Artemis Security Unveils Orion-1, a Frontier Foundation Model for Cyber Defense

On Decision-Grade Readiness, a new benchmark that measures whether an AI security decision can be trusted enough to act on, Orion-1 scored at the top for all five tasks measured, with no frontier model scoring higher across the benchmark.

NEW YORK, Oct. 8, 2026 /PRNewswire/ -- Today, Artemis Security unveiled Orion-1, a frontier foundation model trained to defend against the next generation of machine-speed attacks. Orion-1 works a threat the way a senior defender would: it starts from the first signal, investigates it across every system it touches, decides what happened with a stated confidence, and recommends or triggers the response within the autonomy the customer has set. Orion-1 is available today as part of the Artemis platform, in private preview for selected customers.

Orion-1 arrives as AI changes the economics of attack. New data from Artemis Security Research shows suspicious and malicious AI-enhanced activity up 268% between April and August 2026. These attacks run faster than any team can follow, cost almost nothing to scale, and adapt while they are happening. The same research shows what holds the line: 92% of confirmed attacks across the environments Artemis defends were caught at the point of entry, by detections tuned to each environment. Defense wins when it runs in the context of the environment it protects. Orion-1 was built to run that defense continuously, at the attacker's tempo.

Built for the next generation of attacks

Artemis has run millions of defensive operations across enterprise environments: investigations, detection engineering, threat hunts, remediation, attack surface reduction, and incident response. That operational record defined the scenarios Orion-1 was trained to master, without using customer data.

Post-training targeted four behaviors. Orion-1 starts working from the first signal and builds the picture across the stack as it goes. It composes evidence across domains, so a login from Okta, a role assumption in AWS, and a mailbox rule in Google Workspace read as one story about one actor. When a thread runs out, it changes approach instead of narrating the dead end. And it commits to a decision with a stated confidence, then carries that decision through to a recommended or triggered response within the autonomy the customer has set.

"I spent the past 15 years at the frontier of AI and cybersecurity. General-purpose models are strong reasoners, but they were never trained for this job," said Dan Shiebler, CTO of Artemis Security. "A real attack is one actor leaving small traces across many systems, none of them alarming on its own. Orion-1 was trained end to end to compose those traces into one story, commit to a decision, and carry it through to resolution."

Decision-Grade Readiness: measuring whether defense can be trusted

Security AI is mostly evaluated on proxy tasks: multiple-choice questions about MITRE, capture-the-flag puzzles, code vulnerability spotting. None of them tell a CISO whether a decision the model made can be trusted.

The Decision-Grade Readiness benchmark (DGR) asks one question of every defensive decision: would a senior security engineer trust this enough to act on it? Each of DGR's thousands of tasks is drawn from a scenario with a known ground truth outcome. Every model is evaluated under identical conditions: the same trigger, the same environment context available at the time, and scoped access to the same sources and actions a defender would have. Some test cases contain no attack at all, or benign data that looks malicious at first glance. Each decision is scored on whether the model reached the correct conclusion and whether the evidence it presented supports that conclusion.

Artemis tested Orion-1 against four frontier models: Claude Opus 5.5, GPT-6 Sol, Grok 4.7, and Kimi K3. Orion-1 scored on the frontier of every task. Its largest lead was on attack reconstruction, putting an attacker's steps in the order they happened, where Orion-1 scored 80.8 against 58.3 for the best frontier model tested.

"The industry has been asking AI to do what analysts do, and that's the wrong goal," said Shachar Hirshberg, CEO of Artemis Security. "The attacker moves at machine speed and the defender moves at human speed, and that gap is where breaches happen. You don't close it by making analysts faster. You close it by building defense that runs at the attacker's tempo. Orion-1 is that model. It was trained for the defensive work our platform does every day, and it is judged by the standard our customers already hold us to: can I trust this enough to act on it."

Autonomy the customer controls

Orion-1 operates inside the guardrails of the Artemis platform. Every decision ships with its evidence and a stated confidence. Customers set the level of autonomy per action type, from recommend-only to fully automated, and high impact responses require human approval by default. Every investigation and every action is logged and auditable end to end. During the private preview, Artemis works directly with each customer to set autonomy thresholds that match their risk tolerance.

Availability

Orion-1 is live today in private preview for selected Artemis customers, with broader availability to follow. Organizations can request access at artemissecurity.com.

Attackers operate at machine speed. Now defenders can too.

About Artemis Security

Artemis Security is an agentic security operations platform trusted by Cursor and F500 companies to detect, investigate, and contain attacks at machine speed. Artemis connects evidence across endpoint, identity, code, cloud, and SaaS into a single high-confidence case for every incident, generates detections tuned to each customer's environment, and responds the moment an attack starts, with no new agents to deploy and no data to move. Artemis is built on AWS and runs in customer-dedicated environments. Learn more at artemissecurity.com.

Media contact:
Danielle Ostrovsky
[email protected]

SOURCE Artemis Security