# About Oyster

> Oyster is Red Orca's free cybersecurity AI assistant. Who it is for, what it does with and without an account, a worked example, pricing and what it does not do.

Source: https://documentation.redorca.ai/about/
Last updated: 2026-11-01

Oyster is Red Orca's AI assistant for security work. Ask how an attack works and how to detect and prevent it. With a free account you can also question your own files and get cited answers, plan authorized tests inside a scope you declare, and work through incident evidence in SOC Copilot.

Oyster explains and plans — it has no access to your systems and runs nothing against them. [Open Oyster](https://redorca.ai/) to start; one message a day needs no account, and a free account removes the daily limit.

## Who it is for

Offensive technique is in scope as education for defenders: Oyster explains how attacks work so you can detect and prevent them.

- **People learning security.** Students and career-changers who want attacks, defences and tools explained plainly, with concrete examples instead of generalities.
- **Security practitioners.** Penetration testers, SOC analysts and detection engineers who want a second pair of eyes on a plan, a log, a rule or a piece of code.
- **Teams doing authorized work.** Security teams that plan tests against systems they are allowed to test, and want the scope written down before anything else happens.

## What it does today

What you can use depends on whether you have an account. Both are free.

### Without an account

- Chat about security engineering: vulnerabilities, secure coding, hardening, threat modelling, incident response and defensive architecture.
- One message a day.
- The conversation stays in your browser — it is never stored on our servers and never used for training.
- Files you attach go into a temporary space tied to your browser and are deleted after 30 days without use.

### With a free account

- **Chat** — no daily limit, your history saved to your account, and a choice of models. One answer is generated at a time.
- **Questions over your own files** — upload documents, images or video to your private workspace and ask about them. Answers cite the passages they drew on. Up to 20 uploads a day, 50 MB per document, 500 MB in total. See [Upload and organise files](https://documentation.redorca.ai/get-started/files/).
- **Red Team: Scope, Recon, Planner, Fix Advisor, Code Lab** — declare what you are authorized to test first. Recon and test plans are only written for targets inside that scope, and Oyster only writes them: it does not scan, probe or run anything. See [Red Team](https://documentation.redorca.ai/guides/red-team/).
- **Blue Team: SOC Copilot, Security Intel, Cook Book** — a workbench for investigations: open a case, attach evidence, build a timeline, track indicators of compromise, map activity to MITRE ATT&CK, draft detection rules for Sigma, Splunk SPL and Elastic KQL/ES|QL, follow playbooks and export a report. See [Blue Team](https://documentation.redorca.ai/guides/blue-team/).
- **Findings** — keep what you learn as findings. They are private by default; you can share one as a read-only link, or publish it to a feed other signed-in users can read. See [Findings and sharing](https://documentation.redorca.ai/guides/findings/).

Not offered to accounts: running tools against real hosts, and connecting live security monitoring (SIEM) systems. Those stay with Red Orca's own operators.

## A worked example: from a question to a detection

An illustrative walkthrough of the workflow — not a recorded answer. Real answers vary with the question and the model.

1. **You ask:** "What is Kerberoasting, and how would I spot it in our Windows event logs?"
2. **What Oyster does:** explains the technique — MITRE ATT&CK T1558.003: an attacker with any domain account requests Kerberos service tickets and tries to crack them offline to recover service-account passwords — and names the logs where it shows up. It connects to nothing and runs nothing.
3. **What you get back:** the events to watch (Kerberos service-ticket requests, Windows event ID 4769, especially RC4-encrypted tickets), a starting point for a detection rule you can draft in SOC Copilot, and hardening steps: long random service-account passwords, managed service accounts, AES-only encryption.
4. **The limits:** the answer comes from a language model. Check it against your environment and the vendor's documentation before you act. Oyster sees your logs only if you upload them to your own workspace.

## Pricing and access

Oyster is free. The same Red Orca account also opens Dolphin and Shark.

| | Without an account | Free account | Openweight editions |
|---|---|---|---|
| Price | Free | Free | Not yet on sale |
| Chat | One message a day | No daily limit | — |
| Workspace | — | Files, Red Team, Blue Team, Security Intelligence, Findings | — |
| Your data | Conversation stays in your browser | Conversations are used to improve Oyster ([details](https://documentation.redorca.ai/understand/data-and-privacy/)) | Questions and files would stay on your own machine |

Openweight editions — Oyster packaged to run on your own hardware — are listed in the app's Openweight tab but are not on sale yet.

## Your data, in short

- **Without an account**, your conversation stays in your browser. It is not stored on our servers and never used for training.
- **With an account**, your conversations are stored in your account, visible only to you, and used to improve Oyster's AI. That is a condition of the free account, not an optional extra. Exchanges that contain credentials are dropped from training data. You can withdraw in Settings — which also ends chat access — or delete your account and its data there at any time.
- Files you upload stay in your own private workspace. Other accounts cannot see them.
- Oyster's models run on infrastructure Red Orca operates in the EU. Your conversations are not sent to a third-party AI provider.

The full detail is in [Data and privacy](https://documentation.redorca.ai/understand/data-and-privacy/), the [privacy policy](https://redorca.tech/privacy#oyster) and the [terms of service](https://redorca.tech/terms#oyster).

## What Oyster does not do

- Answers come from a language model and can be wrong. Verify anything you act on.
- Oyster has no access to your systems. It cannot scan, probe or exploit anything, and you remain responsible for being authorized to test the systems you discuss.
- It runs on Red Orca's own hardware, so answers can take several seconds, and each account gets one answer at a time.
- It is not a substitute for professional incident response, legal advice or a penetration test.

## Further reading

- [Security AI should understand the attack — without becoming the attack](https://redorca.tech/blog/security-ai-understands-the-attack)
- [Cybersecurity has a knowledge problem. We're building Oyster to solve it.](https://redorca.tech/blog/cybersecurity-knowledge-problem-oyster)

## Who makes Oyster

Oyster is made by [Red Orca](https://redorca.tech/), a European software company that builds AI agents. Its other products are Dolphin, which makes outbound sales calls and sends email, and Shark, which keeps a team's organizational memory. One account signs you in to all three. Questions: [info@redorca.tech](mailto:info@redorca.tech).