Artemis Security has introduced Orion-1, a model designed to reconstruct attacks from logs spread across identity systems, cloud services, endpoints, software tools and network equipment. It can assign a confidence score, reach a verdict and recommend or initiate a response.
The company fine-tuned the model on work from its own security operations, including threat hunting, detection-rule creation and containment. Artemis says no customer data was used for training, but has not disclosed whether Orion-1 is built on another provider’s base model.
On Artemis’s Decision-Grade Readiness benchmark, Orion-1 was the only tested system to reach the company’s 80-point threshold across all five task types. Its attack-reconstruction score was 80.8, compared with 58.3 for the next model. Those results need caution: Artemis created the benchmark, and the comparison omitted the strongest restricted cyber models from OpenAI and Anthropic. Claude Opus 5.5 may also have routed some requests to an older model because of provider safeguards.
Orion-1 is available only in private preview to selected Artemis customers. Administrators can set how much autonomy it receives for each action, and high-impact responses require human approval by default. The product addresses a real problem for defenders when general models refuse legitimate analysis, but independent testing is still needed to establish how reliably it separates attacks from unusual but harmless activity.