Choose between flexible monthly/annual SaaS tiers or turnkey, one-shot diagnostic audit packs tailored for executive committee and board reporting without recurring commitment.
Understand the cyber world. Public intelligence, macro-observatory, and open research.
Understand your environment. Sovereign stack monitoring, risk trajectories, and decision directives.
Operate with Hermes. Multi-stack workspaces, CLI daemon, Security Delta, and AI security.
Integrate Hermes. Dedicated pipelines, private TAXII feeds, custom scoring, and 99.9% SLA.
Fixed-price, turnkey diagnostic deliverables without recurring subscription. Ideal for French & European procurement orders (PO, virement SEPA, Chorus Pro).
Complete organizational and technical readiness diagnostic certified for Executive Committees and Boards.
Comprehensive supply-chain risk evaluation for critical applications and client deliverables.
Specialized threat model and defense-in-depth review for agentic workflows, MCP tools, and sovereign LLMs.
Hermes is not an alert-spamming scanner. You get a comprehensive Cyber Risk Intelligence engine: 1,498+ DFIR dossiers, real-time KEV/EPSS correlation, exploit trajectory tracking, and a prescriptive decision engine that turns observations into immediate containment (T0) and lasting root-cause remediations (T1).
Community (β¬0) is designed for researchers and students. Professional (β¬190/mo) is tailored for solo CISOs and lead SecOps managing their personal perimeter. Team (β¬790/mo) empowers SOC and engineering teams to coordinate and enforce risk gates in CI/CD. Enterprise serves regulated entities requiring air-gapped deployments or private dedicated TAXII feeds.
In Community, you observe the world's threat landscape. With Professional or Team, Hermes operates in active sovereign mode: your Daily Brief, trajectory inflections, and webhook alerts are strictly filtered against your exact technology stack, eliminating 98% of irrelevant CTI noise.
Absolute sovereignty guarantee: all SBOM parsing, vulnerability mapping, and risk computations execute 100% locally in your browser or local CLI runner. No component inventory, repository code, or architecture manifest is uploaded to our servers.
Yes, immediately with no credit card required. Head over to "My Stack" or the "SBOM Analyzer" and click any of our 3 Instant Demo Presets (Cloud & Microservices, AI Agent & Python, Acme Corp) to experience the full risk trajectory and webhook dispatcher flow.
Legacy software scanners flood teams with thousands of theoretical CVEs, burning hundreds of engineering hours on vulnerabilities that are neither weaponized nor reachable. Hermes Codex applies multi-source threat intelligence, exploit maturity tracking, and graph-based attack path modeling to isolate true risk.
Zero-Server Privacy by Design
Your SBOM files, dependency graphs, and code repositories never leave your workstation. Unlike conventional SaaS platforms that ingest your intellectual property into remote databases, Hermes Codex compiles all findings client-side in WebAssembly/JavaScript.
Hermes Threat Score (HTS vs CVSS)
CVSS evaluates theoretical severity in isolation. The Hermes Threat Score (HTS) incorporates active CISA KEV exploitation, real-time EPSS weaponization velocity, and component exposure to compute operational risk.
Epistemic Rigor & Provenance
Every finding is strictly categorized:
No speculative AI hallucinations presented as ground truth.
Agentic AI Threat Modeling
Evaluate risks unique to autonomous AI agents, tool poisoning, MCP protocol abuse, memory exfiltration, and indirect prompt injection through our dedicated AgentThreat Studio.
Yes. Both Business and Enterprise annual subscriptions, as well as all One-Shot Audit Packs, can be invoiced via corporate Purchase Orders, French public procurement (Chorus Pro), or international SEPA wire transfers with standard net-30 payment terms.
One-Shot Audit Packs produce a comprehensive, publication-grade executive PDF dossier signed and stamped by Hermes Codex. It includes executive summaries for non-technical executives, prioritized technical remediation tables, attack trajectory graphs, and 30/60/90-day roadmaps.
No. Your architecture details, dependency manifests, and responses stay strictly inside your local browser runtime. Hermes Codex does not train models on customer inventories and does not relay proprietary SBOMs to external APIs.