Hermes Risk Trajectories: Temporal Risk Progression & Archetype Library

Strategic Pillar: Cyber Risk is an Evolving Trajectory

Risk is Temporal, Not Static: A vulnerability is not merely characterized by a static severity score (such as CVSS 9.8). It possesses a dynamic state risk(t), an acceleration rate Δrisk / Δt, and inflection triggers. Hermes Trajectory Engine models these dynamics continuously to provide actionable foresight before exploits become catastrophic.

---

Interactive Risk Trajectory Workbench

Explore the 61 modeled cyber risk trajectories below. Filter by Inflection Point status (Critical Acceleration, Accelerating, Rising, Stable) or inspect the matching Canonical Archetype for each target system:

TEMPORAL RISK TRAJECTORY ENGINE

HTR-2.0 61 ACTIVE TRAJECTORIES

Cyber risk is not a frozen static score, but an evolving trajectory risk(t) subject to discrete accelerations Δrisk/Δt. This engine automatically detects critical inflection points and matches active vulnerabilities with historical trajectory archetypes.

All 🚨 Critical ⚡ Accelerating 📈 Rising 🛡️ Stable

Modeled Entities 61

🧬 Library of 8 Canonical Trajectory Archetypes

Every emerging threat is mathematically projected onto 8 documented historical archetypes to anticipate its future path.

⚡ CRITICAL

Rapid Exploitation

Violent risk surge from 0 to 90+ within 72 hours, accompanied by automated botnet scanning.

Signature: Unauthenticated RCE, zero-day PoC, mass exploitation.

🕯️ HIGH

Slow Burn

Vulnerability remains dormant for months before high-value weaponization by APT actors.

Signature: High exploit complexity, targeted infrastructure attacks.

🔕 LOW

False Alarm

High initial CVSS (9.8) but unrealistic attack preconditions or extremely rare configuration.

Signature: Rapid risk deflation, EPSS < 0.1%, no weaponization.

⏳ ELEVATED

Delayed Exploitation

Exploitation developed by reverse-engineering the vendor's patch release (Patch Diffing).

Signature: Surges 2-4 weeks post-patch, targeting patching lag.

🚨 CRITICAL

KEV Acceleration

Abrupt inflection upon CISA KEV catalog inscription, triggering binding patch mandates.

Signature: Confirmed active in-the-wild exploitation, top priority.

📦 HIGH

Supply-Chain Escalation

Cascading risk amplification propagated across thousands of downstream open-source libraries.

Signature: Massive blast radius, complex multi-tier remediation.

🧟 MEDIUM

Long-Tail Persistence

Stubborn unpatched internet exposure persisting for quarters after official patch release.

Signature: Forgotten edge devices, appliance firmware, abandoned legacy.

📉 STABLE

Patch Reduction

Rapid collapse of risk surface driven by automated updates or cloud-native hotpatches.

Signature: 90% exposure resolved within 14 days without friction.

---

1. Mathematical & Epistemic Formulation

Hermes Trajectory Engine v2.0 (HTR-2.0) formalizes temporal cyber risk as a time-indexed vector:

risk(t) = f(HTS(t), EPSS(t), Maturity(t), KEV(t), Exposure(t))

Where discrete acceleration is defined across consecutive observation checkpoints t_k and t_{k-1}:

Acceleration = (risk(t_k) - risk(t_{k-1})) / Δt

Inflection Point Classification

Inflection State	Condition	Operational Meaning
🚨 Critical Acceleration	Δrisk ≥ +15, CISA KEV listing, or in-the-wild zero-day weaponization	Immediate emergency triage; automated containment playbooks activated.
⚡ Accelerating	+9 ≤ Δrisk ≤ +14 or functional exploit script publication	Heightened weaponization velocity; patch scheduling moved forward.
📈 Rising	+3 ≤ Δrisk ≤ +8	Increasing reconnaissance or vendor confirmation; standard monitoring.
🛡️ Stable	`	Δrisk

---

2. The 8 Canonical Trajectory Archetypes

As specified in the Hermes Strategic Master Plan (Section 15.2), all cyber security events project onto 8 empirical families:

⚡ Rapid Exploitation

Sudden violent surge from 0 to 90+ within 72 hours of disclosure, accompanied by mass automated botnet scanning.

🕯️ Slow Burn

Vulnerability remains dormant for quarters before silent weaponization by specialized advanced persistent threats (APTs).

🔕 False Alarm

High initial CVSS score (e.g. 9.8) but mitigated by unrealistic prerequisites, zero public weaponization, or low EPSS (< 0.1%).

⏳ Delayed Exploitation

Weaponization surges 2 to 4 weeks post-patch publication, developed by reverse-engineering vendor binary diffs.

🚨 KEV Acceleration

Abrupt critical inflection triggered by inclusion in CISA KEV, mandating compliance deadlines across federal and enterprise networks.

📦 Supply-Chain Escalation

Cascading risk amplification propagating across hundreds of downstream libraries and containerized base images.

🧟 Long-Tail Persistence

Stubborn unpatched exposure on perimeter or IoT appliances surviving well past 90 days after fix availability.

📉 Patch-Induced Reduction

Rapid collapse in exposure surface powered by automated zero-downtime hotpatching and auto-update mechanisms.

---

3. Programmatic API Access

Trajectory datasets are updated during each intelligence compilation and exported as static REST JSON endpoints:

# Fetch all active risk trajectories
curl -s https://hermescodex.io/api/trajectories/index.json

# Fetch single trajectory with time curve
curl -s https://hermescodex.io/api/trajectories/TRAJ-CVE-2025-3248.json