Skip to content
Hermes Codex

Hermes Decision Engine: Prescriptive Remediation & Operational Arbitration

Interactive Decision Workbench & Prescriptive Arbitration

Section titled “Interactive Decision Workbench & Prescriptive Arbitration”

Calibrate the 5 operational dimensions of your infrastructure, load real-world benchmark cases, obtain target remediation SLAs, and generate auditable compliance manifests in the privacy-first client sandbox:

6 Operational Directives Patch, Mitigate, Isolate, Replace, Accept, Monitor
< 1h Emergency Isolation SLA Weaponized zero-day on Tier 0 asset
5D Evaluation Tensor Criticality, Access, Weaponization, Disruption, Fallback
100% Client-Side Privacy (P7) Zero server transmission

Real-Time Decision Arbitration Workbench

Select a benchmark case or calibrate the 5 operational dimensions of your infrastructure to instantly generate the prescriptive directive, target SLA, and auditable rationale.

👑 Asset Criticality (C_asset) Tier 0 (Crown Jewels)
🌐 Network Reachability (E_reach) Public Internet
💣 Exploit Weaponization (W_exploit) CISA KEV (In The Wild)
⚡ Patch Disruption Penalty (K_disrupt) Severe Outage
🛡️ Compensatory Control Feasibility (F_fallback) WAF / eBPF Ready
PRESCRIPTIVE OPERATIONAL DIRECTIVE:
🛡️ MITIGATE
⏱️ SLA Cible : < 4 Heures
Secondary Contingency Plan: PATCH (en fenêtre de maintenance)
Prescriptive Urgency Score (PUS): 89 / 100
Cost of Uncontrolled Inaction: CRITIQUE (Compromission d'identité)

💡 Deterministic Decision Rationale:

The asset is Tier 0 (Crown Jewel) and the threat is actively weaponized (CISA KEV). However, immediate patching imposes severe downtime during an operational freeze. Because an immediate compensatory WAF/eBPF filter is available, MITIGATE is prescribed within < 4 hours, safely deferring the vendor PATCH to the scheduled maintenance window.

🛠️ Associated Remediation Playbook:

rmmod ebt_snat || modprobe -r ebt_snat

Formal Taxonomy of the 6 Operational Directives

Hermes repudiates naive 'patch everything immediately' dogma. The 6 directives mathematically govern the trade-off between security, availability, and engineering overhead.

📦 PATCH ⏱️ < 24 Hours (Critical) / < 7 Days (High)

Immediate Vendor Patching

Deploy official vendor security updates, backports, or hotfixes to eliminate underlying vulnerability permanently.

🎯 Trigger Condition: Vendor patch verified stable AND (Exploit in KEV OR Public PoC with reachable attack surface).
⚖️ Operational Tradeoff: Requires service restart or maintenance window; potential regression risk.
⏪ Rollback Risk: Low to Moderate.
🛡️ MITIGATE ⏱️ < 4 Hours

Compensatory Defensive Mitigation

Deploy external perimeter controls (WAF virtual patch, eBPF socket drop, ingress firewall rules, or feature toggle) to block exploitation without touching underlying codebase.

🎯 Trigger Condition: Active zero-day without vendor patch OR high patch disruption during strict operational freeze.
⚖️ Operational Tradeoff: Risk of false positives on non-standard client traffic; maintenance overhead of rule lifecycle.
⏪ Rollback Risk: Very Low (Instantaneous rule disablement).
🔒 ISOLATE ⏱️ < 1 Hour (Urgent)

Perimeter & Network Quarantine

Sever untrusted network access, move asset to isolated quarantine VLAN, drop default routing, or confine execution inside an ephemeral microVM sandbox.

🎯 Trigger Condition: Unauthenticated RCE under active wild exploitation on critical asset where no patch or WAF mitigation exists.
⚖️ Operational Tradeoff: Temporary functional impairment of external integrations or service reachability.
⏪ Rollback Risk: Instantaneous (Route restoration).
🔄 REPLACE ⏱️ < 30 Days

Architectural Deprecation & Replacement

Decommission and replace unmaintained, abandonware, or structurally defective components with hardened modern alternatives.

🎯 Trigger Condition: Component is End-of-Life (EOL), unpatched for > 90 days, or architecturally unsecurable.
⚖️ Operational Tradeoff: Substantial migration engineering effort and regression testing cycles.
⏪ Rollback Risk: High (Multi-system architectural migration).
📋 ACCEPT ⏱️ Quarterly Review Cycle

Formalized Risk Acceptance

Document and formalize conscious business risk acceptance when vulnerability is unreachable, purely theoretical, or remediation cost exceeds maximum potential loss.

🎯 Trigger Condition: HTS < 40 AND Exploitability is Theoretical AND Network Reachability is zero (air-gapped / unexposed).
⚖️ Operational Tradeoff: Zero immediate operational expenditure; residual compliance audit tracking.
⏪ Rollback Risk: Zero.
👁️ MONITOR ⏱️ < 48 Hours

Enhanced Telemetry & Threat Hunting

Deploy targeted SIEM detection rules, Canary tokens, and auditd/Sysmon probes to detect early exploitation attempts without altering production code.

