Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsArtemis Security announced Orion-1 on October 8, 2026. It is a cyber defense foundation model that runs inside the company’s security operations platform. Artemis says the model investigates signals across enterprise systems, assembles an account of what happened, and can recommend or trigger responses within limits each customer sets. At launch it was available only to selected customers in private preview. Its headline attack-reconstruction result is a company-reported figure that independent coverage has not verified.
What Orion-1 is
Orion-1 is built for defensive security work rather than as a general-purpose chat assistant. According to Artemis, its post-training drew on detection, threat hunting, detection generation, investigation, and incident response, and customer data was not used in that training. The model is positioned as a component of Artemis’s platform, so it operates on the telemetry and tools that platform can reach rather than on a free-standing prompt.
As an Amazon Associate I earn from qualifying purchases.
Artemis says Orion-1 can read security logs from identity, cloud, endpoint, SaaS, network, and AI systems. The core claim is that it can combine signals that look unremarkable on their own into one connected incident narrative. The company’s CTO, Dan Shiebler, put the premise this way: “A real attack is one actor leaving small traces across many systems, none of them alarming on its own.” The product is designed around that gap between isolated alerts and a coherent story.
How Artemis says it reconstructs an attack
Artemis describes four working behaviors. These are the company’s description of intended behavior, not independent performance findings.
#1 Best Overall
- Start from an initial signal and widen the context. The model begins with one alert or anomaly and gathers related context across the stack.
- Combine evidence across systems. It links events from different sources that would not be flagged individually.
- Change approach when a line of inquiry stalls. If one hypothesis runs out of evidence, Artemis says the model switches to a different investigative path.
- Commit to a decision with stated confidence. The output is a recommendation or response, executed only within the autonomy the customer has configured.
Dan Shiebler described the training goal as composing those traces “into one story, commit to a decision, and carry it through to resolution.” The practical test for a tool like this is whether the story it produces is checkable against the underlying logs, which is why the evidence and confidence requirements covered below matter as much as the headline result.
The benchmark behind the 80.8 figure
Artemis created an evaluation it calls Decision-Grade Readiness (DGR). The company describes it as a test of whether a security decision is trustworthy enough for a senior security engineer to act on. Artemis says DGR contains thousands of tasks built from scenarios with known outcomes. Every model receives the same trigger, the same environment context, and scoped access to the same sources and actions.
According to Artemis, the evaluation includes benign activity that can look malicious and scenarios that contain no attack at all. It scores both correctness and whether the evidence supports the conclusion reached. A model that reaches the right answer on weak evidence does not get full credit under this design, at least as Artemis describes it.
Reported attack-reconstruction result
In its October 8, 2026 release, Artemis says Orion-1 was compared with Claude Opus 5.5, GPT-6 Sol, Grok 4.7, and Kimi K3, and that no tested frontier model scored higher across its measured tasks. The largest reported gap was on attack reconstruction:
| Model | Attack-reconstruction score (Artemis-reported) | Source status |
|---|---|---|
| Orion-1 | 80.8 | Vendor-reported; not independently verified |
| Best other frontier model tested | 58.3 | Vendor-reported; the model is not named in the reported figure |
The scale of the scoring, the number of tasks in this category, and the exact scoring rubric are not stated in the launch materials available to us, so the two numbers cannot be interpreted or reproduced from the release alone. Individual scores for Claude Opus 5.5, GPT-6 Sol, Grok 4.7, and Kimi K3 are not broken out in the reported figures.
What independent coverage says is still open
Unite.AI characterizes the 80.8 figure as vendor-reported and not independently verified. It flags several open questions that a buyer should understand before treating the gap as a meaningful lead:
Rank #3
- How the tasks were composed, and whether they resemble the environments a given customer runs.
- How responses were scored.
- How much results vary across repeated runs.
- The model configurations used for each competitor.
- How the models perform in environments they have not seen before.
Read as a company claim, the result tells you that Artemis believes Orion-1 leads on this internal test. It does not establish how Orion-1 would perform against your own logs, tooling, or attack patterns. For that, Unite.AI’s launch coverage is a useful independent summary of what remains unverified, and Artemis’s own launch release shows exactly which claims the company makes.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Other figures Artemis published
The launch release includes two threat-landscape statistics. Both are attributed to Artemis Security Research and should be read as figures from the environments Artemis defends, not as market-wide measurements.
268% increase in suspicious and malicious AI-enhanced activity
Artemis reports a 268% rise in suspicious and malicious AI-enhanced activity between April and August 2026, measured across environments it defends. The release does not publish the underlying data or the method used to count activity, so the figure cannot be checked from the release itself.
92% of confirmed attacks caught at the point of entry
Artemis says 92% of confirmed attacks across those same environments were caught at the point of entry, using detections tuned to each environment. This is a claim about Artemis’s customer base and detection approach, not an industry-wide detection rate, and the release does not say how many attacks were in the sample.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Controls, approvals, and audit
Artemis says every Orion-1 decision includes the evidence behind it and a stated confidence level. Customers set autonomy by action type, running from recommend-only to fully automated. High-impact responses require human approval by default, and the company says investigations and actions are logged and auditable end to end.
Those are defaults and design commitments in the vendor’s materials. Before relying on them, confirm the following in your own deployment:
Best Value
- Which actions the platform classifies as high-impact, and whether that list matches your change-control rules.
- Whether approval requests reach a named person, and what happens when no one responds.
- Where the audit records are stored, how long they are retained, and whether they can be exported to your SIEM or evidence store.
- Whether the evidence attached to each decision is sufficient for an analyst to re-check the conclusion without re-running the investigation.
Availability and pricing
At announcement, Orion-1 was available in private preview to selected Artemis customers. Broader availability is planned, but the launch materials give no general-release date. Pricing was not stated. If you are evaluating it, the practical route is to ask Artemis for preview access directly through its company announcement and then test it against your own historical incidents.
How to judge the claim for your own team
The most useful test is not the leaderboard number. Replay a set of past incidents, including ones your team closed without a clear root cause, and compare the reconstructed timeline with what your analysts actually established. Include benign activity that looks suspicious, because Artemis says its own evaluation does, and check whether the model’s confidence tracks its accuracy. If it does, the autonomy settings can be widened gradually. If it does not, keep the model in recommend-only mode.
Dan Shiebler’s phrase “compose those traces into one story” describes the ambition. Shachar Hirshberg, Artemis’s CEO, framed the standard as “can I trust this enough to act on it.” That is the question your own replay should answer, using your data rather than the company’s benchmark.
The launch announcement is a vendor claim with a specific, testable shape. The attack-reconstruction gap is large enough to justify a pilot, but the company has not published enough detail for anyone outside Artemis to confirm it.
Source links: Artemis Security, Introducing Orion-1, the leading frontier model for cyber defense (company announcement, October 8, 2026); Artemis Security via PR Newswire, Artemis Security Unveils Orion-1, a Frontier Foundation Model for Cyber Defense (launch release, October 8, 2026); Unite.AI, Artemis Unveils Orion-1, a Cyber Defense Model Built to Reconstruct Attacks (independent coverage, October 8, 2026).
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
