Hermes Threat Score (HTS) Methodology & Divergence Engine

Operational Relevance Metric

The Hermes Threat Score (HTS) is an intelligence metric measuring the real-world operational relevance of a software vulnerability. While CVSS evaluates theoretical technical severity under ideal attacker conditions, HTS answers the pressing defender question: “How urgently do security operations teams need to remediate this vulnerability right now?“

1. Why CVSS Fails as a Prioritization Strategy

Enterprise security teams face thousands of newly published vulnerabilities each month, the vast majority of which receive CVSS scores of 7.0 or higher. Treating CVSS as an operational patching queue leads to alert fatigue and critical blind spots:

• Theoretical vs. Realized Exploitability: A vulnerability with CVSS 9.8 may have zero functional exploits, require complex multi-step memory shaping, or affect an obsolete component deployed in less than 0.1% of networks.
• The “Zero-to-Pawned” Velocity: A vulnerability rated CVSS 7.5 (High) that has been incorporated into automated ransomware exploit kits or CISA’s Known Exploited Vulnerabilities (KEV) catalog represents a catastrophic operational emergency.

HTS bridges the gap between static vulnerability descriptions and active threat operations by fusing:

1. NVD / CWE Technical Metrics
2. EPSS (Exploit Prediction Scoring System) probability distributions
3. CISA KEV / In-the-Wild Exploitation Telemetry
4. Public Exploit Maturity (PoC, Metasploit, Weaponized kits)
5. Internet-Wide Exposure & Enterprise Product Prevalence

---

2. Dimensional Architecture (0–100 Scale)

The Hermes Threat Score combines eight operational dimensions:

HTS TOTAL SCORE = Exploitability (20) + Threat Activity (20) + Weaponization (15)
                + Exposure (15) + Product Prevalence (10) + Impact (10) + Exploit Maturity (10)

Dimension	Weight	Criteria & Operational Evidence
Exploitability	0–20 pts	Network accessibility, authentication barriers, and exploitation preconditions.
Threat Activity	0–20 pts	Observed active exploitation in the wild, CISA KEV listing, honeypot telemetry hits.
Weaponization	0–15 pts	Integration into public frameworks (Metasploit, Nuclei, Cobalt Strike) or dark web commercial loaders.
Exposure	0–15 pts	Proportion of vulnerable instances exposed directly to the public internet (Shodan / Censys data).
Product Prevalence	0–10 pts	Market share and enterprise ubiquity of the affected software or dependency.
Impact Severity	0–10 pts	Scope of damage (Host RCE, unauthenticated data exfiltration, service denial).
Exploit Maturity	0–10 pts	Reliability of the exploit (from theoretical PoC to 100% reliable automated weapon).

---

3. Divergence Analysis: CVSS vs. Hermes

One of the most valuable capabilities of Hermes Codex is Divergence Analysis. Hermes automatically highlights situations where operational reality departs sharply from CVSS.

Case A: CVSS High / Hermes Low (The De-escalation Filter)

CVSS: 9.8 (Critical)  ──►  HERMES THREAT SCORE: 34 (Low)

• Why? The technical impact is devastating (RCE), but there is zero public exploit, exploitation requires non-default memory compiler flags, and the software is an obscure library with minimal internet exposure. Defenders can safely prioritize other active threats.

Case B: CVSS Moderate / Hermes Critical (The Escalation Alert)

CVSS: 6.8 (Medium)   ──►  HERMES THREAT SCORE: 92 (Critical)

• Why? Although CVSS marks the vulnerability as medium because it only allows local information disclosure, active ransomware syndicates are chaining it with ubiquitous domain controllers to achieve full Active Directory compromise.

---

4. Live Benchmark Example: Roundcube CVE-2026-59822

Below is an operational evaluation of CVE-2026-59822 (Roundcube Webmail Pre-Auth RCE):

HTS

HERMES THREAT SCORE

Target: Roundcube Webmail Core Server

Confidence: 98%

96 / 100

EXTREME

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 20 / 20

Weaponization 15 / 20

Exposure 15 / 20

Prevalence 10 / 20

Impact 10 / 20

Exploit Maturity 10 / 20

Attack Chain Potential 6 / 20

⚖️ Divergence & Operational Rationale

Full convergence between CVSS (9.8) and Hermes Threat Score (96). Active in-the-wild weaponization, CISA KEV catalog inclusion, public automated exploit kits, and widespread internet-facing webmail instances mandate immediate out-of-band patching.

---

5. Related Methodologies & Intelligence

Hermes Agentic Security Score (HASS) Explore how Hermes quantifies the unique systemic danger of autonomous and tool-enabled AI agents.

Confidence Model & Evidence Verification Learn how Hermes weights sources, identifies contradictions, and separates facts from inferences.

What Changed? Daily Delta Intelligence View the daily diff of escalated vulnerabilities, new weaponized exploits, and threat actor campaigns.

Flowise CSV Agent RCE (CVE-2026-41264) Examine a high-threat agentic execution sink scored under both HTS and HASS.