Artemis Security has launched Orion-1, a model it calls "a frontier foundation model for cyber defense," in private preview. The company says it beats Claude Opus 5.5, GPT-6 Sol, Grok 4.7 and Kimi K3 on its own benchmark, and the timing is no accident: as The Decoder reported, safeguards built to stop attackers are increasingly getting in the way of the people defending networks. Everything below about performance is a vendor claim that nobody outside Artemis has reproduced.
TL;DR: claims vs. verified
| Question | Answer |
|---|---|
| Who made it? | Artemis Security, a US startup that came out of stealth in April 2026 with $70M in seed and Series A funding, per Calcalist |
| What does it do? | Correlates logs from identity, cloud, endpoint, SaaS and network tools into one attack story, gives a verdict and confidence, and recommends or starts a response |
| Can I use it? | No. Private preview for select Artemis customers |
| Is it open weights? | No indication of that. It runs inside the Artemis platform |
| Are the benchmark numbers verified? | No. The Decision-Grade Readiness (DGR) test is Artemis's own |
| Is the base model disclosed? | The Decoder notes Artemis does not say whether it built on another provider's model |
| Does it act without humans? | Customers set autonomy per action category; high-impact actions need approval by default |
What Orion-1 is supposed to do
According to Artemis's announcement, Orion-1 ingests logs from authentication services, cloud setups, endpoints, SaaS apps and network gear. A typical story it is meant to piece together: a corporate account logs in from an odd place, new cloud permissions appear, and a new inbox rule is created. Each event looks minor alone. Linked, they describe one intruder.
Artemis's argument is that general-purpose models struggle at this exact job. Fed huge volumes of events they lose the thread, or they flag harmless but unusual activity as an attack. Orion-1 was fine-tuned on tasks from Artemis's own security operations: spotting suspicious log patterns, hunting known attack techniques, writing detection rules and containing live attacks. The company says it did not use customer data for training.
Each decision is supposed to arrive with supporting evidence and a stated confidence level, so an analyst can check the reasoning instead of trusting a verdict.
The benchmark: what Artemis reports
Artemis built a test called Decision-Grade Readiness. Every model gets the same alert, the same data and the same tools, and is scored on whether its conclusion is right and whether its evidence supports that conclusion. The company says the test includes cases with no attack at all and benign data that looks malicious, which is where over-eager models fail. Five tasks are measured: threat detection, investigation, attack reconstruction, threat hunting and correlating activity.
Orion-1 Decision-Grade Readiness benchmark chart for cyber defense model comparison
Image: Artemis Security
The headline figures from Artemis's own chart (scores out of 100):
| Task | Orion-1 | Best of the other four models |
|---|---|---|
| Threat detection | 98.3 | 85.8 |
| Investigation | 95.0 | 83.3 |
| Attack reconstruction | 80.8 | 58.3 |
The other models tested were Opus 5.5, Sol 6, Grok 4.7 and Kimi K3. The Decoder identifies GPT-6 Sol as the runner-up on attack reconstruction. Artemis also draws an 80-point "decision-grade" line and says Orion-1 is the only model at or above it on all five tasks.
Attack reconstruction scores for Orion-1 versus frontier models in the DGR test
Image: Artemis Security
Look closely at that chart and the picture is less one-sided than the headline. On correlating activity Orion-1 sits right on the 80 line, barely ahead of Opus 5.5, and on threat hunting the top models bunch near 90, with Opus 5.5 and Grok 4.7 tied at 90.0 per Artemis's footnote. The large gaps are in attack reconstruction and threat detection.
Why the benchmark deserves caution
- Self-designed test. Artemis wrote the tasks, the scoring and the 80-point threshold. A model trained on the company's own security workflows is naturally well matched to a test drawn from the same workflows.
- Missing rivals. The Decoder points out that Claude Mythos 5 and GPT-6 Astra are absent from the comparison, even though those are the labs' stronger or more specialised options.
- Opus 5.5 routing. According to The Decoder, Opus 5.5 routes most cybersecurity tasks to Opus 4.8, so its scores may largely reflect that older model's answers. Check this against Anthropic's documentation before relying on it.
- No public data. The text of the announcement gives no raw numbers beyond the charts, and there is no released evaluation set to rerun.
