Most enterprise post-mortems fail to improve organizational defense because they suffer from three structural flaws:
The Hermes Autopsy Methodology establishes an engineering framework to convert forensic telemetry into quantitative defensive architecture decisions.
Inspect real-world incident autopsies and simulate counterfactual defensive controls below:
Hermes Autopsy mandates reversing the analytical timeline:
[ T_0: Terminal Blast Impact ] (Disruption / Data Exfiltration Revealed) ▲ │ Step 1: How did assets exit or systems freeze? │[ T - Δt_1: Data Exfiltration / Lateral Extrusion ] ▲ │ Step 2: What persistence or implants enabled movement? │[ T - Δt_2: Privilege Escalation & Persistence ] ▲ │ Step 3: What vulnerability was exploited to gain foothold? │[ T - Δt_3: Initial Perimeter Breach / Gate Ingress ] ▲ │ Step 4: What signals existed prior to breach? │[ T - Δt_4: Pre-Breach Reconnaissance & Weaponization Signals ]By traversing from impact backwards:
Every analyzed security control is classified into one of four deterministic failure states:
1. BYPASSED
The defensive control was active, properly deployed, and functional, but the adversary used an evasion technique, zero-day primitive, or valid cryptographic material that fell outside the control’s detection envelope.
Example: A WAF checking for raw PHP script tags bypassed by CSS inlining template injection (@import).
2. MISCONFIGURED
The control possessed the technical capability to detect or prevent the technique, but was improperly scoped, whitelisted, or degraded due to administrative compromise or operational friction.
Example: EDR real-time hooks disabled on web application cache directories (/var/cache/) to avoid CPU overhead.
3. UNMONITORED
The control was deployed and successfully emitted log telemetry, but the signals were never ingested, triaged, correlated, or acted upon by human or automated defenders. Example: Firewall NetFlow logging sustained outbound TCP 443 transfers to an unknown foreign ASN, but no alert threshold was defined.
4. ABSENT
The necessary architectural control did not exist in the target environment at the time of the incident. Example: Web application tier had unrestricted, unproxied outbound egress access to the public internet.
To evaluate defensive alternatives, Hermes computes the Counterfactual Interception Efficiency (E_c) and Combined Reduction Rate (E_comb).
For an intervention $k \in K$ targeting kill-chain step $j$:
E_c(k) = P(Severing Kill-Chain at Step j | Technique T_j, Friction F_k) in [0, 100]%When multiple defense-in-depth interventions are deployed concurrently across different phases:
E_comb = 100 * [ 1 - PROD_{k in I} (1 - E_c(k) / 100) ] %Given baseline incident metrics (Compromised Systems $S_0$, Downtime Hours $D_0$):
S_simulated = max(0, round( S_0 * (1 - E_comb / 100) ))D_simulated = max(0, round( D_0 * (1 - E_comb / 100) ))Delta_B = B_0 * (E_comb / 100)Interventions are weighted against operational cost: