What's new
Expanded investigation guidance, findings that follow the verifier's assessment, clearer reports, and clearer waiting states in Hermes Chat and Assistant.
Updated
Recent Hunt Web updates expand the scanner's research guidance, connect verification decisions more closely to published findings, and improve the way evidence is explained in reports. The aim is to help agents follow promising leads further while avoiding conclusions that exceed the available proof. Hermes Chat and Assistant also provide clearer feedback while a reply is being prepared.
Research skills
Expanded guidance for Quick, Standard, and Deep investigations.
Practical benefit: Helps agents connect observations, hypotheses, comparisons, and useful next steps.
Candidate follow-up
More explicit guidance for handling missing evidence and alternative explanations.
Practical benefit: Keeps an unresolved question available for further investigation.
Independent verification
Structured assessment of the demonstrated claim, evidence, impact, and limitations.
Practical benefit: Aligns the saved finding with the verifier's accepted conclusion.
Reports
Clearer explanations across Dashboard, PDF, Markdown, and JSON.
Practical benefit: Helps security reviewers and developers understand and reproduce the issue.
Hermes Chat
Compact summaries for ordinary Run questions and clearer waiting states.
Practical benefit: Reduces unnecessary initial data loading while retaining access to detailed investigation.
Assistant
An animated thinking indicator with elapsed waiting time.
Practical benefit: Makes an active reply request easier to recognize.
1. Expanded Skills for Evidence-Led Investigation
The Quick, Standard, and Deep profile skills now include additional guidance for investigating application behavior. Existing reconnaissance, testing, chaining, and reporting material remains available.
The additions encourage the agent to connect five parts of an investigation:
- 1The observationWhat a request, Browser action, or other tool actually returned.
- 2The hypothesisWhich security boundary might be affected.
- 3The comparisonWhat normal or controlled behavior should look like.
- 4The next testWhich action could resolve the uncertainty.
- 5The outcomeWhat was demonstrated and what still needs investigation.
- The observation: what a request, Browser action, or other tool actually returned.
- The hypothesis: which security boundary might be affected.
- The comparison: what normal or controlled behavior should look like.
- The next test: which action could resolve the uncertainty.
- The outcome: what was demonstrated and what still needs investigation.
A checklist is a starting point
This makes a checklist a starting point for research. The next action should respond to the application's behavior, including related objects, parameters, operations, and workflow stages.
The research library still contains 569 skills across 39 categories, with 749 alternative lookup names. The separate Hermes Run-control skill brings the total to 570 skill documents. These updates expand existing guidance; they do not add another scanner team or require manually selecting hundreds of skills.
2. Deeper Follow-Up Without Blocking Exploration
A weak signal can be worth investigating before a complete proof exists. For example, a changed response, a newly discovered API operation, or an unexpected object identifier can lead to a useful hypothesis.
A missing result is a gap, not proof
The updated guidance distinguishes a disproved hypothesis from an unfinished investigation. If one explanation is disproved, related operations may still deserve testing. If a tool fails or an account prerequisite is unavailable, the missing evidence remains a gap rather than proof that the application is secure.
Agents are also instructed to use verifier feedback when deciding what to test next. A meaningful follow-up might establish object ownership, compare another operation, confirm a state change, or investigate a related permission boundary. Repeating the same failed request without a useful change does not add evidence.
A supported finding can still be submitted promptly. It does not need to wait for a longer attack chain, and a valid lower-severity issue remains eligible for reporting.
Quick
Prioritize useful leads and deepen a promising signal enough to establish evidence or a concrete next step.
Standard
Balance application coverage with comparisons and follow-up on unresolved behavior.
Deep
Explore relevant alternatives, stateful workflows, dependencies, and possible chains while retaining evidence for each claim.
The additions apply to research across Blackbox, Greybox Environment, and Greybox Browser. Each method continues to use its own access conditions and supported execution tools.
3. More Careful Interpretation of Security Signals
A signal suggests a test; it is not a conclusion
An HTTP status, reflected value, administrator label, exposed client key, or permissive-looking header can suggest a test. It does not independently establish every consequence claimed in a vulnerability report.
The research guidance now places more emphasis on checking whether data is populated, empty, masked, public, or owned by the account making the request. It also asks whether an operation actually crossed a permission boundary or changed application state.
Comparisons should fit the claim. Two accounts may be useful for testing private object access, while an execution claim may require evidence of the relevant execution behavior. The same additional test is not imposed on every vulnerability class.
Consider an illustrative document-sharing application:
- 1HTTP 200 returnedA response was returned; unauthorized access is still a hypothesis.
- 2Check content, ownership, sharingDistinguishes a private document from an empty response or public share.
- 3Comparable requestsPrivate content reaches an account that should not receive it.
