How Artemis Cuts Security Incident Resolution Time by 96% with Claude

Artemis is a cybersecurity startup that builds AI-native protection for enterprise security teams. Unlike vendors that retrofit intelligence onto existing architectures, Artemis was designed from scratch with Claude as the reasoning engine. "You can't bolt intelligence onto a fundamentally static architecture," said Dan Shiebler, co-founder and CTO. "You have to start over, with AI as the reasoning engine, not an add-on."

The problem it was solving was structural. A skilled detection engineer in any security organization might write a few rules per week, each requiring intimate knowledge of the log source, the attack technique, and careful tuning to minimize false positives. When SaaS tools get adopted or configurations change, those rules fall behind. And when a detection fires, analysts face hours of manual work: copying IP addresses into threat intelligence tools, pulling cloud logs, cross-referencing across disconnected systems—only to find most alerts are benign.

Artemis evaluated multiple model providers and chose Claude—deploying Opus 4.7, Sonnet 4.6, and Haiku 4.5 on Amazon Bedrock in single-tenant, SOC2-compliant environments where no customer data is shared or used for model training. Claude-powered agents build a living model of each customer's environment from the moment data sources connect: every entity, asset, behavioral baseline, and cross-source relationship. Deep domain expertise for each log type—Okta, AWS CloudTrail, Entra ID, CrowdStrike—is encoded into every investigation, regardless of which analyst is on shift. Internally, 100% of the Artemis engineering team works with Claude Code, and 300+ custom skills encode the team's full operational playbook.

One enterprise customer's security team had averaged two hours per investigation. The same cases now produce structured, evidence-cited reports and response actions in under five minutes. A global financial services customer received over 100 environment-specific detections within its first week of integration—covering credential access, lateral movement, and persistence techniques their previous tool had missed entirely. Detection coverage increased 90% from day one. "The investigation backlog for our customers didn't shrink. It disappeared," said Shachar Hirshberg, co-founder and CEO.

Artemis uses Claude not just in the product but to build the product. The 300+ custom skills encode everything from creating new detectors to managing infrastructure and reviewing code—so internal tools become product features and engineering velocity compounds. As Hirshberg put it: "We help them go from triaging a fraction of alerts, hoping the ones we skipped were benign, to having every single alert investigated with the same analytical rigor."