Hermes Security Delta: Transversal State A vs State B Comparative Engine

⚖️ Interactive Security Delta Workbench

Select a comparative scenario below to inspect side-by-side differences between State A and State B, or use the interactive live simulator at the bottom to test defensive configurations in real-time:

Quantitatively measure the security gain or risk regression between two states: before/after patch, AI agent v1 vs v2, SBOM manifest, or Zero-Trust architecture. Assess the Risk Delta (ΔHTS), trajectory shift, and blast radius impact.

⚡ Interactive Live Delta Simulator

Toggle defensive controls below to compute real-time Risk Delta and blast radius containment.

Apply vendor upstream security patch Enforce unprivileged sandboxing / container cgroup Grant write access via MCP tool server (Elevated risk) Enforce Zero-Trust authentication (mTLS + JIT)

1. The Four Core Dimensions of Security Delta

As formalized in Section 18 of the Hermes Strategic Master Plan, Security Delta evaluates state transitions across 4 objective vectors:

📊 Risk Delta (ΔHTS)

ΔHTS = HTS(State B) - HTS(State A)
A negative delta denotes risk mitigation (e.g. -78 pts), while a positive delta immediately flags security regressions (e.g. +62 pts upon adding unconstrained tools to an AI agent).

📈 Trajectory Shift

Inflection Point Transition
Tracks whether the change successfully pulled an asset out of Critical Acceleration down into Stable, or inadvertently triggered weaponization momentum.

🌐 Exposure Delta

Attack Surface & Interface Reduction
Measures changes in open network listening ports, public perimeter reachability, unauthenticated endpoints, and unprivileged user namespace exposure.

💥 Blast Radius Delta

Lateral Movement & Privilege Boundary Shift
Quantifies worst-case impact containment: from unrestricted domain takeover down to isolated sandbox container execution.

2. Transversal Use Cases

Security Delta applies universally across modern engineering operations:

Paradigm	State A (Baseline)	State B (Target)	Primary Analytical Goal
Vulnerability Patching	Unpatched runtime (`CVE-2025-39964`)	Backported fix + hardened sysctl	Prove that weaponized execution primitives are completely severed.
Agentic AI Autonomy	Sandboxed read-only agent	Agent with SQL + MCP filesystem	Identify dangerous capability expansions before deploying to production.
SBOM Evolution	Manifest v2.4 (legacy dependencies)	Manifest v2.5 (sanitized targets)	Verify that dependency upgrades eliminated known KEV vulnerabilities.
Architecture Modernization	Legacy VPN / Direct RDP	Zero-Trust (ZTNA + JIT bastion)	Quantify the elimination of lateral network movement pathways.

3. Programmatic API Access

Security Delta scenarios and differential calculations are accessible via static REST JSON endpoints:

# Fetch all compiled Security Delta scenarios
curl -s https://hermescodex.io/api/security-delta/index.json

# Fetch single scenario details
curl -s https://hermescodex.io/api/security-delta/DELTA-PATCH-01.json