Hermes Threat Trajectory (HTR) Methodology
1. HTS vs HTR: State vs. Movement
Section titled “1. HTS vs HTR: State vs. Movement”- Hermes Threat Score (HTS): Measures the current instantaneous operational risk on a scale from 0 to 100.
- Hermes Threat Trajectory (HTR): Measures the direction, velocity, and second-derivative acceleration of that risk across a rolling temporal horizon ($T-30$ to $NOW$).
Static Snapshot (HTS = 78) --> Tells you where the risk is right now.Dynamic Vector (HTR = ACCELERATING, v = +4.2 pts/day) --> Tells you where the risk will be tomorrow.2. Interactive Trajectory Benchmark
Section titled “2. Interactive Trajectory Benchmark”Below is an operational visualization of a critical asset exhibiting rapid exploit acceleration:
CVE-2026-76460 — Cisco Identity Services Engine (ISE) — Token-Replay Authentication Bypass
While CVSS 10.0 signaled maximum theoretical severity from day one, HTR tracked the true operational escalation: a dormant flaw jumping from an internal tracker (HTS 42) to weaponized exploitation and KEV integration within 14 days, with explosive velocity (+4.8 pts/day).
3. Mathematical Formulation
Section titled “3. Mathematical Formulation”1. Velocity ($v$)
Section titled “1. Velocity ($v$)”Velocity measures the average daily change in Hermes Threat Score across an observation window $\Delta t$:
v = (HTS_t2 - HTS_t1) / (t2 - t1) [units: points / day]2. Acceleration ($a$)
Section titled “2. Acceleration ($a$)”Acceleration measures the rate at which risk momentum is intensifying or tapering off:
a = (v_current - v_previous) / Delta_t [units: points / day^2]A positive acceleration ($a > 0$) combined with high velocity signifies an exploit weaponization sprint (threat actors rapidly incorporating the vulnerability into botnets or ransomware kits).
4. The 6 Trajectory Classifications
Section titled “4. The 6 Trajectory Classifications”Rather than arbitrary qualitative labels, HTR applies deterministic state classifications:
| Classification | Technical Criteria | Strategic Defender Decision |
|---|---|---|
ACCELERATING | $v \ge +2.0$ pts/day or weaponized PoC / in-the-wild exploitation within 72 hours. | Emergency Out-of-Band Patch |
EMERGING | Newly disclosed zero-day or high-exposure surface with active research reconnaissance. | Pre-Emptive Perimeter Shielding |
STABLE | $-0.5 \le v \le +0.5$ pts/day; established mitigation available; no novel exploit chains. | Standard Patching Maintenance |
DECELERATING | $v \le -1.0$ pts/day; widespread vendor patching or deprecated software ecosystem. | Deprioritize to Standard Cycle |
VOLATILE | Contradictory telemetry, disputed vendor advisories, or fluctuating honeypot hits. | Enhanced Sensor Monitoring |
INSUFFICIENT_DATA | Sparse telemetry; pending official disclosure or missing protocol captures. | Track Primary Feeds |
5. Comparative Metric Architecture
Section titled “5. Comparative Metric Architecture”Hermes does not claim that HTS or HTR make other metrics obsolete; rather, they serve distinct operational purposes:
Metric Nature Primary Question Answered----------------------------------------------------------------------------------------CVSS Theoretical Inherent "How destructive could this be under ideal conditions?"EPSS Statistical Likelihood "What is the statistical chance of exploitation in 30d?"CISA KEV Observed Historical "Has this been seen exploited in the wild anywhere?"HTS Operational Relevance "How urgently do we need to patch this right now?"HTR Temporal Trajectory "Is the adversary momentum speeding up or dying down?"