Artemis Security

Introducing Orion-1, the leading frontier model for cyber defense. Orion-1 scored higher than every frontier model tested including Opus 5.5 and Sol 6. Artemis runs millions of defensive operations across enterprise environments. We post-trained Orion-1 for the type of defensive work Artemis runs every day: threat detection, threat hunting, investigation, and incident response. Orion-1 reads security data, works out whether it describes an attack, and backs that conclusion with evidence. To measure whether those conclusions can be trusted, we built Decision-Grade Readiness, a new benchmark that asks of every decision whether a senior security engineer would trust it enough to act on. On the first five tasks we measured (threat detection, investigation, attack reconstruction, threat hunting, and correlating activity), Orion-1 scored higher than every frontier model we tested. Orion-1 runs inside Artemis today, in private preview for a small number of customers, with broader availability to follow. We go deeper on how we trained Orion-1, the benchmark, and what comes next in our blog: https://lnkd.in/gFgKAC5q/?utm_campaign=Orion-1Launch&utm_source=linkedin&utm_medium=paid&utm_id=1220484686&hsa_acc=522780202&hsa_cam=1220484686&hsa_grp=910738546&hsa_ad=1640221366&hsa_net=linkedin&hsa_ver=3

Today, we are introducing Orion-1, the leading frontier model for cyber defense. Orion-1 scored higher than every frontier model we tested including Opus 5.5 and Sol 6. The evaluations were conducted on key tasks (threat detection, investigation, attack reconstruction, threat hunting, and activities correlation) and on Decision-Grade Readiness, a new benchmark we built to measure whether a models security decisions can be trusted enough to act on. Across the environments Artemis defends, suspicious and malicious AI-enhanced activity rose 312% between April and September 2026. These attacks run faster than any team can follow, cost little to scale, and adapt while they are happening. Closing that gap takes defense that runs at machine speed, with a model that does the manual work of security operations so teams can focus on judgment. Orion-1 reads logs across identity, cloud, endpoint, SaaS, network, and AI systems, works out whether they represent an attack, and backs that conclusion with evidence. Model access is available first in private preview to Artemis Security customers. If you are not a customer and want to see what it finds in your environment, my DMs are open. Full announcement in the comments.

Attack Story #5: 51X Over Baseline: catching the Exfiltration every Control Approved An authorized user pulled 63 confidential financial archives from corporate Google Workspace and pushed them to a personal Discord account within minutes, hitting three years of financial records in one sitting. The endpoint's data-loss controls inspected every file and allowed each one. Artemis measured the download against the account's own 30-day baseline at 51x, connected it to the upload as a single sequence, and identified the exfiltration the controls had approved. Full story in the first comment 👇

Attack Story #4: The Employee Who Was Never Here: A Fraudulent IT Worker’s Scripted Alibi A new remote IT hire's account signed into the corporate VPN hour after hour at exactly 26 seconds past the minute, while the operators actually working it sat in Belarus and Russia. His credentials were valid, his MFA factors checked out, and his exit IP looked residential, so every control waved him through. The identity provider saw a legitimate new employee and the reputation feeds saw a benign address, but neither saw the scripted alibi keeping a fake American at his desk for 18 days. Artemis read the facts together, joining two concurrent sessions 17 minutes apart across an ocean, cron-perfect login timing, and MFA factors that split cleanly by country, and confirmed in minutes what the manager had felt for weeks, deactivating an account that was never his to begin with. Full story in the first comment 👇

Attending Fal.Con? Book a meeting with our team, show up, and walk away with the internet's favorite hacking multi-tool, on us.

Excited to share that Anthropic just highlighted Artemis Security in their Claude Code Guide for Startups, a writeup on how the most AI-native companies operate. Artemis is the only cyber company featured in this list alongside a dozen of the world’s most AI-Native companies we admire including Cognition, Clay, ClickHouse, and Harvey. In the piece, we mention that everyone is racing to build AI products. Far fewer are rebuilding how their company actually runs. The second one is the much bigger unlock. Artemis runs as an AI-native company, not a company that happens to use AI. It's the reason we ship more than 5,000 PRs a week with a team a fraction the size of the incumbents. This allows us to deliver swiftly and reliably to protect F500 companies, Cursor, and many more enterprises, all to stop attacks at machine speed. Full guide in the comments.