Orion-1: Artemis Security Builds an AI Model for Defenders
Security teams have a frontier model problem. The same skills that make a model useful for investigating an intrusion also make it useful for running one, so providers keep tightening the guardrails. Defenders increasingly get caught behind them.
US startup Artemis Security thinks a purpose-built model is the answer. Its new release, Orion-1, is designed to investigate and respond to attacks on corporate networks on its own. On the company's own benchmark, it beats Claude Opus 5.5 and GPT-6 Sol.
What Orion-1 actually does
Orion-1 works through log data from the systems a typical company runs:
- authentication services
- cloud setups
- corporate endpoints
- SaaS applications
- network equipment
The model's job is to connect signals that look harmless in isolation. Artemis gives this example: a login to a corporate account, new permissions in a cloud environment, and a freshly created inbox rule in an email account. Orion-1 links them and attributes all three to one attacker.
Once it has reconstructed what happened, the model assigns a confidence score, settles on a verdict, and then either recommends a response or starts one.
According to Artemis, general-purpose models struggle with this kind of work in two ways. They lose the thread when fed billions of events, or they treat unusual but benign activity as an attack.
How it was trained
Artemis fine-tuned Orion-1 on tasks taken from its own security operations. These include finding suspicious patterns in logs, hunting for known attack techniques, writing new detection rules, and containing live attacks. The company says no customer data went into training.
Artemis calls Orion-1 a "Frontier Foundation Model." Its blog post, however, only describes the fine-tuning. It doesn't say whether the model is built on top of an existing model from another provider.
A benchmark built around decisions
To compare models, Artemis created its own test, called "Decision-Grade Readiness" (DGR). Most existing security benchmarks quiz models on attack techniques or give them hacking puzzles. DGR works differently. Every model gets the same initial alert, the same environmental data, and the same tools a human security team would have. It then has to decide whether an attack is actually underway.
The benchmark contains thousands of tasks with known outcomes. Some contain no attack at all, and some include benign data built to look malicious. Models are graded on both their verdict and the evidence behind it.
Artemis reports results across five tasks. Besides Opus 5.5 and GPT-6 Sol, it tested Grok 4.7 and Kimi K3. The widest margin came in attack reconstruction, where Orion-1 scored 80.8 against 58.3 for the next-best model.
These are vendor-run numbers on a vendor-built benchmark, and they should be read that way.
Availability and controls
Orion-1 is available in a private preview for selected customers on the Artemis platform. Customers set limits for each type of action, which defines how much the model may decide without a human. By default, high-impact actions require human approval.
Artemis is young. It came out of stealth in April and disclosed $70 million across seed and Series A rounds, roughly six months after it was founded.
Why defenders are hitting walls
The bigger story is the friction security teams face with general-purpose models.
OpenAI considers its Astra model the first that could reach its highest cybersecurity risk tier. That tier covers a model that could develop and carry out cyberattacks on its own. Claude Opus 5.5 hands most cybersecurity tasks off to the older Opus 4.8.
Hugging Face ran into the problem directly. In July, it tried to analyze a fully autonomous AI attack on its own infrastructure using commercial frontier models. The guardrails blocked analysis of the attack data entirely. The team switched to the open-weight model GLM 5.2, running on its own servers.
Providers are responding with specialized, access-controlled models for defenders. OpenAI only gives the less restricted GPT-5.5-Cyber to verified defenders. Anthropic takes a similar route with its cyber verification program. It runs its strongest model, Claude Mythos 5, through the Claude Security scanner and partner security products.
This matters for reading Artemis's results. Neither Mythos 5 nor GPT-6 Astra appears in the Orion-1 comparison. And because Opus 5.5 routes cyber tasks to Opus 4.8, the Opus 5.5 scores may largely reflect the older model's answers.
Our Take
The Hugging Face episode suggests that refusal-heavy guardrails can fail the very people they are meant to protect. A team analyzing an attack on its own systems had to fall back on a self-hosted open-weight model. That points toward a split market: tightly gated frontier models on one side, and specialized or self-hosted tools for defenders on the other.
Orion-1 fits that pattern, but the evidence is thin so far. The benchmark is Artemis's own. The strongest restricted models are missing from the comparison. The model's origins are unclear. Independent testing against Mythos 5 or GPT-6 Astra would say far more than the current numbers.
The design choices look sensible. Per-action autonomy limits and default human approval for high-impact steps match a broader industry move toward training AI to attack and defend under explicit controls. It is worth watching whether customers in the preview actually let Orion-1 act, or keep it in an advisory role.