- 4The verifier reproduces itThe finding can describe the specific access and impact demonstrated.
| Observation or test | What it establishes |
|---|---|
| Account A requests a document identifier associated with Account B and receives HTTP 200. | A response was returned; unauthorized document access is still a hypothesis. |
| The agent checks the response content, document ownership, and sharing settings. | It can distinguish a private document from an empty response, public share, or normal access. |
| Comparable requests demonstrate private content available to an account that should not receive it. | The candidate now has concrete evidence of an access-control failure. |
| The verifier independently reproduces the relevant behavior. | The accepted finding can describe the specific access and impact demonstrated. |
If the first request returns only a generic page, the agent can investigate relevant preview, download, or related API operations within the permitted Scope. The initial hypothesis does not need to be exaggerated to justify further research.
4. Findings Follow the Verifier's Assessment
Independent verification now records a structured assessment of the claim, its supporting evidence, the accepted report content, and useful follow-up work. The saved finding's title, classification, severity, description, and impact follow that assessment.
- 1The verifier assesses the claimA structured assessment.
- 2Evidence is weighedThe supporting evidence for that claim.
- 3Accepted report contentWhat the evidence actually supports.
- 4The saved finding followsTitle, classification, severity, description, and impact.
- 5Follow-up stays openBroader suspected consequences remain investigation questions.
A report describes what was demonstrated
For example, if the evidence demonstrates unauthorized access to a limited set of records, the report should describe that access. It should not also claim that passwords were stolen or that full system compromise occurred without evidence of those effects.
Broader suspected consequences can remain investigation questions. A narrower valid finding can be saved while those questions are pursued separately. CVSS scores are included when calculated and validated; an uncalculated score does not need to be invented to fill a report field.
Human review is still required
The update is intended to reduce unsupported conclusions and improve consistency. Automated verification still requires human review, and no universal false-positive reduction rate has been established.
5. Reports Written for Security Reviewers and Developers
Finding reports now have stronger writing guidance for explaining the issue to a person reviewing or fixing it. Internal evidence references remain available for traceability, while the main narrative explains what happened.
A useful finding should describe:
Affected area
The affected endpoint, parameter, feature, or workflow.
Conditions
The account conditions and other prerequisites.
Test and result
The tested input or action and the observed result.
Comparison
The relevant comparison and why the difference matters.
Impact and limits
The demonstrated impact and any remaining limitations.
Reproduction and fix
Clear reproduction steps, expected results, and remediation.
Where a PoC script is available, its instructions should explain any private values that the reviewer must supply. Exported reports can redact sensitive values, so a redacted example may require those values before reproduction. Missing details are not reconstructed or guessed.
The same accepted report fields support Dashboard, PDF, Markdown, and JSON. PDF and Markdown provide readable assessment documents. JSON retains structured fields and evidence references alongside descriptive text that can also be understood by a human reviewer.
Existing findings are not rewritten
Existing findings are not automatically rewritten or reassessed. A downloaded report still represents its saved assessment snapshot; a recent download time does not establish that the underlying findings were verified again.
6. Clearer Hermes Chat Responses and Waiting States
For ordinary questions about a Run, Hermes can begin with a compact summary of its saved state. Detailed evidence and investigation tools remain available when the question requires them. This reduces unnecessary initial data loading without shortening the scanner's investigation.
The conversation interface now distinguishes sending a message, waiting for Hermes to reply, and a delayed connection. An animated indicator and elapsed waiting time make ongoing work more visible. Reduced-motion preferences are respected.
- 1Sending a messageThe message is on its way.
- 2Waiting for HermesAn animated indicator and the elapsed waiting time make the work visible.
- 3A delayed connectionShown separately from waiting for a reply.
A reply is not a completed scan
A conversational reply and a completed scan remain separate events. A request to summarize findings reads saved information; an instruction to continue testing can activate the associated scanner work. Its progress and verified results remain visible through the Run.
Reply time still depends on the selected model, provider, requested work, and connection. The indicator describes waiting; it is not a fixed response time or a measure of scanning completion.
7. Smoother Feedback in Assistant
Assistant now displays Assistant is thinking immediately after a message is sent through the Send button or Enter. The indicator combines a subtle animated icon, moving dots, and elapsed waiting time.
The indicator clears when the reply operation finishes. It stays associated with the conversation that submitted the message, and its animations respect reduced-motion settings.
Assistant and Hermes stay separate
Assistant remains the space for general cybersecurity questions. Its model configuration and role are separate from Hermes, which connects conversation with a selected Run. The visual update does not change the selected model or the depth of scanner work.
8. Using the Updates in an Assessment
The existing Target → Scope → Run → Findings → Report workflow remains the starting point. Prepare access for the chosen testing method, select the appropriate profile and time setting, then review both accepted findings and unfinished checks.
- 1TargetAdd the application and choose the testing mode.
- 2ScopeSave the URLs and account access to test.
- 3RunPick a profile and follow the scan.
- 4FindingsReview verified issues and evidence.
- 5ReportRead the saved snapshot or export a PDF.
When a candidate needs more evidence, use its recorded gap to direct a useful follow-up. Resume and Hermes continuation retain the selected Run's saved context, while scope boundaries, account handling, Pause, and time policies remain controlled by Hunt Web.
For further detail, see Scanning Tools and Skill Library, Scanning Agents, Findings, Results, and Reports, and Hermes Chat and Templates.