Artemis Security launches Orion-1, a security-only model, claiming 80.8 vs 58.3 on its own benchmark

Artemis Security has launched Orion-1, a purpose-built model that investigates and responds to attacks on corporate networks. According to the company, it outperforms Claude Opus 5.5 and GPT-6 Sol on Artemis' own benchmark, scoring 80.8 on attack reconstruction against 58.3 for the next-best model. Orion-1 is in private preview for select customers on the Artemis platform.

What Orion-1 does

Orion-1 ingests log data from authentication services, cloud environments, corporate endpoints, SaaS apps and network gear. It correlates individual signals, such as a corporate account login, new cloud permissions and a newly created email inbox rule, and ties them to a single actor. It then assigns a confidence score, issues a verdict, and recommends or initiates a response.

Artemis claims general-purpose models lose track when fed billions of events, or flag harmless but unusual activity as attacks. The company says it fine-tuned Orion-1 on tasks from its own security operations: spotting suspicious log patterns, hunting known attack techniques, writing detection rules and containing live attacks. It says no customer data was used in training.

Artemis calls Orion-1 a "Frontier Foundation Model" but describes only the fine-tuning in its blog post. It has not said whether the model builds on another provider's base model. Parameter count, context window, training cutoff and pricing are not disclosed.

The benchmark: self-built and self-scored

The comparison uses Artemis' own "Decision-Grade Readiness" (DGR) benchmark. Each model gets the same initial alert, environmental data and tooling a security team would have, then must decide whether an attack is underway. The thousands of tasks have known outcomes. Some contain no attack, and others include benign data designed to look malicious. Scoring covers both the verdict and the supporting evidence.

• Orion-1 is the only model at or above Artemis' self-defined 80-point threshold across all five tasks.
• Attack reconstruction: Orion-1 scored 80.8; GPT-6 Sol, the best comparison model, scored 58.3.
• Also tested: Grok 4.7 and Kimi K3.

There are significant caveats. Artemis designed the benchmark and the 80-point threshold itself, and no independent replication exists. Claude Mythos 5 and GPT-6 Astra, the strongest models from Anthropic and OpenAI, were not included. Claude Opus 5.5 routes most cybersecurity tasks to the older Opus 4.8, so its results may largely reflect that model.

Deployment controls

Customers set limits per action type on how much Orion-1 can decide autonomously. High-impact actions require human approval by default. Artemis emerged from stealth in April, disclosing $70 million across seed and Series A rounds about six months after its founding.

Why the market exists

Frontier providers are restricting cyber capabilities. OpenAI considers Astra the first model that could reach its highest cybersecurity risk tier. In July, Hugging Face found that commercial frontier models' guardrails blocked analysis of data from a fully autonomous AI attack on its infrastructure. The team switched to the open-weight GLM 5.2 on its own servers. Providers now ship restricted defender models instead: OpenAI limits GPT-5.5-Cyber to verified defenders, and Anthropic runs Claude Mythos 5 through its Claude Security scanner and partner products.

What this means

The core issue is real: safety guardrails aimed at attackers also impede defenders, which creates room for specialized vendors. But Orion-1's headline numbers come from a vendor-built benchmark that omits the strongest rival models, so they show positioning more than proven superiority. The meaningful tests will be independent evaluation, disclosure of the base model and training approach, and false-positive rates in production. Until then, treat the 80.8 vs 58.3 gap as an unverified company claim.