Artemis Security launches Orion-1 for automated attack investigation and response

Orion-1 targets hands off network defense

US startup Artemis Security has launched Orion-1, a model designed to investigate and respond to attacks on corporate networks on its own. On the company's benchmark, it beat Claude Opus 5.5 and GPT-6 Sol.

Orion-1 processes log data from auth services, cloud setups, corporate endpoints, SaaS apps and network gear, then connects signals such as a corporate account login, new cloud permissions and a newly created email inbox rule to one attacker. After forming a picture of the incident, it assigns a confidence score, locks in a verdict and recommends or kicks off a response.

Artemis says general purpose models can lose track when fed billions of events or flag harmless but odd activity as an attack. Orion-1 was fine tuned on tasks from its own security operations, including spotting suspicious log patterns, hunting known attack techniques, writing new detection rules and containing live attacks. The company says no customer data was used in training. Artemis calls Orion-1 a Frontier Foundation Model, but only describes the fine tuning and it is unclear whether it built on top of another provider's model.

Benchmark centers on decision readiness

Artemis built a benchmark called Decision-Grade Readiness, or DGR. Most existing security tests ask models about attack techniques or have them solve hacking puzzles, while DGR gives every model the same initial alert, the same environmental data and the same tools a security team would have, then asks it to decide whether an attack is underway.

The thousands of tasks have known outcomes. Some contain no attack at all, and some include benign data designed to look malicious. Models are scored on both their verdict and the evidence they present. Only Orion-1 reached or passed Artemis's own 80 point threshold across all five tasks.

Artemis also tested Grok 4.7 and Kimi K3 alongside Opus 5.5 and GPT-6 Sol. The largest gap appeared in attack reconstruction, where Orion-1 scored 80.8 and the next best model reached 58.3; the image caption identifies GPT-6 Sol as the best comparison model at 58.3.

Guardrails are narrowing defense choices

Broad frontier models are getting harder for security teams to use because providers keep locking down their cyber capabilities. OpenAI considers its Astra model the first that could reach the highest cybersecurity risk tier, where a model could develop and run cyberattacks on its own. Claude Opus 5.5 routes most cybersecurity tasks to the older Opus 4.8, and when Hugging Face tried in July to analyze a fully autonomous AI attack on its own infrastructure using commercial frontier models, their guardrails blocked the analysis of the attack data entirely. The team ended up switching to the open weight model GLM 5.2 running on its own servers.

For defense, providers are shipping specialized models with restricted access. OpenAI only hands out the less restricted GPT-5.5-Cyber to verified defenders, and Anthropic runs Claude Mythos 5 through the Claude Security scanner and partner security products. Mythos 5 and OpenAI's strongest model, GPT-6 Astra, are missing from the Orion-1 comparison, and with Opus 5.5 the benchmark results may largely reflect answers from the older Opus 4.8.

Availability

Orion-1 is live in a private preview for select customers on the Artemis platform, where customers set limits per action type on how much the model can decide on its own. High impact actions need human approval by default. Artemis came out of stealth in April and disclosed $70 million from seed and Series A rounds about six months after the company was founded.

Sources: The Decoder