Artemis Security

• Platform vendors already inside these accounts could add comparable AI investigation to products enterprises license today. If that closes enough of the speed gap, the Artemis difference narrows to price before its reference base broadens.
• Retrieving data on demand depends on telemetry sitting in sources Artemis can query. Enterprises whose logging is appliance-bound or on premises, without supported query access, blunt the cost advantage that anchors the pitch.
• The managed service commits Artemis to putting human eyes on every customer-visible case at a company the record counts at about fifty people, on a figure that carries no date. If hiring lags what that service promises, the accountability it sells is what a customer notices missing first.
• The efficacy figures a buyer meets first, a 96 percent cut in resolution time and a 94 percent cut in detect and respond time, come from Artemis, and the reviewed sources hold no independent test of either.
• Artemis runs its detection and investigation agents on a licensed model service that its Trust Center lists as a subprocessor. A price increase or a capability change there would reach the Artemis cost base and product behavior directly.
• Fortune reports startups proliferating with similar claims about autonomous detection and response. If those buyers prefer adding a layer to the platform they already run, Artemis faces the harder replacement sale with a younger product.

Artemis Security sells to enterprise security operations teams that pay to collect telemetry and still lose ground to attacks that outrun manual triage. The company argues that traditional log platforms charge for ingesting and storing everything, hand analysts a rule match to start from and leave the investigation to them. It offers two ways in, replacing that platform or running beside it, and its own page says a customer sets the pace.

Independent coverage carries the cost half of that argument. An SC Media brief summarizing SiliconANGLE coverage positions the product as an alternative to traditional SIEM platforms that can incur significant data streaming costs, and GovInfoSecurity describes a company that emerged from stealth to identify threats by better correlating telemetry data. The problem is established industry background rather than one Artemis has to teach a buyer.

The numbers that size the pain trace back to Artemis. Its homepage claims a 96 percent reduction in mean time to resolution, and an AlleyWatch article prints a 94 percent reduction in detect and respond time for early customers. No independent test of either figure appears in the reviewed sources, so a buyer weighs them against their own alert volume. [s18, s17, s1, s20, s4]

A model of the customer’s environment is the platform’s claimed foundation. Artemis says it builds a living model of every user, account, device, resource and AI agent from identity providers, HR systems, asset management and business context, and applies that model when a detection runs rather than after an alert fires. Artemis says its research team maintains comprehensive MITRE ATT&CK coverage and that detectors written for one environment tune themselves as that environment shifts.

The data design is hybrid rather than purely federated. Artemis ingests the hot-path data detection depends on and queries high-volume sources where they already sit, which is how it argues for full visibility without the ingest bill. Its catalog lists 152 connectors across cloud, identity, endpoint, network, SaaS, log platforms and threat intelligence.

Published capability detail grew this quarter. The Cursor account describes correlation across more than twenty log sources, thousands of detectors tuned to that one environment, detector authoring in plain language with version history and rollback, and more than 1,200 threat hunts in a quarter. A second account covers Lemonade. Artemis also sells a managed service that puts senior analysts inside the customer’s environment to check what the platform finds and to own the response.

A buyer who wants to check the platform without Artemis has little to work with. No documentation portal and no self-service trial appear on the surfaces the reviewed sources cover, and no evaluation by a party independent of Artemis appears in them. The one hands-on write-up in the record comes from a newsletter whose author names Artemis as its partner, so a buyer assessing the capability reads what Artemis and its partners publish. [s1, s4, s6, s7, s8, s5, s22, s15]

Artemis positions against the legacy log platform rather than a named rival. Its own pages contrast the product with platforms that deliver an alert and leave the investigation to the analyst, and with detection content that decays from the day a person stops maintaining it. Press sharpens the target, with GovInfoSecurity calling it a SIEM replacement startup and an SC Media brief positioning it as an alternative to traditional SIEM platforms.

The structural argument is economic. Artemis argues that traditional architectures charge for ingesting and storing everything, on a cost model that scales with data volume, so retrieving data on demand pressures the revenue line those platforms sell on. The reviewed sources do not show an incumbent changing its packaging in response. The counterweight is the shape of the sale, because a replacement means displacing a platform the buyer already pays for. Artemis hedges that by offering to complement or replace the existing platform at the pace the customer chooses.

CrowdStrike sits on both sides of that line. It sells security operations tooling to the same enterprise buyer, it runs the 2026 startup accelerator with AWS and NVIDIA whose cohort names Artemis, and Artemis reproduces a post from CrowdStrike’s chief business officer welcoming the launch. Fortune describes a crowded and rapidly evolving space, with startups proliferating around similar claims about autonomous detection and response. Artemis competes with them on the same ground when it runs beside an existing platform. [s1, s17, s18, s14, s4, s16]

Customer evidence is named, and Artemis publishes most of it. Fortune named Mercury, Wix, Lemonade and Abnormal AI as clients in April 2026 and reported a spokesperson saying the company had closed a few seven-figure deals. Artemis has since published two full customer accounts, Cursor in July and Lemonade in August 2026, and its homepage publishes endorsements from named security leaders, among them Sony’s senior director of cyber defense and Upwork’s senior director of active defense.

