AI safety filters often cannot distinguish an authorized penetration test from an attack in progress. Exploit reproduction, malware analysis and requests to “fix this code” use the same language and artifacts that attackers use, so general-purpose models may refuse legitimate defensive work. Artemis Security’s Orion-1 is a specialist cyber-defense model designed to investigate incidents across an organization’s systems and help defenders act on the evidence.
Why a legitimate security question can trigger a refusal
Cybersecurity is inherently dual-use. A defender may need to reproduce an exploit to confirm that a patch works, inspect malicious code to understand an intrusion, or generate a detection rule from an attack technique. The resulting prompt can look almost identical to a request for instructions to break into a system.
As an Amazon Associate I earn from qualifying purchases.
Chris Anley, chief scientist at NCC Group, described the problem this way: “This is where the whole offensive versus defensive and guardrails part comes in, because ‘fix this code’ as a prompt is both an essential mechanism for defense but also a roadmap for finding critical vulnerabilities in the code base.” He added that the same tool can be both offensive and defensive, and “the two can’t really be unpicked.”
TechCrunch reported that researchers encounter refusals and inconsistent behavior on these tasks. Chris Thompson, CEO of RemoteThreat and founder of Offensive AI Con, said, “I think the practical impact is you spend a lot of time negotiating with the model instead of working on the core security program.” Some practitioners respond by moving sensitive work to local, open-weight models, accepting the operational and maintenance burden that comes with self-hosting.
#1 Best Overall
Why the conflict is difficult to solve with a simple policy change
A model cannot reliably infer authorization from text alone. “I own this system” may be true, false or impossible for the model to verify. Allowing detailed exploit assistance could help a penetration tester and an intruder alike, while blocking it can prevent a team from validating a critical fix.
A 2026 position paper by Terry Yue Zhuo, Yangruibo Ding, Wenbo Guo and Ruijie Meng argues that AI agents can automate vulnerability discovery and exploitation. It also warns that adaptive adversaries may bypass output-only guardrails. The authors recommend developing offensive capabilities in audited cyber ranges and distilling the resulting knowledge into safer defensive agents. That approach separates controlled attack simulation from production assistance instead of assuming one universal refusal rule can handle both.
What Orion-1 is
Artemis Security describes Orion-1 as a frontier foundation model for cyber defense, running inside the Artemis platform. It is intended to read and correlate telemetry from identity, cloud, endpoint, SaaS, network and AI systems. Its stated jobs include investigating incidents, reconstructing attacks, hunting threats, generating detections and supporting response decisions.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #2
Artemis says the model was post-trained on defensive operations, including threat detection, threat hunting, detection generation, investigation and incident response, without using customer data for that training. The intended workflow starts with the first signal, composes evidence across domains, changes investigative direction when one line of inquiry ends, reports confidence and carries a decision into a recommended or triggered response subject to customer-defined autonomy.
Dan Shiebler, Artemis’s chief technology officer, summarized the design goal as follows: “A real attack is one actor leaving small traces across many systems, none of them alarming on its own. Orion-1 was trained end to end to compose those traces into one story, commit to a decision, and carry it through to resolution.”
What Artemis says the model can improve
Artemis reports that suspicious and malicious AI-enhanced activity rose 268% between April and August 2026. That is a vendor-published observation, not an independent industry measurement. Artemis also says 92% of confirmed attacks across the environments it defends were caught at the point of entry; this figure is likewise limited to the environments covered by the company’s own service.
Rank #3
To evaluate whether an output is actionable rather than merely plausible, Artemis created its Decision-Grade Readiness (DGR) benchmark. The benchmark uses thousands of scenarios with known outcomes, gives each model identical triggers and context, and includes benign cases that resemble attacks. It asks whether a senior security engineer would trust the decision enough to act.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute| DGR result reported by Artemis | Orion-1 | Best frontier model tested |
|---|---|---|
| Attack reconstruction | 80.8 | 58.3 |
| Other four measured tasks | Reported above the frontier models Artemis tested | Lower than Orion-1 in Artemis’s comparison |
These scores and the claim of leading on all five measured tasks come from Artemis. No independent replication or standardized industry-wide DGR result has been published, so the figures should be read as vendor benchmark results rather than proof of superiority in every environment.
How Orion-1 is intended to operate safely
Specialization does not remove the need for access controls. Artemis says each decision includes supporting evidence and a stated confidence level. Customers can configure autonomy by action type, while high-impact actions require human approval by default. Investigations and actions are logged for audit.
Rank #4
- Evidence with the decision: Analysts can review the signals that led to a conclusion instead of receiving an unexplained label.
- Action-level autonomy: Routine recommendations and higher-risk changes can have different approval requirements.
- Human approval for high-impact actions: The default is not unrestricted automated remediation.
- Audit logs: Investigations and resulting actions are recorded for review and compliance.
Those controls matter because a model that can connect events across many systems can also amplify a mistaken assumption. Confidence reporting is useful only when teams treat it as a prompt to inspect evidence, not as a guarantee.
General-purpose guarded models versus a specialist defense model
| Decision factor | General-purpose guarded model | Specialist cyber-defense model such as Orion-1 |
|---|---|---|
| Dual-use defensive tasks | May refuse exploit verification, malware analysis or remediation prompts that resemble offensive requests. | Designed and post-trained around authorized defensive investigations, subject to platform controls. |
| Cross-domain correlation | Usually requires the user to collect, normalize and provide the relevant context. | Artemis says Orion-1 correlates identity, cloud, endpoint, SaaS, network and AI-system evidence inside its platform. |
| Explainability and audit | Depends on the product’s logging and enterprise controls. | Artemis says every decision includes evidence and confidence, with investigations and actions logged. |
| Automation controls | Varies by product and integration. | Artemis says autonomy is configurable by action type and high-impact actions require approval by default. |
| Deployment and data sovereignty | Hosted services may impose data-handling and refusal-policy constraints; local models offer more control but require operations expertise. | Runs inside the Artemis platform; public details about alternative deployment modes were not stated. |
| Validation | Public evaluations vary widely in task design and independence. | DGR results are reported by Artemis and have not been independently replicated. |
Can Orion-1 investigate attacks automatically?
It is designed to automate parts of investigation and response, but “automatically” does not mean every action runs without a person. Artemis says the system can move from an initial signal through evidence gathering, attack reconstruction and a recommended or triggered response within customer-set autonomy. High-impact actions require human approval by default, so the practical level of automation depends on how an organization configures each action type and integrates its systems.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →The model’s proposed advantage is speed and continuity: an investigation does not have to stop when evidence crosses from an identity system into a cloud workload, endpoint, SaaS application or AI service. That cross-domain view is also where data quality, permissions and logging coverage become decisive. Missing telemetry can produce an incomplete story regardless of the model used.
Availability, pricing and open questions
Orion-1 was in private preview for selected Artemis customers on October 8, 2026. Artemis said broader availability would follow, but did not publish a general-access date. Public pricing was not stated.
Organizations evaluating a specialist model should ask for evidence beyond a headline score:
- Which telemetry sources are supported, and how much historical data can an investigation use?
- Can every automated action be restricted, approved and reversed by policy?
- What evidence, confidence details and audit records are retained?
- How are benign look-alike cases measured, not just confirmed attacks?
- Has an independent party reproduced the benchmark results?
- Where is customer data processed, and what deployment options exist?
Shachar Hirshberg, Artemis’s chief executive, frames the urgency as a speed mismatch: “The attacker moves at machine speed and the defender moves at human speed, and that gap is where breaches happen.” Orion-1’s proposition is to narrow that gap without discarding human oversight. For now, it is a private-preview enterprise platform with vendor-reported results, not a broadly available replacement for analysts, authorization controls or independent testing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
