How Lemonade Modernized Security with Artemis
“I deal with many, many security products. I’ve seen a lot. In 30 years, I’ve not come across a product that quickly showed me so much value. I love Artemis.”
Jonathan Jaffe · CISO, Lemonade
Thousands
of investigations run automatically every month
24/7/365
deep high quality analysis for every case
Minutes
to resolve investigations that once took analyst time
500,000+
of assets under continuous intelligence
AI-powered insurance · enterprise · environment intelligence · SIEM replacement
About Lemonade
Lemonade is the AI-powered insurance company, that has rebuilt insurance around automation and machine learning from the ground up. Its environment is large and busy, spanning cloud infrastructure, identity systems, AI agents, and data warehouses, and it changes continuously as the company ships. Protecting an environment of this size and pace is achieved by a security team that wanted tooling as modern as the company itself, led by CISO Jonathan Jaffe.
The opportunity
For Lemonade, the core security challenge at this scale comes down to understanding the environment itself. With 500,000+ of assets across cloud, identity, and data, the team needed a clear and current picture of what it had, what normal looked like, and where real risk was concentrated. Alerts and logs alone left too much of that picture to manual effort, and the work of assembling it manually grew heavier as the environment expanded. What Lemonade wanted was continuous intelligence about its environment that stayed accurate on its own as things changed.
“With our rapid adoption of agentic technology, our environment evolves daily. I wanted a security platform that could keep an accurate picture of it without my team rebuilding that picture by hand.”
Jonathan Jaffe · CISO, Lemonade
The challenge
Lemonade already ran an established SIEM, and it did the job it was built for by collecting logs and raising alerts. As the company grew, the team spent real effort turning that raw telemetry into a working understanding of the environment, and that effort grew with every new asset and account. Investigations were also a distributed effort. The team coordinated over Slack and Zoom, worked separate tools in parallel, and consolidated what each person found by hand into tools such as Slack canvas or Notion pages, which left the reasoning behind an investigation spread across individual tools rather than held in one place. They wanted depth and context they could trust, delivered in a form the whole team would rely on daily, through the calm periods as much as the busy ones.
One conventional way to get that kind of always-on depth is to hire a managed service, and the team knew the tradeoffs that come with one: quality that varies with whoever picks up the case, and context that lives outside the company. Lemonade wanted the coverage without the compromise. Coming from a company that cares deeply about customer experience, Lemonade expected the same high bar in their security products.
The solution
Artemis gives Lemonade that experience and understanding through its environment intelligence. Artemis builds a living model of the whole environment and keeps it current as things change, bringing assets, context, and risk together in one continuously updated view. The team can see what they have, how it’s connected, and where attention is most warranted, all in one place.
“The most important thing is that everything works together, in one place. Artemis ingests any logs we throw at it, automatically creates detectors based on current threat intel, our environment, and the logs themselves, and then does deep analysis of what it finds. Each piece matters, but all of it together is what makes the product.”
Jonathan Jaffe · CISO, Lemonade
Detection coverage builds itself on top of that model. Artemis ingests any log source Lemonade sends it, then automatically creates detectors from three inputs working together: current threat intelligence, Lemonade’s own environment, and the logs already flowing in. When new threats emerge or the environment shifts, coverage follows on its own, without the team writing and maintaining rules by hand.
AI mode lets anyone on the team ask questions about the environment in plain language, and get answers grounded in Lemonade’s own data. Agentic investigations run across the connected sources and work cases on their own, around the clock, applying the same depth to the first case of the day and the fiftieth. Shared case management gives the team a common place to set verdicts and track status together.
How Lemonade uses Artemis
Day to day, environment intelligence has become one of the features Jonathan reaches for most. He navigates it to understand Lemonade’s assets, see the context around them, and catch what has changed across the environment. That model has surfaced more than security findings: Artemis flagged cost and security posture optimization opportunities across Lemonade’s cloud, data, and identity infrastructure.
“I love Artemis’ optimization insights. Almost immediately, Artemis made us aware of ways to optimize key, expensive resources like Snowflake instance, EKS clusters, and Okta in ways that lowered our operational costs of those things. We never would have discovered those optimizations on our own”
Jonathan Jaffe · CISO, Lemonade
AI mode sees similarly heavy use, with the team running hundreds of conversations to ask questions and get grounded answers about their own security data. Cases flow through a single shared workspace where the team triages, investigates, sets verdicts, and moves work forward together. Across a large asset base, this gives them a steady way to focus on the risk that genuinely matters and to keep that focus current as the environment grows.
“As a team, we spend multiple hours in Artemis a day. I might spend an hour in the product every day, myself. I look forward to using Artemis each morning.”
Jonathan Jaffe · CISO, Lemonade
Cases arrive already investigated. By the time a team member opens one, a deep analysis is waiting, and the work starts from conclusions and evidence rather than raw alerts. From there, AI mode runs alongside every investigation, which gives the team one place to go deeper on what an investigation turned up and a record of how it got there. An analyst picking up a colleague’s case can see what was already investigated and what came back, confirm nothing was missed, and rerun the same investigation later if the question returns. Work moves through the team along the same path: a team member may hand off a case, hunt, or investigation, to another member, who takes the actions Artemis recommends, reviews the findings, and routes fixes to owners of the resource in question..
The case also carries the checks that used to be assembled query by query. When secret scanning flagged an AWS credential pair, the open question was whether the matching secret key had been exposed anywhere else, in source control or on an endpoint. Answering that once meant hand-crafting endpoint queries, searching repositories manually, and refining until the result was trustworthy enough to report. Artemis now runs that search across the connected sources and returns the evidence behind its answer.
“Before Artemis, an investigation meant Slack, Zoom, and trying to consolidate everyone’s findings into a canvas or a Notion page. Now AI mode sits alongside every investigation, so it all lives in one place with a paper trail. I can see what my coworker was looking for and what he found, and I know no stone was left unturned.”
Nick Kosmas · Security Engineer, Lemonade
Artemis is useful beyond the security team, as well. Lemonade has made AI mode available to IT with limited permissions, so a ticket that needs investigation before anyone changes a configuration, an authentication failure for example, can be worked through directly rather than waiting on security to look first.
Results and impact
Artemis now serves as the full member of Lemonade’s security operations with environment intelligence and AI mode among the most-used parts of the product. Investigations that once took meaningful analyst time now complete in just minutes, with thousands of them run automatically every month.
“It’s like having a service working 24 hours a day that never gets tired, doing what you would normally have to hire a managed service for, with more consistency and higher quality. The time it saves is hard to even measure, because there’s work we simply would not be able to do without it. We have put Artemis to work across our whole environment, and it has kept earning its place. It is one of the few security products I can say is genuinely getting better over time.”
Jonathan Jaffe · CISO, Lemonade
Get started with Artemis
Modern companies run on environments that change by the day, and good security starts with a rich understanding of those environments. Artemis gives teams continuous understanding through environment intelligence. Artemis is proud to support some of the most innovative companies in the world. See what Artemis can do in your environment and request a demo at artemissecurity.com.
