US start-up Artemis Security has presented Orion-1, an AI model that investigates and defends against cyberattacks on corporate networks autonomously. According to The Decoder, the system combines scattered log data from login services, cloud environments, company computers, online software and the network to detect an attacker's activity. The model then commits to a result with a confidence score and recommends or starts a countermeasure.
What the model is meant to do
According to Artemis, Orion-1 links individual traces, such as a login to a company account, additional cloud access rights and a newly created mailbox rule, into the attack of a single actor. The company argues that general-purpose models lose the thread across billions of events or flag harmless but unusual activity as an attack. Orion-1 was therefore further trained on tasks from Artemis's own security operations, such as spotting suspicious events in log data, searching for known attack patterns, writing new detection rules and containing ongoing attacks. Artemis says customer data was not used for training.
The company's own benchmark
The results come from a benchmark Artemis developed itself, "Decision-Grade Readiness" (DGR). Each model receives the same initial alert, the same data and the same tools as a security team and must decide whether an attack is present. According to Artemis, only Orion-1 scores at or above the company's own threshold of 80 points in all five published tasks. The largest gap the company reports is in attack reconstruction: 80.8 points for Orion-1 versus 58.3 for GPT-6 Sol. Grok 4.7 and Kimi K3 were also tested.
Background
The background is that providers of general frontier models are increasingly restricting their cyber capabilities. According to The Decoder, strict protection filters block security analyses; Hugging Face, for example, switched to the open-weight model GLM 5.2 on its own servers because commercial models refused to analyze attack data. Providers rely on specialized models with restricted access for defense: OpenAI releases GPT-5.5-Cyber only to verified defenders, and Anthropic uses Claude Mythos 5 through the Claude Security scanner and partner products.
Assessment
Several limitations matter. The benchmark comes from the vendor itself and has not been independently verified. Mythos 5 and GPT-6 Astra are missing from the comparison, and for Claude Opus 5.5 the older Opus 4.8 may have answered for most of the test. It is also unclear whether Artemis used an existing model from another provider as a foundation. Orion-1 currently runs only in a private preview for selected customers; consequential interventions require human approval by default.
For security managers at mid-sized companies, such a specialized model could become relevant if the results are independently confirmed and it connects to existing log sources. Whether and under what terms Orion-1 will become available remains open.
Artemis emerged from stealth mode in April, announcing $70 million from its seed and Series A rounds, roughly six months after its founding.
Sources
Editorially owned by Ideal Syka. Sources and method: Newsroom & method. Tips and corrections: ai@i6eal.de.
