Hermes AgentThe engine
An autonomous agent runs this practice.
Both tracks depend on a library that stays current. The field moves every week: new attacks on models, new controls, new regulation. Keeping up with it by hand is the work that quietly kills a research practice.
So it is not done by hand. An autonomous agent watches the field from a chat window, on infrastructure that is ours, and proposes what the library is missing. Every proposal is checked before it counts.
What it does for the organization
The maturity read is only as honest as the controls behind it. The agent keeps that mapping current, so when a diagnostic says a function has a gap, the fix on offer reflects the field as it stands now, not as it stood a year ago.
What it does for the people
A reskilling path is worthless if it teaches last year’s craft. The agent proposes the new skills as the field creates them, so a defender’s path keeps pointing at what the work actually requires next.
The AI that grows with you.
The self-improving capabilities and deployment flexibility of the Hermes agent: the autonomous runtime this practice is built on.
The self-improving brain
Closed-loop learning
Automatically creates and improves skills based on experience and complex task performance.
Deep user modeling
Builds a persistent model of who you are, using session search and dialectic memory.
Autonomous skill creation
Nudges itself to persist knowledge and curate its own procedural memory.
The universal agent
Multi-platform presence
Works across Telegram, Discord, Slack, WhatsApp, Signal, and a full-featured terminal.
Parallel subagents
Spawns isolated subagents to parallelize workstreams and collapse multi-step pipelines.
Serverless persistence
Hibernates when idle and wakes on demand, to minimize cost on a low-end virtual private server or cloud virtual machine.
Supported models
OpenRouter (200+ models), Nous Portal, OpenAI, custom endpoints
Deployment backends
Local, Docker, SSH, Daytona, Singularity, Modal
Automation
Built-in cron scheduler for natural-language task delivery
Charter
Hermes Agent: the first agent hire of your security practice.
What Hermes Agent is chartered to do, what it verifiably does today, and what it cannot do yet. The last part is the one most agents leave out.
Measured today
Designed, not yet running
- Research that runs on a schedule, unattended.
- Turning finished work into named skills, published here.
- Sitting a certification exam, with the transcript shown.
What it found in the field
The feed, live.
Every item names the one thing worth learning because of it. An item nobody acts on drops off a week after its date; an item that becomes work is kept as the record of what it caused.
What the agent found is the owner’s to read. The argument for how it is bounded is on this page; the output it produced is not.
What it proposed for the library
The last batch. And what review did to it.
This is one real batch, dated. It is not a live pulse, and it does not refresh itself to look busy. When the agent proposes nothing, this stays exactly where it is.
What the agent brought
- Hugging Face security incident disclosure
SEF-03 · MDS-06
- CoSAI principles for secure-by-design agentic systems
AIS-11 · IAM-05 · SEF-07
- Cloud Security Alliance NIST AI Risk Management Framework agentic profile
GRC · LOG-03
- CISA, NSA and FBI joint AI data security guidance
DSP-01 · DSP-17 · DSP-20 · DSP-21
- MITRE ATLAS, agentic platform coverage
MDS-06 · TVM-10
What the gate caught
Every control anchor it proposed was checked against the control objectives. Three of the identifiers did not exist: they were not even valid domain prefixes. Review replaced them with the real controls, and only the corrected version counts.
That is the whole argument, on our own back office. The agent is useful because it proposes. It is trustworthy because it does not get the last word.
The full account
The case study walks one whole run: the four systems it worked across from a single chat window, the doors it could not open, and how we can show you why each one stayed shut.
See what it finds, once a week.
What the agent produces is the owner’s to read in full. What clears review reaches a public WhatsApp channel weekly. Join to see it.