🎯 Trigger Condition: Newly disclosed CVE with high theoretical severity but zero in-the-wild weaponization or weaponized exploit circulating on specialized darknet channels.
⚖️ Operational Tradeoff: SIEM ingestion bandwidth and SOC analyst triage load.
⏪ Rollback Risk: Negligible.

Prescriptive Remediation Playbook Library

Turn-key technical recipes for WAF, Linux kernel, SDN micro-segmentation, and container isolation ready for incident execution.

PLAY-01-EBPF-DROP ⚙️ Linux Kernel XDP / TC

eBPF Sub-Millisecond Kernel Socket Drop

Directive: MITIGATE
Implementation snippet:
SEC("xdp") int xdp_drop_cve(struct xdp_md *ctx) { void *data = (void *)(long)ctx->data; void *data_end = (void *)(long)ctx->data_end; struct ethhdr *eth = data; if ((void *)(eth + 1) > data_end) return XDP_PASS; if (eth->h_proto == bpf_htons(ETH_P_IP)) { struct iphdr *ip = (void *)(eth + 1); if ((void *)(ip + 1) > data_end) return XDP_PASS; if (ip->protocol == IPPROTO_TCP) { struct tcphdr *tcp = (void *)(ip + 1); if ((void *)(tcp + 1) > data_end) return XDP_PASS; if (tcp->dest == bpf_htons(7001)) return XDP_DROP; } } return XDP_PASS; }
✅ Verification command:
bpftool prog show name xdp_drop_cve && bpftool net list
PLAY-02-WAF-VIRTUAL-PATCH ⚙️ Reverse Proxy / WAF

ModSecurity / Coraza Virtual Regex Patch

Directive: MITIGATE
Implementation snippet:
SecRule REQUEST_URI "@rx (?:/api/v1/reset_password|/guest/provision)" "id:100901,phase:2,deny,status:403,log,msg:'Hermes Virtual Patch: Malformed Account Provisioning Replay'"
✅ Verification command:
curl -ik -X POST https://target/api/v1/reset_password -d 'malformed' | grep 403
PLAY-03-VLAN-QUARANTINE ⚙️ Software-Defined Network (SDN) / Calico / Cilium

Automated Micro-Segmentation Quarantine

Directive: ISOLATE
Implementation snippet:
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: emergency-isolate-asset
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: vulnerable-workload
  ingress: []
  egress: []
✅ Verification command:
cilium endpoint list | grep vulnerable-workload
PLAY-04-MODULE-UNLOAD ⚙️ Host OS Modprobe

Vulnerable Kernel Module Dynamic Blacklist

Directive: MITIGATE
Implementation snippet:
rmmod ebt_snat || modprobe -r ebt_snat && echo 'install ebt_snat /bin/true' > /etc/modprobe.d/cve-2026-53266-mitigation.conf
✅ Verification command:
lsmod | grep ebt_snat || echo 'Module successfully unmapped'
PLAY-05-DECOMMISSION-WORKFLOW ⚙️ Infrastructure as Code (Terraform / Helm)

Graceful Sunset & Architecture Replacement

Directive: REPLACE
Implementation snippet:
resource "kubernetes_deployment" "legacy_workload" {
  metadata {
    annotations = {
      "hermes.codex/deprecated" = "true"
      "hermes.codex/sunset-date" = "2026-10-15"
    }
  }
  spec {
    replicas = 0
  }
}
✅ Verification command:
kubectl get deployments -A -l hermes.codex/deprecated=true
PLAY-06-AUDITD-PROBE ⚙️ Linux auditd

High-Fidelity Kernel Syscall Audit Probe

Directive: MONITOR
Implementation snippet:
auditctl -a always,exit -F arch=b64 -S setsockopt -F a2=0x2710 -k cve_2026_ebtables_exploit
auditctl -a always,exit -F arch=b64 -S sendmsg -F a0=3 -k cve_2025_afalg_race
✅ Verification command:
ausearch -k cve_2026_ebtables_exploit --raw

Decision Audit Trail & Regulatory Compliance Justification (NIS2 / DORA)

Regulatory authorities mandate auditable proof when vulnerabilities are mitigated or isolated rather than immediately patched. Generate your verifiable defense declaration.

