Artemis Security

• Platform vendors already inside these accounts could add comparable AI investigation to products enterprises license today. If that closes enough of the speed gap, the Artemis difference narrows to price before its reference base broadens.
• Retrieving data on demand depends on telemetry sitting in sources Artemis can query. Enterprises whose logging is appliance-bound or on premises, without supported query access, blunt the cost advantage that anchors the pitch.
• The managed service commits Artemis to putting human eyes on every customer-visible case at a company a Datadog case study counts at about fifty people, on a figure that carries no date. Artemis needs enough analyst capacity to review every customer-visible case.
• The efficacy figures a buyer meets first, a 96 percent cut in resolution time and a 94 percent cut in detect and respond time, come from Artemis, and the reviewed sources hold no independent test of either.
• Artemis runs its detection and investigation agents on models it licenses from Anthropic. A price increase or a capability change there would reach the Artemis cost base and product behavior directly.
• Fortune reports startups proliferating with similar claims about autonomous detection and response. Artemis competes for those buyers when they choose software to complement an existing platform.

Artemis Security sells to enterprise security operations teams that pay to collect telemetry and still lose ground to attacks that outrun manual triage. Artemis offers an alternative to the traditional security log-analysis platform, with investigated cases, supporting evidence and staged response actions. It offers two ways in, replacing that platform or running beside it.

Independent coverage carries the cost half of that argument. An SC Media brief summarizing SiliconANGLE coverage positions the product as an alternative to traditional security log-analysis platforms that can incur significant data streaming costs, and GovInfoSecurity describes a company that emerged from stealth to identify threats by better correlating telemetry data. A research outlet writing on detection engineering frames the same operational mismatch, between how modern environments change and how detections are traditionally authored. The problem is established industry background rather than one Artemis has to teach a buyer.

The 96 and 94 percent figures describe reported Artemis product outcomes. Its homepage claims that 96 percent of investigations close without a human at one customer, and an AlleyWatch article prints a 94 percent reduction in detect and respond time for early customers. A newsletter analysis reports that 40 percent of alerts are never investigated across the industry, which sizes the problem without testing the Artemis figures, so a buyer weighs them against their own alert volume. [s18, s17, s30, s15, s1, s20, s4]

A model of the customer's environment is the platform's claimed foundation. Artemis says it builds a living model of every user, account, device, resource and AI agent from identity providers, HR records, organizational structure, asset inventories and maps of critical business resources, and applies that model when a detection runs rather than after an alert fires. Detectors are written for one environment in minutes and auto-tuned so that coverage does not decay.

The data design is hybrid rather than purely federated. Artemis ingests the hot-path data detection depends on and queries high-volume sources where they already sit, which is how it argues for full visibility at lower ingestion cost. Its catalog lists 152 connectors across application, cloud, endpoint, identity, network and other categories.

Published capability detail is detailed and vendor-authored. The Cursor account describes correlation across more than twenty log sources, detectors that tune themselves as the environment shifts, and more than 1,200 hunt executions in a quarter, with response held behind human confirmation at that customer. Across the platform, Artemis says a customer sets the approval level per action and per connector and can start fully gated. A second account covers Lemonade. Artemis also sells a managed service that puts senior analysts inside the customer's environment to check what the platform finds and to own the response.

No documentation portal and no self-service trial appear on the surfaces the reviewed sources cover, and the AWS Marketplace listing is a contract route rather than a trial. A research outlet has twice described the architecture and both accounts report what Artemis positions rather than testing it. [s1, s4, s6, s7, s8, s5, s9, s22, s27, s30, s21]

Artemis positions against the legacy log platform rather than a named rival. Artemis describes continuously tuned detectors and completed investigations with supporting evidence and staged response actions. Press sharpens the target, with GovInfoSecurity calling it a SIEM replacement startup and an SC Media brief positioning it as an alternative to traditional SIEM platforms.

The structural argument is economic. Artemis argues that traditional architectures charge for ingesting and storing everything, on a cost model that scales with data volume, so retrieving data on demand pressures the revenue line those platforms sell on. The reviewed sources do not show an incumbent changing its packaging in response. The counterweight is the shape of the sale, because a replacement means displacing a platform the buyer already pays for. Artemis offers to complement or replace an existing security log-analysis platform.

CrowdStrike included Artemis in its 2026 accelerator cohort announcement. Fortune describes a crowded and rapidly evolving space, with startups proliferating around similar claims about autonomous detection and response. Artemis competes with them on the same ground when it runs beside an existing platform. [s1, s17, s18, s14, s4, s16]

Customer evidence is named, and Artemis publishes most of it. Its homepage carries a trusted-by list naming Cursor, Lemonade, Wix, Eleos Healthcare, Blacksmith, Mercury and Canoe alongside an unnamed Global 500 financial institution and an unnamed Fortune 500 technology company. Fortune identified Mercury, Wix, Lemonade and Abnormal AI as clients and described a few seven-figure deals. Artemis has published two full customer accounts, covering Cursor and Lemonade.

