About Oyster

Oyster is Red Orca’s AI assistant for security work. Ask how an attack works and how to detect and prevent it. With a free account you can also question your own files and get cited answers, plan authorized tests inside a scope you declare, and work through incident evidence in SOC Copilot.

Oyster explains and plans — it has no access to your systems and runs nothing against them. Open Oyster to start; one message a day needs no account, and a free account removes the daily limit.

Who it is for

Offensive technique is in scope as education for defenders: Oyster explains how attacks work so you can detect and prevent them.

• People learning security. Students and career-changers who want attacks, defences and tools explained plainly, with concrete examples instead of generalities.
• Security practitioners. Penetration testers, SOC analysts and detection engineers who want a second pair of eyes on a plan, a log, a rule or a piece of code.
• Teams doing authorized work. Security teams that plan tests against systems they are allowed to test, and want the scope written down before anything else happens.

What it does today

What you can use depends on whether you have an account. Both are free.

Without an account

• Chat about security engineering: vulnerabilities, secure coding, hardening, threat modelling, incident response and defensive architecture.
• One message a day.
• The conversation stays in your browser — it is never stored on our servers and never used for training.
• Files you attach go into a temporary space tied to your browser and are deleted after 30 days without use.

With a free account

• Chat — no daily limit, your history saved to your account, and a choice of models. One answer is generated at a time.
• Questions over your own files — upload documents, images or video to your private workspace and ask about them. Answers cite the passages they drew on. Up to 20 uploads a day, 50 MB per document, 500 MB in total. See Upload and organise files.
• Red Team: Scope, Recon, Planner, Fix Advisor, Code Lab — declare what you are authorized to test first. Recon and test plans are only written for targets inside that scope, and Oyster only writes them: it does not scan, probe or run anything. See Red Team.
• Blue Team: SOC Copilot, Security Intel, Cook Book — a workbench for investigations: open a case, attach evidence, build a timeline, track indicators of compromise, map activity to MITRE ATT&CK, draft detection rules for Sigma, Splunk SPL and Elastic KQL/ES|QL, follow playbooks and export a report. See Blue Team.
• Findings — keep what you learn as findings. They are private by default; you can share one as a read-only link, or publish it to a feed other signed-in users can read. See Findings and sharing.

Not offered to accounts: running tools against real hosts, and connecting live security monitoring (SIEM) systems. Those stay with Red Orca’s own operators.

A worked example: from a question to a detection

An illustrative walkthrough of the workflow — not a recorded answer. Real answers vary with the question and the model.

1. You ask: “What is Kerberoasting, and how would I spot it in our Windows event logs?”
2. What Oyster does: explains the technique — MITRE ATT&CK T1558.003: an attacker with any domain account requests Kerberos service tickets and tries to crack them offline to recover service-account passwords — and names the logs where it shows up. It connects to nothing and runs nothing.
3. What you get back: the events to watch (Kerberos service-ticket requests, Windows event ID 4769, especially RC4-encrypted tickets), a starting point for a detection rule you can draft in SOC Copilot, and hardening steps: long random service-account passwords, managed service accounts, AES-only encryption.
4. The limits: the answer comes from a language model. Check it against your environment and the vendor’s documentation before you act. Oyster sees your logs only if you upload them to your own workspace.

Pricing and access

Oyster is free. The same Red Orca account also opens Dolphin and Shark.

	Without an account	Free account	Openweight editions
Price	Free	Free	Not yet on sale
Chat	One message a day	No daily limit	—
Workspace	—	Files, Red Team, Blue Team, Security Intelligence, Findings	—
Your data	Conversation stays in your browser	Conversations are used to improve Oyster (details)	Questions and files would stay on your own machine

Openweight editions — Oyster packaged to run on your own hardware — are listed in the app’s Openweight tab but are not on sale yet.

Your data, in short

• Without an account, your conversation stays in your browser. It is not stored on our servers and never used for training.
• With an account, your conversations are stored in your account, visible only to you, and used to improve Oyster’s AI. That is a condition of the free account, not an optional extra. Exchanges that contain credentials are dropped from training data. You can withdraw in Settings — which also ends chat access — or delete your account and its data there at any time.
• Files you upload stay in your own private workspace. Other accounts cannot see them.
• Oyster’s models run on infrastructure Red Orca operates in the EU. Your conversations are not sent to a third-party AI provider.

The full detail is in Data and privacy, the privacy policy and the terms of service.

What Oyster does not do

• Answers come from a language model and can be wrong. Verify anything you act on.
• Oyster has no access to your systems. It cannot scan, probe or exploit anything, and you remain responsible for being authorized to test the systems you discuss.
• It runs on Red Orca’s own hardware, so answers can take several seconds, and each account gets one answer at a time.
• It is not a substitute for professional incident response, legal advice or a penetration test.

Further reading

• Security AI should understand the attack — without becoming the attack
• Cybersecurity has a knowledge problem. We’re building Oyster to solve it.

Who makes Oyster

Oyster is made by Red Orca, a European software company that builds AI agents. Its other products are Dolphin, which makes outbound sales calls and sends email, and Shark, which keeps a team’s organizational memory. One account signs you in to all three. Questions: info@redorca.tech.