📜 HERMES DECISION AUDIT MANIFEST 
{
  "audit_version": "1.0",
  "engine": "Hermes Decision Engine V3.0",
  "timestamp": "2026-09-18T18:00:00Z",
  "compliance_frameworks": ["NIS2-Art21", "DORA-Art9", "ISO27001-A.12.6.1"],
  "evaluation_context": {
    "threat_id": "CVE-2026-83021",
    "asset_criticality": "TIER_0 (Crown Jewels)",
    "network_reachability": "DMZ_PROXY",
    "exploit_weaponization": "CISA_KEV_WILD",
    "disruption_penalty": "SEVERE_OUTAGE (Operational Freeze)",
    "compensatory_fallback": "IMMEDIATE_WAF (Port 7001 eBPF Filter)"
  },
  "arbitration_result": {
    "primary_directive": "MITIGATE",
    "target_sla": "< 4 Hours",
    "secondary_contingency": "PATCH (Next Scheduled Maintenance Window)",
    "prescriptive_urgency_score": 89,
    "formal_justification": "Compensatory defensive control deployed to prevent active exploitation without incurring catastrophic operational downtime during active freeze window."
  }
}

1. The 6 Operational Directives

Section titled “1. The 6 Operational Directives”

Hermes formalizes security remediation into a deterministic taxonomy of six operational directives:

graph TD
    Threat["Vulnerability Signal / CVE Ingestion"] --> DecisionTree["Hermes Prescriptive Decision Tensor"]


    DecisionTree --> D1["1. PATCH (Immediate Vendor Update)"]
    DecisionTree --> D2["2. MITIGATE (Compensatory WAF / eBPF / Config)"]
    DecisionTree --> D3["3. ISOLATE (Quarantine VLAN / MicroVM Air-Gap)"]
    DecisionTree --> D4["4. REPLACE (Decommission & Architecture Sunset)"]
    DecisionTree --> D5["5. ACCEPT (Documented Business Risk Acceptance)"]
    DecisionTree --> D6["6. MONITOR (Enhanced SIEM & Canary Telemetry)"]


    D1 --> SLA1["SLA: < 24 Hours"]
    D2 --> SLA2["SLA: < 4 Hours"]
    D3 --> SLA3["SLA: < 1 Hour"]
    D4 --> SLA4["SLA: < 30 Days"]
    D5 --> SLA5["SLA: Quarterly Review"]
    D6 --> SLA6["SLA: < 48 Hours"]
  1. PATCH (Vendor Update): Applied when an official update is verified stable, patch disruption is low, or no viable compensatory filter exists.
  2. MITIGATE (Compensatory Control): Prioritized when immediate patching causes severe business outage during operational freezes or when an active zero-day lacks an official fix.
  3. ISOLATE (Perimeter Quarantine): Mandatory emergency response when unauthenticated RCE is actively exploited against critical infrastructure without defensive filters.
  4. REPLACE (Component Sunset): Mandated for abandonware, End-of-Life (EOL) dependencies, or structurally flawed agent tools.
  5. ACCEPT (Conscious Risk Acceptance): Formally justified when reachability is zero, exploitability is purely academic, and remediation cost exceeds asset exposure.
  6. MONITOR (Active Telemetry): Prescribed for early-stage disclosures with low exploit maturity to avoid premature production alarms.

2. The 5-Dimensional Evaluation Tensor

Section titled “2. The 5-Dimensional Evaluation Tensor”

Every decision is computed deterministically from five orthogonal factors:

PUS = min(100, (0.35 * C_asset + 0.35 * E_reach + 0.30 * W_exploit) * 100)

Where:

  • C_asset (Asset Criticality): Tier 0 Crown Jewels (1.0) down to Tier 3 Non-Production (0.2).
  • E_reach (Network Reachability): Public Internet (1.0), DMZ Proxy (0.75), Internal VPC (0.45), Air-gapped (0.1).
  • W_exploit (Exploit Weaponization): CISA KEV In-The-Wild (1.0), Weaponized PoC (0.8), Academic PoC (0.5), Theoretical (0.2).
  • K_disrupt (Patch Disruption Penalty): Outage penalty dictating whether MITIGATE or ISOLATE precedes PATCH.
  • F_fallback (Compensatory Feasibility): Availability of drop-in WAF rules or eBPF socket drops.

3. Regulatory Compliance & Justification (NIS2 & DORA)

Section titled “3. Regulatory Compliance & Justification (NIS2 & DORA)”

Under European regulations (NIS2 Article 21, DORA Article 9) and ISO 27001 (Control A.12.6.1), auditors penalize organizations that fail to patch critical CVEs within standard SLA windows unless a formalized compensatory mitigation and technical risk rationale is documented.

The Hermes Decision Engine generates an automated, cryptographically signed JSON manifest providing auditor-ready justification for deferring patches in favor of active mitigations.

4. Integration with the Hermes Codex Ecosystem

Section titled “4. Integration with the Hermes Codex Ecosystem”
📐 HDEM Methodology Explore the mathematical optimization models and multi-objective utility functions of the Decision Engine.
☠️ Agent Death Simulator Simulate deterministic hypervisor SIGKILL and epistemic memory suicide for rogue AI agents.
💥 Agent Blast Radius Workbench Calculate multi-vector damage propagation and containment boundary attenuation factors.
🔭 Threat Observatory Review live signal ingestion, reduction funnels, and real-time operational decisions.