Incident management · Production

Artemis Security integrates Claude across its AI-native cybersecurity platform, reducing investigation time from two hours to under five minutes

The problem

Traditional security stacks built on static rule sets could not keep pace with AI-powered threats; detection engineers wrote only a few rules per week, rules fell behind as environments changed, and each alert triggered hours of manual investigation across disconnected systems—most of which turned out to be benign.

Workflow diagram · grounded in source
1
Data source connection
integration
“Integration takes less than an hour, and customers begin receiving environment-specific intelligence within minutes of connecting their first data source”
2
Living environment model built
ai_action
“Claude-powered agents build a living model of each customer's environment: every entity, asset, behavioral baseline, and cross-source relationship”
3
New event evaluated against context
ai_action
“When a new event arrives, Artemis evaluates it against the full context of the user, system, and organization, not just a static set of rules”
4
Detection fires, investigation agents activate
ai_action
“When a detection fires, Claude-powered investigation agents take over: formulating hypotheses, querying across log sources, correlating signals, and producing reports with severity assessments and clear chains of reasoning. Deep domain e…”
5
Evidence-cited investigation report
output
“The same cases now produce structured, evidence-cited reports and response actions in less than five minutes”
6
Natural language analyst queries
ai_action
“Analysts can also query their security data in English, asking to see suspicious commercial VPN usage across their organization, then follow up to review a detailed report, maintaining context across the interaction. They can build new d…”
7
Claude Code engineering workflow
ai_action
“100% of the engineers work with Claude Code as a core part of their development workflow. Over 300 custom Claude skills encode the team's operational playbook, from creating new detectors to managing infrastructure and reviewing code”
Reported outcome

Investigation time fell from two hours to under five minutes, the investigation backlog for customers disappeared, and a global financial services customer received over a hundred environment-specific detections within the first week of integration.

Reported metrics
Investigation time before (enterprise customer average)two hours per investigation
Investigation time afterless than five minutes
Environment-specific detections in first weekover a hundred
engineer adoption of Claude Code100%
Show all 8 reported metrics
investigation time before (enterprise customer average)two hours per investigation
investigation time afterless than five minutes
environment-specific detections in first weekover a hundred
engineer adoption of Claude Code100%
custom Claude skillsOver 300
integration timeless than an hour
time to first environment-specific intelligencewithin minutes
investigation backlogdisappeared
Reported stack
ClaudeOpus 4.7Sonnet 4.6Haiku 4.5Amazon BedrockClaude CodeOktaAWS CloudTrailEntra IDCrowdstrike
Source
https://www.anthropic.com/customers/artemis
Read source ↗

Frequently asked questions

What did this team achieve with this AI workflow?

Investigation time fell from two hours to under five minutes, the investigation backlog for customers disappeared, and a global financial services customer received over a hundred environment-specific detections withi…

What tools did this team use?

Claude, Opus 4.7, Sonnet 4.6, Haiku 4.5, Amazon Bedrock, Claude Code, Okta, AWS CloudTrail, Entra ID, Crowdstrike.

What results were reported?

Investigation time before (enterprise customer average): two hours per investigation; Investigation time after: less than five minutes; Environment-specific detections in first week: over a hundred; engineer adoption of Claude Code: 100% (source-reported, not independently verified).

How is this incident management AI workflow structured?

Data source connection → Living environment model built → New event evaluated against context → Detection fires, investigation agents activate → Evidence-cited investigation report → Natural language analyst queries → Claude Code engineering workflow.

Related incident management cases