Distribution runs wider than direct sales. The AWS Marketplace listing lets a buyer contract and bill through AWS, the careers page carries a channels and partnerships lead and a technology alliances manager, and CrowdStrike included Artemis in its 2026 accelerator cohort announcement.

The chief executive fronts the launch coverage, and the careers page listed seventeen openings when it was captured, among them two senior sales engineer roles, one of them in London, a senior account executive for enterprise, a founding product manager, a SOC manager and a security analyst. Artemis also sells a managed service in which its own analysts operate the platform for a customer. [s1, s16, s7, s8, s9, s3, s14, s5]

The founders' backgrounds map onto the product. Artemis says Shachar Hirshberg led product for Amazon GuardDuty. GovInfoSecurity describes him as a former GuardDuty leader, and Fortune calls him a former AWS product leader. Artemis also describes his early role at Demisto and engineering leadership at Palo Alto Networks. Artemis says Dan Shiebler led AI and machine learning at Abnormal AI after building Twitter's web-ads machine learning organization. On its About page, Artemis also states that he holds a doctorate in AI from the University of Oxford.

Headcount evidence is dated and partial. GovInfoSecurity reported 30 employees, and a Datadog case study lists the company at about fifty with no date attached to that figure. The reviewed sources name no executive beyond the two founders, so a buyer weighing leadership depth reads the founding pair and the roles the company is hiring for. [s17, s16, s2, s12, s3]

Artemis lists ISO/IEC 27001 and SOC 2 Type II certification, plus HIPAA and GDPR compliance, in its homepage footer. The footer also includes a Trust Center link. The underlying reports and the subprocessor list behind that Trust Center are not in the reviewed sources, so a buyer would request them from the company directly.

Deployment evidence and a published tenancy design sit beside those claims. The launch release reports production use in banking and financial services, and the case study Anthropic published states that every customer runs in a SOC 2 compliant dedicated single-tenant environment and that customer data is never shared across tenants and is never used to train models. The AWS Marketplace listing gives buyers who prefer it a way to contract and bill through AWS, and the contact page publishes a New York street address and an inquiry form. [s1, s13, s11, s17, s9, s24]

Add analyzed competitors to compare them side by side with Artemis Security.

Artemis sells to enterprise security operations teams, and the named customers skew toward technology companies. The launch release adds banking and financial services as sectors already running the product, and the homepage trusted-by list names Cursor, Lemonade, Wix, Eleos Healthcare, Blacksmith, Mercury and Canoe alongside an unnamed Global 500 financial institution and an unnamed Fortune 500 technology company. Lemonade is an insurance company, so that account describes a regulated-sector buyer.

The two published customer accounts describe different entry points into the same category. Cursor is an engineering-heavy company whose infrastructure changes by the hour, and whose team wanted to keep ownership of its data and bring its own detection logic. Lemonade already ran an established SIEM. Artemis labels the account as a SIEM replacement and reports more than 500,000 assets under continuous intelligence. The account says the team weighed hiring a managed service and wanted the coverage without the tradeoffs it saw there.

Artemis names its buyer directly on the managed service page: security leaders who need accountability behind the automation, and teams without the headcount to staff an overnight rotation. Geographic and vertical packaging beyond those sector mentions is not disclosed, so a buyer outside the named sectors cannot tell from the record whether the product is packaged for them.

The claimed advantage is knowledge of the customer's environment rather than a corpus Artemis owns. The company describes a living model of every user, account, device, resource and AI agent, built from identity providers, HR records, organizational structure, asset inventories, service-management systems and maps of critical business resources, and applied when a detection runs. Detectors written for one environment are auto-tuned continuously so that coverage does not decay.

The reasoning models come from outside. The case study Anthropic published states that Artemis evaluated multiple model providers before building its platform on Claude, using Opus 4.7, Sonnet 4.6 and Haiku 4.5 inside the platform. So a licensed provider supplies the models, and Artemis builds the environment model above them.

Demonstrated capability comes from the company and its partners. The Cursor account describes correlation across more than twenty log sources, 500 terabytes of security data analyzed every month, more than 1,200 hunt executions in a quarter, and investigations that ship the evidence behind each verdict. Artemis says a customer sets the approval level for response per action and per connector, and that every containment step is impact-checked before it runs and reversible. A research outlet describes the same architecture in two reports without testing it, and no independent technical evaluation, public sandbox or self-service trial appears in the reviewed sources.

Artemis runs an enterprise sales-assisted motion with no self-service path. Buyers can book a demo or submit an inquiry, and no self-service sign-up appears in the reviewed sources. Fortune describes a few seven-figure deals, consistent with large enterprise contracts.

