Chris Seymour and Alex Gibson have built operational software, network defense analytics, and tools for cyber and network analysts in demanding mission environments. Artemes AI applies that experience to vulnerability decisions that stay tied to observed system evidence.
A match between a package and a CVE is useful evidence, but it is not a complete risk decision. Teams also need to understand runtime state, exposure, asset importance, and the controls already in place.
Artemes AI is being built to preserve those distinctions. The workflow records what was observed, what remains unknown, and which next step can close the evidence gap before a team acts.
The current architecture combines endpoint telemetry, deterministic analytics, curated vulnerability intelligence, and AI analysis with practitioner review.
Fleet and osquery provide Windows and Linux endpoint observations that can be stored in BigQuery for deterministic analysis and replay.
The analysis service can draft asset-level analysis from bounded case files. Deterministic quality checks block unsupported claims before findings can be promoted.
CISA KEV, FIRST EPSS, and reviewed rules that link software to CVEs provide sourced vulnerability context before model analysis.
The system is designed to distinguish observed facts from inference. Missing exposure, threat, outcome, or compliance evidence stays missing instead of being filled from model memory.
These principles are reflected in the current data model, prompt contract, and review workflow.
Every conclusion should say what was observed, what is inferred, and what is still unknown.
Draft analysis is built from bounded case files and sourced reference data, with provenance retained for review.
Recommendations should identify the evidence behind the finding and the validation or remediation step a practitioner can review.
Automated checks flag unsupported statements about exposure, threats, outcomes, severity, compensating controls, and compliance.
Draft analysis is staged for review, and canonical promotion remains a controlled workflow.
Chris is a software engineer and business owner focused on network security. He designed and developed large cyber defense data collection and analytics capabilities used to support network situational awareness and defensive operations in DoD environments.
Alex is a product engineer and business owner who builds tools that help people understand and protect their networks. He has created software used by cyber and network analysts during critical missions around the world.
These are implemented workflow components, not customer, certification, or performance claims.
Fleet/osquery observations flow through Pub/Sub into BigQuery for deterministic analytics and historical replay.
CISA KEV, FIRST EPSS, and reviewed rules that link software to CVEs enrich context without asking a model to invent reference facts.
Model output is staged as a draft, checked for unsupported claims, and retained with review artifacts before controlled promotion.
Firestore records findings, assets, review state, assignments, due dates, report schedules, and dashboard summaries by customer.
Request early access to discuss the telemetry you already collect, the decisions you need to support, and the evidence boundaries that matter in your environment.
