The timing, in a way, said everything.
Just weeks after CrowdStrike's 2025 threat report documented attackers breaking into systems in under a minute—faster than most security teams can pour a morning coffee—a startup called Artemis decided it had seen enough of the old playbook. In April 2025, the New York-based company emerged from stealth with $70 million in combined seed and Series A funding and a pointed argument: that traditional security operations centers, built for a slower era of human-paced threats, need more than incremental improvements. They need rebuilding from scratch.
It's the kind of pitch that lands differently when attacks themselves have gone algorithmic.
Felicis led the Series A round. First Round Capital and Brightmind had co-led the seed. Theory VC and Lockstep joined in, alongside a syndicate that reads like a security industry reunion—founders of Demisto and Abnormal AI, Splunk's former CEO and CTO, senior executives who've done time at CrowdStrike, Palo Alto Networks, Microsoft, and Okta. The company didn't disclose valuation, though with that roster and that capital, the vote of confidence seems clear enough.
Federated Queries and the SIEM Problem
Artemis was founded in late 2024 by two veterans who'd watched the cybersecurity arms race from inside some of its biggest players. Shachar Hirshberg led product for Amazon GuardDuty at AWS and earlier worked on Demisto and Palo Alto Networks products. Dan Shiebler headed machine learning and AI at Abnormal Security after a stint on Twitter's Cortex team. Both had developed strong opinions about what wasn't working.
Their answer? An alternative to legacy SIEM architecture—those sprawling security information and event management systems that have anchored enterprise defenses for years, often at eye-watering cost.
Rather than ingesting every log and event upfront, Artemis uses what it calls federated queries to pull data on-demand from existing cloud storage and log sources. The company claims this delivers full visibility at roughly a fifth of the cost of traditional SIEMs, though independent validation of that math remains to be seen. The platform generates detections specific to each customer's environment and autonomously investigates signals across identity systems, cloud infrastructure, endpoints, networks, and SaaS applications.
There's also what the company calls "AI Mode"—a natural language interface that, according to Artemis, lets security analysts ask questions conversationally instead of writing the kind of complex query syntax that typically requires specialized training. The company claims the system now processes billions of events per hour and analyzes over 15,000 terabytes of data daily, though those figures are difficult to verify independently at this stage.
Early Customers, Early Promises
For a company barely half a year old, Artemis has assembled a respectable customer list: Mercury, Wix, Lemonade, and Abnormal AI have all signed on. The startup has closed what it describes as "a few seven-figure deals" and expects to hit multi-million dollars in annual recurring revenue before 2025 ends, according to Fortune.
One data point the company offered: a 96% reduction in time to resolution at an unnamed, highly regulated enterprise customer. Details were scarce, but the metric fits the broader narrative Artemis is selling—speed as a first-order concern in an environment where attackers no longer need days or even hours to do damage.
The company earned a spot in the CrowdStrike, AWS, and NVIDIA Cybersecurity Startup Accelerator cohort in January 2025, just weeks after its founding. Perhaps more than the founders expected, the timing aligned with industry anxiety about AI-enabled threats.
The Market Artemis Is Entering
CrowdStrike's 2025 Global Threat Report painted an unsettling picture: breakout times had reached record lows, with some intrusions occurring in under a minute. The report also noted a significant jump in attacks by AI-enabled adversaries and found that the majority of detections are now malware-free—meaning traditional signature-based defenses increasingly miss the mark.
Meanwhile, the SIEM landscape itself has been consolidating. Cisco completed its $28 billion acquisition of Splunk back in March 2024, leaving some enterprise buyers wondering about vendor lock-in and innovation cycles. That kind of market reshuffling tends to create openings for challengers, particularly those promising a fundamentally different approach rather than incremental feature additions.
Whether Artemis can convert early momentum into durable market position is another question. The company had nine open roles across engineering, go-to-market, and product as of mid-April—a hiring push that suggests confidence, if not certainty.
What Comes Next
The thesis underpinning Artemis—that security operations need to be rebuilt for threats moving at algorithmic speed—resonates at a moment when many CISOs feel outpaced. The heavyweight investor backing and early customer wins suggest the company has cleared initial credibility hurdles.
Still, the harder test lies ahead: proving that federated queries and AI-native detection can scale beyond early adopters and become the infrastructure enterprise security teams rely on when the next rapid intrusion attempt arrives. The company's youth cuts both ways—it means less technical debt, but also less battle-testing in the chaotic conditions where security platforms either hold or buckle.
For now, Artemis has capital, attention, and a well-timed argument. Whether that's enough to redefine how organizations defend themselves in an era of machine-speed attacks will depend on execution under pressure—the one test no amount of seed funding can simulate in advance.