Distribution runs wider than direct sales. The AWS Marketplace listing lets a buyer contract and bill the platform through AWS, and the careers page carries a technology alliances manager alongside a channels and partnerships lead. CrowdStrike included Artemis in its 2026 accelerator cohort announcement. Resellers and managed-service partners do not appear in the reviewed sources, so the routes to a buyer that the record documents are the company's own sellers and the marketplace listing.

Shachar Hirshberg fronts the launch press, and the careers page carried seventeen open roles when it was captured, across engineering, security operations, product, customer success, sales, recruiting and partnerships. Two are senior sales engineer roles and one is in London, which no other role in that listing names. Fortune reports that founders of Demisto and Abnormal AI, former Splunk leadership and senior executives from CrowdStrike, Palo Alto Networks, Microsoft and Okta joined the round. No deal attributed to those investors appears in the cited pages.

Artemis publishes one number and leaves its unit undefined. The AWS Marketplace listing prices one unit of Artemis cloud platform access at five million dollars for twelve months, with twenty-four and thirty-six month terms also offered. The same listing states that the platform bills in Units, that a buyer commits to a set quantity of them, and that pricing scales with the number of Units bought, and it does not define what a single Unit maps to in a customer's environment.

That gap is what a buyer closes in the sales conversation. Because the listing does not define a Unit, the published figure describes the price of a single Unit rather than what a given environment costs, and the record does not show whether a growing telemetry estate raises the Artemis bill the way it raises an ingest-priced one.

Cost behavior during an investigation is undisclosed as well. Artemis offers to leave high-volume data in storage the customer owns and query it there, so some storage cost can stay on the customer's side. Who pays for increased query volume during an incident, the customer or Artemis?

Artemis delivers a software platform the customer connects to telemetry where it already lives, streaming the detection-critical part and querying the rest in place. The company says a customer connects its first sources in under an hour, and its connector catalog spans application, cloud, endpoint, identity and network sources. The marketplace listing describes software as a service deployed on AWS, and the launch release says the product works alongside existing security tools.

A managed service now sits beside the software. Artemis says its platform detects, investigates and prioritizes around the clock. Senior analysts operate it on the customer's environment, validate what the platform finds, own the response, and act only within limits the customer sets per connector. The same team takes incident command when a case becomes an incident, and the page excludes posture and CVE management, management of the wider tool estate, offensive engagements and full-service forensics.

The operational bar is high and the public evidence for it comes from the company. Processing billions of events per hour is its own figure, and no service level agreement, status page or uptime commitment appears in the reviewed sources.

Artemis lists ISO/IEC 27001 and SOC 2 Type II certification, plus HIPAA and GDPR compliance, in its homepage footer. The footer also includes a Trust Center link. The reports and subprocessor list behind that Trust Center are not in the reviewed sources.

The launch release reports production use in banking and financial services, and the case study Anthropic published states that every customer runs in a SOC 2 compliant dedicated single-tenant environment and that customer data is never shared across tenants or used to train models. A buyer who wants the underlying reports requests them from the company before a formal review can confirm their scope.

Artemis positions as a platform over the customer's existing data estate, and its own architecture supports that claim more than its ecosystem does. Detection, investigation, hunting and response run on one living model of the environment, the catalog lists 152 connectors including one for MCP, an interface for AI tools, and at Cursor the security team brings its own detection logic and works through MCP.

Artemis publicized its integration with Anthropic's compliance API and telemetry from Claude Code and Claude Cowork. It also has an AWS Marketplace listing, and CrowdStrike included it in its accelerator cohort. The company also has a technology alliances manager opening, and the MCP interface is an integration point other teams could build against.

Ecosystem mechanics beyond those are undocumented in the reviewed sources. No API documentation, partner directory or independently distributed product built on Artemis appears in them.

The founding pair covers the two halves of the product. Shachar Hirshberg ran product for Amazon GuardDuty, according to Artemis, and the About page adds an early role at Demisto, an engineering leadership role at Palo Alto Networks, an MBA from Harvard Business School and service as an officer in the Israeli military's intelligence corps. Artemis says Dan Shiebler led AI and machine learning at Abnormal AI. Its About page also states that he built the machine learning organization behind Twitter's web ads product and holds a doctorate in AI from the University of Oxford.

Headcount evidence is dated and partial. GovInfoSecurity reported 30 employees, and a Datadog case study lists about fifty with no date attached to that figure. The careers page carried seventeen open roles when it was captured, across engineering, security operations, product design, customer success, sales, recruiting and partnerships. Among them are a SOC manager and a security analyst, and the managed service page says senior analysts operate the platform for customers who want accountability behind the automation.

Fortune reports that founders of Demisto and Abnormal AI, the former chief executive and chief technology officer of Splunk, and senior executives from CrowdStrike, Palo Alto Networks, Microsoft and Okta joined the round. The reviewed sources name no executive beyond the two founders.