Artemis Security review: an AI-native security operations platform with per-action approval

Artemis Security describes itself as an "AI-native security operations platform that detects, investigates and stops attacks", built on a living model of the environment covering users, accounts, devices, resources and AI agents. It came out of stealth on 15 April 2026 with $70M in seed and Series A funding, the Series A led by Felicis, and introduced Orion-1, a foundation model for cyber defense, on 8 October 2026. It also offers an optional MDR service in which senior analysts operate Artemis 24/7.

Artemis correlates identity, cloud, endpoint and SaaS data against its model of the environment and investigates autonomously. Proposed actions, such as revoking sessions, isolating a host, disabling an inbox rule or blocking a domain, come with an impact preview and evidence. It acts alone only where pre-authorised, with approval set per action and per connector, and an audit trail records who, what and why. Artemis cites 96% of investigations resolved autonomously in its Cursor case, and a 96% reduction in mean time to resolution; those are Artemis's figures.

• Investigation depth per alert · 20%

  8 / 10

  Correlates identity, cloud, endpoint and SaaS data against a living model of the environment and investigates autonomously; its Cursor case cites 96% of investigations resolved autonomously (Artemis's figure).

• Explainability of verdicts · 15%

  7 / 10

  Investigations and proposed actions come with evidence and an impact preview, and an audit trail records who, what and why; step-level agent reasoning is less documented.

• Coverage of alert sources · 15%

  8 / 10

  225+ connectors, including SIEMs it ingests (Splunk, Microsoft Sentinel, CrowdStrike NG-SIEM) and data stores it queries in place (Snowflake, BigQuery, AWS Security Lake).

• Human-in-the-loop controls · 15%

  9 / 10

  Acts alone only where pre-authorised, with approval set per action and per connector, impact-checked containment that is reversible by design, and a who, what and why audit trail.

• Transition effort from an existing SOAR · 15%

  8 / 10

  An AI-native SOAR builder (visual and natural language) aimed at teams maintaining a SOAR, 300+ actions, a Splunk SOAR connector and automatic playbook update proposals; existing playbooks are rebuilt rather than translated.

• Deployment model options · 10%

  5 / 10

  Ingests hot-path data and queries high-volume data where it lives, and describes on-premises execution of actions; tenancy and data residency options are not described.

• Pricing transparency · 10%

  2 / 10

  No pricing is published.

Weighted score: 7.10 / 10 (computed from the weights on /method#how-we-score)

• No public pricing.
• Out of stealth since April 2026, so the customer record is short.
• Deployment and residency options not described.
• Outcome figures are Artemis's own claims.

Artemis offers an AI-native SOAR builder, visual and natural language, aimed at teams maintaining a SOAR, with 300+ actions, a Splunk SOAR connector and automatic proposals to update playbooks. Playbooks are rebuilt in Artemis rather than translated. Artemis says connectors go live in under an hour and real cases arrive inside 48 hours. Pilot with approval required on every action, then pre-authorise the categories you trust.

Source: artemissecurity.com · artemissecurity.com/platform/overview · artemissecurity.com/platform/response · artemissecurity.com/connectors · Artemis Security funding announcement · Reviewed Sep 2026

• Approval set per action and per connector, the most granular control described here alongside Mate's modes.
• 300+ response actions across major security and IT tools.
• Queries high-volume data where it lives.

Teams that want fine-grained approval control over AI response, teams that query high-volume data where it lives in stores such as Snowflake, BigQuery or AWS Security Lake, and Splunk SOAR users looking at an AI-native replacement. Teams that need published prices, described deployment and residency options, or a long customer record should compare the alternatives first.