The Machine-Speed Arms Race: Inside Artemis Security's Orion-1

NEW YORK, NY – October 08, 2026 — For the past decade, the cybersecurity industry has operated on a fundamental, unwritten assumption: machines find the anomalies, but humans make the decisions. Alerts are generated at the speed of light, but they are ultimately triaged, investigated, and remediated at the speed of a tired security analyst clicking through a dashboard. As of this morning, that paradigm is officially obsolete.

Today, Artemis Security unveiled Orion-1, a frontier foundation model engineered specifically for autonomous, machine-speed cyber defense. Unlike the wave of generative AI "copilots" that act as glorified chat interfaces for security operations centers, Orion-1 is designed to be an agentic defender. It investigates signals across disparate enterprise systems, calculates a confidence score, and—crucially—can execute automated remediation without human intervention.

The launch arrives at a critical inflection point in global digital infrastructure. According to new telemetry data from Artemis Security Research, suspicious and malicious AI-enhanced activity spiked by 268% between April and August of 2026. This data aligns with broader macroeconomic threat intelligence; major industry players have recently warned that the widespread adoption of offensive AI has compressed the cyberattack lifecycle from days to mere minutes. When attackers use automated, agentic models to discover vulnerabilities and generate malware on the fly, human-in-the-loop defense becomes a mathematical impossibility.

The End of the Human-in-the-Loop

The fundamental problem Orion-1 attempts to solve is one of tempo. Traditional defense wins when it operates within the specific context of the environment it protects, but building that context takes time. By the time a human analyst correlates a suspicious login with an abnormal data transfer, a machine-speed attack has already established persistence and exfiltrated the data.

"The industry has been asking AI to do what analysts do, and that's the wrong goal," said Shachar Hirshberg, CEO of Artemis Security. "The attacker moves at machine speed and the defender moves at human speed, and that gap is where breaches happen. You don't close it by making analysts faster. You close it by building defense that runs at the attacker's tempo."

To achieve this, Orion-1 was not trained on the broad, generic text datasets that power consumer-facing models. Instead, Artemis leveraged its operational record, training the model on millions of enterprise defensive workflows—investigations, threat hunts, and incident responses—without utilizing proprietary customer data. The resulting model is designed to mimic the investigative behaviors of a senior security engineer.

When a thread runs dry, Orion-1 is programmed to pivot its approach rather than simply narrating a dead end. It composes evidence across domains, recognizing that a seemingly benign login from Okta, an obscure role assumption in AWS, and a new mailbox rule in Google Workspace are not isolated events, but a single, coordinated narrative of an ongoing breach.

"I spent the past 15 years at the frontier of AI and cybersecurity. General-purpose models are strong reasoners, but they were never trained for this job," said Dan Shiebler, CTO of Artemis. "A real attack is one actor leaving small traces across many systems, none of them alarming on its own. Orion-1 was trained end to end to compose those traces into one story, commit to a decision, and carry it through to resolution."

Grading the AI Guard Dog: The Benchmark Dilemma

Proving that an AI can reason through a cyberattack is difficult; proving that it can be trusted to act on that reasoning is another entirely. The cybersecurity industry has historically evaluated AI using proxy tasks, such as multiple-choice questions based on the MITRE ATT&CK framework or controlled capture-the-flag puzzles.

Artemis argues these metrics are fundamentally flawed because they do not answer the only question that matters to a Chief Information Security Officer (CISO): Can I trust this model enough to let it touch my infrastructure?

In response, the company introduced the Decision-Grade Readiness (DGR) benchmark. DGR evaluates models using thousands of tasks drawn from real-world scenarios with known ground truths. Every model is tested under identical conditions, facing the same triggers and given scoped access to the same defender tools. Crucially, the benchmark includes benign data designed to look malicious, testing the model's resistance to false positives.

According to Artemis, Orion-1 outperformed four leading frontier models—Claude Opus 5.5, GPT-6 Sol, Grok 4.7, and Kimi K3—across all five measured tasks on the DGR benchmark. Its most significant victory was in attack reconstruction, where Orion-1 scored 80.8 compared to 58.3 for the next highest-performing model.

However, the introduction of a vendor-created benchmark naturally invites skepticism. While the performance metrics are impressive, DGR is not currently overseen by an independent body like MITRE Engenuity or an academic consortium. As one independent AI evaluation specialist noted under the condition of anonymity, "When a vendor writes the exam and controls the testing environment, it is hardly surprising that their proprietary model sets the curve. Until DGR is open-sourced and validated by third-party researchers, enterprise buyers will view these scores as marketing rather than gospel."

The Trust Boundary: Crossing the Autonomous Rubicon

Even if the benchmark scores hold up to independent scrutiny, Orion-1 faces a much larger systemic hurdle: enterprise risk tolerance. The technology to autonomously sever network connections, isolate endpoints, or modify identity access policies now exists, but the corporate appetite for granting AI that level of unilateral power remains virtually nonexistent.

The fear is not just that the AI will miss an attack, but that it will hallucinate a threat and take down critical business infrastructure in response. A false positive that results in an autonomous system shutting down a hospital's patient database or a financial institution's trading floor carries catastrophic liability.

Artemis is acutely aware of this friction. Orion-1 does not operate as a rogue agent; it functions strictly within the role-based guardrails of the Artemis platform. Customers maintain absolute control over the level of autonomy granted to the system, dialing it from "recommend-only" up to fully automated execution based on the specific action type. By default, high-impact responses require human approval, and every decision Orion-1 makes is shipped with its underlying evidence, a stated confidence score, and a fully auditable log.

"The technology is ready to pull the trigger, but our underwriters are not," explained a CISO at a Fortune 500 manufacturing firm currently evaluating agentic security models. "We love the idea of machine-speed investigation. We want the AI to do the heavy lifting of connecting the dots across our cloud and on-prem environments. But when it comes to actually killing a process or locking an account, we still need a human finger on the button. The liability of an AI-driven outage is simply too high."

During the current private preview phase, Artemis is working directly with select customers to set these autonomy thresholds, carefully matching the AI's operational leash to the organization's specific risk tolerance. It is a delicate balancing act between the urgent need for speed and the corporate mandate for safety.

As threat actors increasingly rely on agentic models to launch coordinated, hyper-fast campaigns, the transition to autonomous defense is no longer a matter of if, but when. Orion-1 proves that the cybersecurity industry is finally building weapons capable of fighting a machine-speed war. The remaining question is how long it will take for the humans in charge to actually let them fight.