Distribution runs wider than direct sales. The AWS Marketplace listing lets a buyer contract and bill through AWS, the careers page carries a channels and partnerships lead and a technology alliances manager, and CrowdStrike, AWS and NVIDIA name Artemis in the 2026 cohort of the accelerator they run together.

The commercial organization is still forming. The chief executive fronts the launch coverage and authors company posts, and the careers page lists fourteen openings including an enterprise account executive, a founding customer success engineer, a technology alliances manager, a security operations manager and a security analyst. Artemis also sells a managed service in which its own analysts operate the platform for a customer. [s16, s7, s8, s1, s9, s3, s14, s5, s23]

The founders’ backgrounds map onto the product. Shachar Hirshberg led product for Amazon GuardDuty, which GovInfoSecurity reports in its own voice, and the About page adds an early role at Demisto and an engineering leadership role at Palo Alto Networks. Fortune places Dan Shiebler as head of AI at Abnormal Security and earlier a machine learning leader at Twitter, and the About page says he built the machine learning organization behind Twitter’s web ads product.

Headcount evidence is dated and partial. GovInfoSecurity reported 30 employees at the April 2026 launch, and a Datadog case study lists the company at about fifty with no date attached to that figure. The reviewed sources name no executive beyond the two founders, so a buyer weighing leadership depth reads the founding pair and the roles the company is hiring for. [s17, s16, s2, s12, s3]

Artemis publishes its compliance posture on a Trust Center named in the site footer. The rendered page lists ISO 27001:2022, SOC 2, HIPAA and GDPR, with a SOC 2 Type 2 report, an ISO 27001 certificate, an engagement letter, a security policy and a penetration test behind an access request. It also names the subprocessors behind the service, including the cloud provider, the hosted database provider, the authentication provider and the model service the agents run on.

Deployment evidence and a published tenancy design sit behind those attestations. The launch release reports production use in banking and financial services, sectors whose vendor reviews are demanding, and the case study Anthropic published states that customer data is never shared across tenants and is never used to train models. Because the reports are gated, a buyer requests them before a procurement review can confirm their scope. The AWS Marketplace listing gives buyers who prefer it a way to contract and bill through AWS. [s10, s13, s11, s17, s9, s5]

Add analyzed competitors to compare them side by side with Artemis Security.

Artemis sells to enterprise security operations teams, and the named customers skew toward technology companies. The launch release adds banking and financial services as sectors already running the product, and the clients Fortune named are Mercury, Wix, Lemonade and Abnormal AI. Lemonade is an insurance company, so that account describes a regulated-sector buyer.

The two published customer accounts describe different entry points into the same category. Cursor moved off its previous log platform, an engineering-heavy company whose infrastructure changes by the hour and whose security team wanted to keep its own data store and write its own detection logic. Lemonade already ran an established platform when it bought Artemis for a current picture of more than 500,000 assets, and Artemis tags that account as a SIEM replacement. The account says the team weighed hiring a managed service and wanted the coverage without the tradeoffs it saw there.

Artemis names its buyer directly on the managed service page: security leaders who need accountability behind the automation, and teams without the headcount to staff an overnight rotation. Geographic and vertical packaging beyond those sector mentions is not disclosed, so a buyer outside the named sectors cannot tell from the record whether the product is packaged for them.

The claimed advantage is knowledge of the customer’s environment rather than a corpus Artemis owns. The company describes a living model of users, accounts, devices, resources and AI agents, built from identity providers, HR systems and asset management, and applied when a detection runs. Its research team maintains MITRE ATT&CK coverage as the baseline, with per-environment detectors and behavioral baselines layered on top.

The reasoning models come from outside. The case study Anthropic published states that Artemis evaluated several model providers before building on Claude and runs three model tiers inside the platform, and the Trust Center lists Amazon Bedrock Anthropic among its subprocessors. So an outside provider supplies the models, and Artemis builds the environment model above them.

Demonstrated capability comes from the company and its partners. The Cursor account describes correlation across more than twenty log sources, thousands of detectors tuned to one environment, more than 1,200 threat hunts in a quarter, and investigations that ship the queries and evidence behind each verdict. No evaluation by a party independent of Artemis, no public sandbox and no self-service trial appears in the reviewed sources.

Artemis runs an enterprise sales-assisted motion with no self-service path. The site offers demo booking, the reviewed sources show no self-service sign-up, a proof of value runs four weeks against criteria the customer sets, and a spokesperson told Fortune the company had closed a few seven-figure deals, which fits large negotiated contracts rather than bottom-up adoption.

Distribution runs wider than direct sales. The AWS Marketplace listing lets a buyer contract and bill the platform through AWS, and the careers page carries a technology alliances manager alongside a channels and partnerships lead. CrowdStrike, AWS and NVIDIA name Artemis in the 2026 cohort of the accelerator they run together, which is a selection by three platform vendors rather than a reseller relationship. Resellers and managed-service partners do not appear in the reviewed sources, so the routes to a buyer that the record documents are the company's own sellers and the marketplace listing.

