AI-native detection and response that correlates telemetry into investigated attack narratives

Artemis was founded by Shachar Hirshberg and Dan Shiebler and emerged from stealth roughly six months later with $70M in combined seed and Series A funding led by Felicis, with First Round Capital, Brightmind Partners, Theory VC, Two Sigma, and Lockstep participating. Hirshberg served in the Israeli Intelligence Corps, was a development manager at Demisto before its acquisition by Palo Alto Networks, and then led GuardDuty at AWS; Shiebler headed AI and machine learning at Abnormal AI and holds a machine learning doctorate from Oxford. Their premise is a velocity mismatch: attacks now move at machine speed while investigation and response still run at human speed, and adding analysts does not close that gap.

The platform connects to more than 150 security data sources through a mix of direct log ingestion and federated query, and first builds what the company calls environment intelligence: a continuously updated model of users, accounts, devices, resources, and the relationships between them, drawn from authoritative systems rather than inferred from alerts alone. Detections are tuned against that model, so they reflect one customer's environment instead of a generic ruleset, and coverage gaps are surfaced explicitly. Every alert is investigated as it arrives, producing a case with an evidence chain and stated reasoning rather than an isolated signal, alongside pre-staged and auditable response actions and a threat hunting workflow that turns published threat reports into finished hunts. A natural language mode sits across all of it. Customers named publicly include Cursor, Lemonade, Wix, Mercury, and Sony.