The Pulse
Artemis Security launches Orion-1 for cyber defense
Artemis Security says its Orion-1 model scored 80.8 on attack reconstruction, compared with 58.3 for the best competing model in its Decision-Grade Readiness benchmark. The model is in private preview for selected customers and can recommen
AI.info Team · Written with AI ·
Orion-1 scored 80.8 on attack reconstruction, compared with 58.3 for the best competing model Artemis Security tested. The company says the task measures how well a model puts an attacker’s steps in chronological order. Artemis announced the cyber-defense model on October 8, saying it is designed to investigate suspicious activity across enterprise systems and recommend or trigger responses. The result comes from the company’s own Decision-Grade Readiness benchmark, not an independent evaluation described in the announcement.
Artemis frames the test around decisions defenders can act on
Artemis says the benchmark contains thousands of tasks based on scenarios with known outcomes. Models receive the same trigger, environment context, and scoped access to sources and actions, according to the release. Some scenarios contain no attack, or include benign activity that initially looks suspicious. The company says it scores both whether a model reaches the right conclusion and whether its evidence supports that conclusion.
Artemis tested Orion-1 against Claude Opus 5.5, GPT-6 Sol, Grok 4.7 and Kimi K3. It says Orion-1 scored at the top across all five tasks measured, though the announcement gives a specific head-to-head score only for attack reconstruction. The release does not provide the benchmark tasks, underlying results or an independent audit, leaving readers without enough detail to reproduce the comparison.
Orion-1 connects signals across enterprise systems
The model is intended to link activity that appears unrelated when examined one system at a time. Artemis’s example combines an Okta login, an AWS role assumption and a Google Workspace mailbox rule into a single account of one actor’s activity. The system is designed to start investigating from an initial signal, change approach when one line of inquiry stalls, and state its confidence in a decision.
Artemis says it drew training scenarios from millions of defensive operations across investigations, detection engineering, threat hunting, remediation, attack-surface reduction and incident response. The company says it did not use customer data to train Orion-1. Dan Shiebler, Artemis Security’s CTO, said: “A real attack is one actor leaving small traces across many systems, none of them alarming on its own.”
Customers set how much Orion-1 can do on its own
Orion-1 is available through the Artemis platform in private preview for selected customers. Artemis says organizations can set autonomy by action type, ranging from recommendations only to fully automated responses. High-impact responses require human approval by default, and the company says investigations and actions are logged and auditable.
The controls matter because the model is meant to move from interpreting evidence to initiating a response, where a mistaken judgment could interrupt legitimate work. Shachar Hirshberg, Artemis Security’s CEO, described the company’s aim as building defense that “runs at the attacker’s tempo.” For now, access remains limited to selected customers; Artemis has not given a date for broader availability.