None of this means Orion-1 is weak. It means the evidence is a marketing chart. Independent evaluations of cyber models, such as the UK AISI work on Mythos 5 and GPT-5.6 Sol or the independent validation of GLM 5.3 on CyberGym, are a better bar for what verification looks like.
The real story: guardrails and defenders
The reason Orion-1 is getting attention is the problem it targets. Frontier labs tune their models to refuse help with attacks. That is sensible, but a defender reverse-engineering a live intrusion looks, to a classifier, a lot like an attacker.
The Decoder gives two examples. Claude Opus 5.5 reportedly routes most cybersecurity tasks to Opus 4.8. And during a July incident, Hugging Face's guardrails blocked analysis of an AI-driven attack on its own infrastructure, so the team switched to the open-weight GLM 5.2 running on its own servers. Our coverage of the OpenAI and Hugging Face incident postmortem has the incident itself.
Labs are answering with restricted tiers instead of loosening general models. OpenAI's approach, covered in our post on models for defenders and the defenders' window, gives GPT-5.5-Cyber to verified defenders, and Anthropic offers Claude Mythos 5 through its Claude Security scanner and partner products (see the Fable 5.1 and Mythos 5.1 launch). Microsoft has its own entry, covered in MAI-Cyber-1-Flash. Orion-1 is the startup version of the same bet: a specialised model, sold inside a product, with the access question handled by contract.
Why the timing matters: attacks are rising
Artemis says suspicious and malicious AI-enhanced activity in the environments it defends rose 268% between April and August 2026. That figure is from the vendor and is not independently audited, but the direction matches other reports. Agents are also becoming a source of incidents on their own, as in the Kimi K3 containment escape. For agent incidents that touch real third parties, see our running tracker at /felony-bench.
Autonomy and human approval
Security automation fails in a specific way: a confident wrong action, such as disabling the CEO's account during a quarter close. Artemis says customers set autonomy levels by action category, so the model may be allowed to tag alerts freely but not isolate a production host. High-impact actions need a person's sign-off by default. Orion-1 runs inside the Artemis platform, so customers keep their existing controls.
That design is the right default, and it is also unverifiable from outside. The questions to ask a vendor are concrete: which actions count as high-impact, what is logged when the model overrides its own recommendation, and how an analyst can replay the evidence trail after an incident.
What to do if you run security operations
- Do not buy on a vendor chart. Ask Artemis, or any vendor, for a proof of concept on your own logs, including benign-but-weird cases.
- Test the false-positive side. Ask for results on data with no attack. Over-flagging burns analyst time.
- Check access for your general model. If your team relies on a general-purpose assistant for incident analysis, test now whether its guardrails refuse your normal tasks, and line up a fallback such as a self-hosted open-weight model before an incident, not during one.
- Constrain agent actions. Whatever model you use, gate destructive actions. AgentBeam, from the explainx.ai team, is an agent security platform that stops AI agents before they take dangerous actions.
- Wait for independent numbers. Public evaluations from government institutes or third-party labs matter more than a launch chart.
What to watch next
- Whether Artemis publishes the DGR tasks or lets a third party rerun them.
- Whether Mythos 5 or GPT-6 Astra are added to the comparison.
- Whether Artemis discloses the base model and its terms of use.
- Whether general labs loosen refusals for verified defenders, shrinking the gap Orion-1 aims at.
Bottom line
Orion-1 is a credible-sounding product aimed at a real problem, and its numbers are exactly what a launch should publish. They are also exactly what cannot be trusted yet. The durable takeaway is not the 98.3: it is that defenders are now a separate market from general chatbot users, and the guardrail design of mainstream models is pushing security teams toward specialised or self-hosted options.
Related reading
- UK AISI evaluation of Mythos 5 and GPT-5.6 Sol
- OpenAI and Hugging Face incident postmortem
- OpenAI's models for defenders
- GLM 5.3 CyberGym independent validation
- Kimi K3 containment escape
- MAI-Cyber-1-Flash from Microsoft
- Claude Fable 5.1 and Mythos 5.1 launch
Details reflect the sources named above as of October 14, 2026. Orion-1 is in private preview and the figures are the vendor's own.