Orion-1 cybersecurity model outperforms Claude Opus 5.5, GPT-6 Sol

Artemis Security has introduced Orion-1, a frontier model trained specifically to investigate and respond to attacks on corporate networks. The startup, which emerged from stealth in April 2026 after raising $70 million across seed and Series A rounds, positions Orion-1 as a specialized alternative to general-purpose models that security teams struggle to use for defense work.

What changed

On October 8, 2026, Artemis Security unveiled Orion-1, a frontier foundation model built through post-training on defensive operations the company runs daily across enterprise environments. The model reads security logs from identity systems, cloud infrastructure, endpoints, SaaS applications, networks, and AI systems to identify threats, correlate activity across domains, assign confidence scores, and recommend or execute countermeasures within guardrails set by each customer.

According to the announcement, Orion-1 outperforms Claude Opus 5.5 and GPT-6 Sol on five measured tasks: threat detection, investigation, attack reconstruction, threat hunting, and activity correlation. The company reports the largest performance gap in attack reconstruction, where Orion-1 scored 80.8 points compared to 58.3 for the next-best model. Artemis tested Grok 4.7 and Kimi K3 on its benchmark as well.

Artemis developed its own measurement framework called Decision-Grade Readiness to assess whether a model’s security decisions can be trusted enough for human operators to act on. Instead of using multiple-choice questions about attack frameworks or capture-the-flag puzzles, DGR presents all tested models with identical scenarios drawn from real outcomes, the same contextual data a security team would have, and scores both the correctness of each decision and the quality of evidence presented. Some test scenarios contain no attack at all or include benign activity designed to appear malicious.

The company post-trained Orion-1 on defensive work across threat detection, threat hunting, detection generation, investigation, and incident response. According to Artemis, no customer data was used during training. The post-training targeted four specific behaviors: working from the first signal and building a picture across the stack, composing evidence across domains so a login from one system, a role assumption in another, and an email rule in a third read as one story about one actor, changing approach when a thread runs out instead of narrating a dead end, and committing to a decision with stated confidence before carrying that decision through to a response.

Orion-1 is now available in private preview to select Artemis customers running on the Artemis platform. Customers can set autonomy limits per action type, with high-impact decisions requiring human approval by default.

Why it matters

General-purpose models are creating problems for security teams. As frontier models gain defensive capabilities that could help security analysts, AI safety teams at model providers are restricting those same capabilities to prevent attackers from using them. OpenAI routes most cybersecurity tasks in Claude Opus 5.5 to the older Opus 4.8 model. When Hugging Face attempted to analyze an AI-driven attack on its own infrastructure in July 2026 using commercial frontier models, guardrails blocked the analysis entirely, forcing the team to use an open-weight model running on private servers.

Simultaneously, the pace and scale of attacks are accelerating. According to Artemis, suspicious and malicious AI-enhanced activity rose 268 percent between April and August 2026 across the environments the company defends. The announcement states that general-purpose models lose coherence when processing billions of events and often flag benign but unusual activity as threats or miss genuine attacks buried in noise.

A purpose-built model like Orion-1 addresses both constraints. It is trained specifically to compose evidence across disconnected log sources, trace individual signals back to a single attacker, and make decisions security teams can act on without constant human review. For organizations with large security teams or high alert volumes, this specialization could reduce triage time and human fatigue. For smaller teams, it could provide detection coverage they cannot staff manually.

Orion-1 also signals a broader market shift. If specialized models outperform general ones on security tasks, security teams may face pressure to adopt purpose-built tools rather than relying on general frontier models with safety policies applied. This dynamic could favor startups like Artemis that can move faster than model providers constrained by broader safety concerns.

What to test

Before adopting Orion-1, security teams should verify several claims:

• Benchmark independence: The Decision-Grade Readiness benchmark was built by Artemis itself. Have independent evaluators or customers reproduce the results on their own data before treating the performance gap as decisive.

• Baseline clarity: Artemis tested Claude Opus 5.5, but Opus 5.5 routes most cybersecurity tasks to the older Opus 4.8. The strongest general-purpose models tested, Claude Mythos 5 and OpenAI’s GPT-6 Astra, were not included in the comparison. Request clarification on which model variant handled each task.

• Real-world drift: The model was post-trained on Artemis’s own defensive operations. Test whether it generalizes to your environment’s specific tools, log formats, and threat landscape. A model trained on one company’s logs may encounter unexpected patterns in yours.

• Autonomy thresholds: Artemis allows per-action autonomy limits. Understand which actions the model recommends most often, which ones require human approval at your organization’s risk tolerance, and whether the overhead of review eliminates efficiency gains.

• Cost and integration: Orion-1 runs on the Artemis platform. Evaluate total cost of ownership, latency, and compatibility with existing security tools and workflows before committing.

The conclusion

Artemis Security’s Orion-1 represents a credible attempt to address the gap between defensive need and vendor caution about AI misuse. The company has built a model post-trained on real-world defensive workflows, measured it against a task-specific benchmark, and deployed it with human oversight enabled by default.

However, the evidence so far is limited to Artemis’s own benchmark. Security teams should request independent validation, test the model on their own logs and threat scenarios, and compare total cost of ownership to alternatives before adopting it. The absence of the strongest general-purpose models from the comparison also leaves room for skepticism about the performance gap.

What to watch: whether Artemis customers report improved detection rates and reduced false positives after deployment, whether independent security researchers reproduce the benchmark results, and whether competing models or security startups respond with specialized alternatives. Orion-1’s adoption may accelerate the shift toward purpose-built models over general ones for defense work.

Related reading

• OrcaCyber Zero 1.5 Cybersecurity Model Launches With 1M Context
• Claude Dynamic Workflows: 1,000 Parallel Agents Now Available
• Claude Haiku 5.5 price cuts, benchmarks reshape model selection