The list. Artemis Security made the 2026–2027 Fortune Cyber 60, the startup ranking Lightspeed Venture Partners and AWS put together with Fortune, in its first year of operations. Fortune’s profile lists it as early stage, founded in 2025, based in New York City, with 52 employees and CEO Shachar Hirshberg. Lightspeed says it sorted more than 300 startups by recurring revenue and growth, then checked the self-reported numbers. Fortune signed off on the final list.
What it sells, in plain words. A SOC, or security operations center, is the team that watches alerts. Most run on a SIEM, a big log warehouse with detection rules on top. Artemis calls itself an AI-native security operations platform. It says it connects to more than 270 sources across cloud, identity, endpoint and SaaS. It then runs detection engineering, threat hunting, investigation and response as one product.
The unique part: the map comes first. Plenty of startups now put AI agents on top of an existing SIEM to triage alerts. Artemis says it builds a live model of every user, device, account, resource and AI agent in a customer’s environment, and runs everything else on that model. That matters more than it sounds. An alert is just a line of text until you know whose laptop it is, what that account can reach, and whether the “user” is actually a coding agent with production keys. Most SOCs answer those questions by hand, across five consoles. If the model is accurate and current, the AI starts each case with the context an analyst spends twenty minutes gathering. If it’s stale, the AI is confidently wrong at machine speed.
The AI-agent angle. Counting AI agents as identities is the detail to watch. Companies are handing agents tokens, repo access and cloud roles faster than anyone is inventorying them. A SOC that can’t tell an agent from a human can’t tell when an agent goes off-script. Artemis is betting that the inventory and the detection belong in the same system.
The proof, and its limits. Artemis says Cursor and Lemonade both replaced their legacy SIEMs with it. At Cursor, the company says it correlates more than 35 log sources and resolves 96% of investigations autonomously, with evidence attached. At Lemonade, it says it tracks more than 500,000 assets. It also says it has built nearly 40,000 custom detectors for customers, up from 300 in March, and merged more than 50,000 pull requests this year. These are Artemis’ figures, not independent audits. The 96% is the one to pressure-test. Resolved by whose standard, and how often did a human later reopen a case?
The financial view. Fortune lists Artemis’ funding as $70 million, with investors Felicis, First Round Capital, Theory Ventures, Brightmind Partners and Lockstep. Round sizes, timing, valuation and revenue are Undisclosed. Seventy million dollars for a year-old company is a lot of runway. It’s also a signal that investors think SIEM replacement, not SIEM add-ons, is where the money is. That is a bigger fight. Splunk, Microsoft, Google and CrowdStrike all sell the log layer and are adding their own agents. A startup that asks a customer to rip out the warehouse has to be clearly better, not just cheaper to run.
Why it’s winning now. Attackers are using AI to move faster. Artemis says AI-enhanced suspicious activity across its customers rose 312% from April to September, its own number. Whatever the exact figure, the gap between attack speed and analyst speed is real. Buyers who were afraid to let software close cases are running out of alternatives.
For practitioners. Ask any AI SOC vendor, Artemis included, to show you its picture of one real account: what it owns, what it can reach, what changed this week. If that picture is wrong, nothing built on top of it will be right.
Would you trust an AI to close a case if you could see the map it reasoned from, and would you rip out your SIEM to get it?