 0.7`)	Available (`>= 0.7`)	`MITIGATE`	< 48 Hours	`PATCH` (Next Release)
50 - 79	Low (`< 0.7`)	Any	`PATCH`	< 7 Days	`MONITOR`
30 - 49	Any	Any	`MONITOR`	< 14 Days	`ACCEPT` (If isolated)
0 - 29	Any	Any	`ACCEPT`	Quarterly	`MONITOR` (Annual review)

4. The Prescriptive Playbook Execution Lifecycle

A directive is useless without an executable technical procedure. HDEM pairs each directive with a structured Remédiation Playbook Lifecycle:

sequenceDiagram
    autonumber
    participant D as Decision Engine
    participant S as SOC / DevSecOps
    participant E as Execution Layer (WAF / Kernel / K8s)
    participant A as Audit & Compliance Log

    D->>S: Dispatches Prescriptive Directive (e.g. MITIGATE < 4h)
    S->>E: Applies Pre-Compiled Playbook Snippet
    E-->>S: Execution Verified (Command Output Check)
    S->>A: Emits Cryptographic Compliance Token
    Note over A: NIS2 Art. 21 / DORA Art. 9 Justification Logged

5. Justifiable Regulatory Defensibility (NIS2, DORA, ISO 27001)

Under modern regulatory frameworks, compliance is no longer a check-box exercise. European authorities (e.g. ANSSI, BSI, ENISA) conduct rigorous post-incident forensic audits. If an organization suffered an intrusion through an unpatched vulnerability, investigators demand:

When did the organization become aware of the flaw?
Why was the patch not applied within the standard window?
What compensatory controls were actively operational during the deferral period?

HDEM automates the generation of a tamper-evident Decision Audit Manifest, recording:

Input parameters at decision timestamp T_0.
Mathematical rationale justifying why MITIGATE or ISOLATE was chosen over PATCH.
Verification command output proving the compensatory control was active.

🎯 Decision Engine Tool Access the interactive client-side workbench and execute live prescriptive arbitration.

☠️ Agent Death Simulator Emergency kill-switches and epistemic memory suicide for rogue autonomous agents.

💥 Agent Blast Radius Methodology Mathematical modeling of the 5-vector damage tensor and containment boundary attenuation.

🔭 Threat Observatory Continuous operational threat intelligence and reduction funnels.

Hermes Decision Engine Methodology (HDEM): Multi-Objective Remediation Arbitration

Interactive Decision Engine Workbench

Real-Time Decision Arbitration Workbench

💡 Deterministic Decision Rationale:

🛠️ Associated Remediation Playbook:

Formal Taxonomy of the 6 Operational Directives

Immediate Vendor Patching

Compensatory Defensive Mitigation

Perimeter & Network Quarantine

Architectural Deprecation & Replacement

Formalized Risk Acceptance

Enhanced Telemetry & Threat Hunting

Prescriptive Remediation Playbook Library

eBPF Sub-Millisecond Kernel Socket Drop

ModSecurity / Coraza Virtual Regex Patch

Automated Micro-Segmentation Quarantine

Vulnerable Kernel Module Dynamic Blacklist

Graceful Sunset & Architecture Replacement

High-Fidelity Kernel Syscall Audit Probe

Decision Audit Trail & Regulatory Compliance Justification (NIS2 / DORA)

1. The Core Failure of Classical Vulnerability Prioritization

2. Mathematical Formalism: The Multi-Objective Utility Function

3. Prescriptive Urgency Score (PUS) Formulation

Decision Boundary Matrix:

4. The Prescriptive Playbook Execution Lifecycle

5. Justifiable Regulatory Defensibility (NIS2, DORA, ISO 27001)

6. Related Methodologies & Tools

3. Prescriptive Urgency Score (`PUS`) Formulation