The motion reads as founder-led with an organization forming underneath. Shachar Hirshberg fronts the launch press and authors company posts, and the careers page carried fourteen open roles when it was captured on August 25, 2026, across engineering, security operations, product, customer success, sales and partnerships. Fortune reports that founders of Demisto and Abnormal AI, former Splunk leadership and senior executives from CrowdStrike, Palo Alto Networks, Microsoft and Okta joined the round, a network that may open doors, and no cited page shows it producing a deal.

Artemis publishes one number and leaves its unit undefined. The AWS Marketplace listing prices one unit of Artemis cloud platform access at five million dollars for twelve months, with twenty-four and thirty-six month terms also offered. The same listing states that the platform bills in units and that a buyer commits to a quantity of them, and it does not define what a single unit maps to in a customer’s environment.

That gap is what a buyer closes in the sales conversation. Because the quantity is undisclosed, the published figure describes the price of a single unit rather than what a given environment costs, and the record does not show whether a growing telemetry estate raises the Artemis bill the way it raises an ingest-priced one.

Cost behavior during an investigation is undisclosed as well. Artemis offers to hold data for up to seven years or to leave it in storage the customer owns, so some storage cost can stay on the customer’s side. Whether query spikes during an incident land on the customer’s bill or the vendor’s is the kind of question buyers with log platform experience raise in procurement.

Artemis delivers a platform the customer connects to telemetry where it already lives, streaming the detection-critical part and querying the rest in place. The company says connectors go live in under an hour and that at one customer real cases appeared within an hour of the proof-of-value kickoff, with connectors running across Splunk, Microsoft Sentinel and SentinelOne. The marketplace listing describes software as a service deployed on AWS, and the launch release says the product works alongside existing security tools.

A managed service now sits beside the software. Artemis says its platform detects, investigates and prioritizes around the clock. Senior analysts operate it on the customer’s environment, review every customer-visible case, decide whether to close, respond or escalate, and act only within limits the customer sets per connector. The same team takes incident command when a case becomes an incident, and the page excludes posture and CVE management, management of the wider tool estate, offensive engagements and full-service forensics.

The operational bar is high and the public evidence for it comes from the company. Processing billions of events an hour is its own figure, and no service level agreement, status page or uptime commitment appears in the reviewed sources, so a buyer cannot test an operational commitment the record does not carry.

Artemis publishes its compliance posture on a Trust Center named in the site footer. The rendered page lists ISO 27001:2022, SOC 2, HIPAA and GDPR, and it offers a SOC 2 Type 2 report, an ISO 27001 certificate, an engagement letter, an information security policy and a penetration test behind an access request. It also names the subprocessors behind the service, which is the disclosure a buyer needs to route its own vendor review.

Deployment evidence and a published tenancy design back the attestations. The launch release reports production use in banking and financial services, and the case study Anthropic published states that every customer runs in a dedicated single-tenant environment and that customer data is never shared across tenants or used to train models. Because the reports are gated, a buyer requests access before a formal review can confirm their scope.

Artemis positions as a platform over the customer’s existing data estate, and its own architecture supports that claim more than its ecosystem does. Detection, investigation, hunting and response run on one living model of the environment, the catalog lists 152 connectors, and the product opens outward through an MCP interface with the customer’s own repository as the source of truth for detection logic.

Third-party programs are few and recent. The publicized ones are the June 2026 integration with Anthropic’s compliance API and telemetry from Claude Code and Claude Cowork, the AWS Marketplace listing, and the accelerator CrowdStrike runs with AWS and NVIDIA. The company also has a technology alliances manager opening, and Cursor’s engineers author detectors through the product’s MCP interface, which is an integration point other teams could build against.

Ecosystem mechanics beyond those are undocumented in the reviewed sources. No API documentation, partner directory or independently distributed product built on Artemis appears in them, so a reader weighing the platform claim has the architecture Artemis describes and little from outside it.

The founding pair covers the two halves of the product. Shachar Hirshberg ran product for Amazon GuardDuty, which GovInfoSecurity reports in its own voice, and the About page adds an early role at Demisto and an engineering leadership role at Palo Alto Networks. Fortune places Dan Shiebler as head of AI at Abnormal Security and earlier a machine learning leader at Twitter, while the About page says he built the machine learning organization behind Twitter’s web ads product and holds a doctorate from Oxford.

Headcount evidence is dated and partial. GovInfoSecurity reported 30 employees at the April 2026 launch, and a Datadog case study lists about fifty with no date attached to that figure. The careers page carried fourteen open roles on August 25, 2026, across engineering, security operations, product design, customer success, sales and partnerships. Two of them are a security operations manager and a security analyst, and the managed service page says senior analysts operate the platform for customers who want accountability behind the automation.

Operator validation around the company is dense for its age. Fortune reports that founders of Demisto and Abnormal AI, the former chief executive and chief technology officer of Splunk, and senior executives from CrowdStrike, Palo Alto Networks, Microsoft and Okta joined the round. The reviewed sources name no executive beyond the two founders, so a buyer weighing leadership depth has the founders and the open roles to read.