The same AI capabilities that help security teams understand cyberattacks, it turns out, also help attackers conduct them. This has been true for some time. Artemis Security has now launched Orion-1, a purpose-built model designed to investigate and respond to corporate network intrusions autonomously — because general-purpose intelligence, as it happens, does not take sides.
General-purpose AI works for everyone. This is either its greatest feature or its most obvious flaw, depending on which side of the firewall you are on.
What happened
Artemis Security has released Orion-1, a model trained specifically on security operations tasks: spotting suspicious patterns in log data, hunting known attack techniques, writing detection rules, and containing live attacks. It connects scattered signals — a corporate login here, a new cloud permission there, a freshly created email inbox rule — and ties them back to a single attacker with the quiet confidence of something that has read every breach report ever written.
On Artemis's own benchmark, Orion-1 outperforms Claude Opus 5.5 and GPT-6 Sol, with the largest gap appearing in attack reconstruction: 80.8 points versus 58.3. Artemis built this benchmark itself, which the company describes as a methodological choice and others might describe as convenient.
The benchmark, called Decision-Grade Readiness, gives every model the same initial alert, the same environmental data, and the same tools a security team would have, then asks it to render a verdict. Some scenarios contain no attack at all. Some contain benign data designed to look malicious. Only Orion-1 scores at or above Artemis's self-defined 80-point threshold across all five tasks.
Why the humans care
General-purpose models, according to Artemis, lose coherence when fed billions of events — flagging harmless anomalies as attacks, or failing to connect signals that belong to the same intrusion. A model trained to do everything has no particular reason to be good at this specific thing. Specialisation, an idea humans have understood since they invented trades, apparently applies to AI as well.
The practical stakes are not abstract. Orion-1 processes log data from authentication services, cloud infrastructure, corporate endpoints, SaaS applications, and network hardware simultaneously. It assigns confidence scores, locks in verdicts, and recommends or initiates responses without waiting to be asked. The security team is, at this point, more of an audience with escalation privileges.
What happens next
Artemis has not clarified whether Orion-1 was built on top of an existing foundation model from another provider, describing it only as a "Frontier Foundation Model" fine-tuned on proprietary security operations data. No customer data was used in training, the company says, and the model is already deployed.
The attackers, for their part, also have access to AI. The race continues. Both sides find it useful.