About Canoe Intelligence

Canoe Intelligence (“Canoe”), a Bloomberg company, builds AI that automates the collection and extraction of alternative investments data for wealth managers, institutional investors, family offices, and asset servicers. Canoe is trusted by more than 500 institutional clients representing over $11 trillion in assets, and it ingests documents from more than 44,000 funds. In July 2026, after Artemis began working with Canoe Intelligence, the company announced that it had agreed to be acquired.

The problem

The sensitive financial documents and client access flowing through Canoe make it an attractive target for attackers. The company runs many security scanners, each operating in its own silo and without cross-correlation. It had a limited single view through the cloud security posture management tool. To understand what was happening, the team had to log in to each tool and piece the picture together by hand.

Canoe ran a legacy SIEM operated by a third-party provider. The SIEM shipped with a large default rule set, but Canoe couldn’t see or change most of it. The provider held admin access and wouldn’t say which alerts it had configured, and the team couldn’t check whether its connectors were healthy.

When an alert fired, an analyst at the provider did the initial triage and escalated to Canoe by an email, or with a phone call if an incident came up, often on a weekend or after hours.

That handoff was manual and time-consuming: escalated alerts arrived without much context, so Canoe’s small team still had to investigate them itself. Canoe wanted to eliminate the manual handoff and have far more of the triage happen automatically.

How Canoe uses Artemis

Use Case 1: Security analytics on first-party application logs

Canoe’s platform generates its own audit logs, which record what users and systems do inside the product. With a legacy SIEM, monitoring those logs meant forcing them into a specific format, fixing field parsing, and hand-writing alert logic for Canoe’s own business rules. Like many teams, Canoe found that work kept slipping behind higher priorities.

Now Canoe forwards its platform’s audit logs to Artemis through Datadog. Artemis takes the logs in their existing structure, learns their baseline, and builds detections around it, with no parsers or custom alert logic to maintain. Activity inside Canoe’s own product can now be investigated alongside its cloud, identity, email, and endpoint data, so a suspicious action in the platform becomes part of the same investigation as everything else.

Use Case 2: Replacing a managed SIEM

Canoe’s legacy SIEM needed custom sources parsed by hand, ran on static rules, and left triage to the provider, so the team depended on the provider for every fix. When Artemis pulled Canoe’s existing rules out of the legacy SIEM, many hadn’t been updated in one to two years. Rather than migrate them, Canoe chose to start fresh and let Artemis build detections from its own environment.

Now with Artemis, the Canoe security team is able to run every aspect of what the managed SIEM used to, giving the team more autonomy and less dependency. Canoe’s team set up many of its own connectors, bringing in sources across cloud, identity, email, endpoint, network, and code. Artemis normalizes each source as it arrives, so no one writes or maintains parsers.

Instead of static rules, Artemis put 2,000+ detectors to work across Canoe’s sources within five weeks, including adaptive detectors built from Canoe’s own baselines that keep tuning as the environment changes. Canoe’s team didn’t write or tune a single one. Artemis also took over the triage the provider used to do, and Canoe can now see every detection and every connector, with no change waiting on anyone outside the team.

To catch what’s new, Artemis puts the threat intelligence Canoe already has to work. When Canoe’s cloud security tool published an advisory on a vulnerable AI gateway component and showed no exposure, an Artemis hunt checked further and found the component running in Canoe’s cloud environment. For each new threat, Artemis also checks endpoints and code repositories, then creates a detector so any future activity opens a case.

Canoe went from connecting its first data source to deciding to replace the managed SIEM in about four weeks, and completed the transition by late August.

Use Case 3: Automated triage and plain-language investigation

Before Artemis, an investigation started with an email from the provider, and the team logged in to each security tool to piece together what had happened.

Now with Artemis, triage happens automatically and arrives with context. Artemis builds a model of Canoe’s environment and investigates across sources. Only the investigations that warrant attention reach the team as cases, each with the evidence and reasoning attached. For example, when a CloudTrail alert shows someone deleting a production bucket, the case already shows whether that person’s location matches their baseline in Canoe’s network security tool and whether Google Workspace recorded a burst of authorization attempts.

Day to day, the team works from Slack. They start each morning with Artemis’s daily list of the top things to act on, and anyone on the team can tag Artemis in a channel to investigate an IP address or a user. The team also asks Artemis questions directly in AI Mode when a case needs a closer look. They often have Artemis run the first round of triage, then hand its write-up to an AI coding assistant to keep investigating in Canoe’s codebase.

Use Case 4: Heightened monitoring during an M&A event

Every acquisition brings public attention and a period when attackers expect processes to be in flux. When Canoe’s announcement went out, it was all hands on deck for the security team, which expected phishing and social engineering to follow. The announcement also coincided with one of Canoe’s peak periods, when activity across the business spikes. Artemis monitored the environment throughout the acquisition, and the team could ask Artemis in plain language whether it saw signs of attempted phishing or unusual access, then drill into any activity that needed a closer look.

Canoe’s employees did their part too. As legitimate acquisition-related emails started arriving, staff reported them as suspected phishing, and those reports surfaced in Artemis as well.

Artemis also shows Canoe who attackers are aiming at. A dashboard that combines email security and identity data ranks the executives and senior staff targeted most, so the security team can show leadership the data behind its warnings.

The Result: Artemis became the place Canoe’s security team works

Within five weeks, Artemis had more than 2,000 detectors running across Canoe’s sources, analyzed billions of events, ran hundreds of autonomous investigations, and escalated fewer than one in six to the team as cases. Canoe’s team wrote none of those detections by hand.

Canoe’s team now works directly on its own security data. The team sees across all of its security tools in one place, triage happens automatically, and investigations arrive with context instead of as an email or a phone call. Artemis writes and tunes detections based on how Canoe’s environment actually behaves, and when the team adds a source, including its own platform logs, Artemis handles the detection work.

Next, Canoe plans to connect additional sources to Artemis and expand how it uses the platform, including custom dashboards and executive reporting that show the value of its security program over time to its leadership and new parent company.