Cybersecurity Has a Knowledge Problem. We're Building Oyster to Solve It.

A penetration tester begins an investigation.

They identify a product version, unusual service, configuration, CVE or suspicious behaviour. What happens next?

The work moves across multiple worlds.

• Search the CVE.
• Check the National Vulnerability Database (NVD).
• Check CISA's Known Exploited Vulnerabilities (KEV) Catalog.
• Search vendor advisories.
• Look through MITRE ATT&CK.
• Search GitHub.
• Read technical write-ups.
• Check exploit and proof-of-concept repositories.
• Search detection rules.
• Look for related techniques.
• Compare versions.
• Determine whether the vulnerability is actually exploitable in this environment.
• Then convert everything into something another human can understand and act on.

None of these resources is the problem. The problem is the distance between information and understanding.

That distance is becoming increasingly difficult for humans to manage.

Vulnerability information is growing faster than the old workflow

In April 2026, NIST announced changes to how it operates the National Vulnerability Database in response to the growth in CVE submissions. According to NIST, CVE submissions increased 263% between 2020 and 2025. NIST also reported that it enriched nearly 42,000 CVEs in 2025 — 45% more than in any previous year — while submission growth continued to outpace enrichment capacity.

CVE submissions during the first quarter of 2026 were nearly one-third higher than during the same period in 2025. In response, NIST is moving toward a more risk-based operating model in which some vulnerabilities receive priority for enrichment while others may remain unenriched for longer.

That is not a failure of NVD. It is evidence of a broader shift:

Cybersecurity has entered a scale problem.

Humans are generating, discovering and consuming security information faster than traditional knowledge infrastructure was designed to handle.

Meanwhile, exploitation does not wait for research to become convenient

CISA maintains its Known Exploited Vulnerabilities Catalog as an authoritative source of vulnerabilities with evidence of exploitation in the wild. The catalogue is not intended to replace severity scoring or local risk assessment. It provides a separate exploitation signal that organisations can use for prioritisation.

That distinction matters.

A vulnerability can have a high CVSS score without being relevant to a particular environment. Conversely, evidence of active exploitation can make a vulnerability operationally urgent even when severity alone does not fully capture the risk.

For defenders and penetration testers, this creates an increasingly difficult question:

Does it matter here?

• Is the affected version deployed?
• Is exploitation known?
• Is there an attack path?
• What technique does it enable?
• What prerequisites exist?
• What mitigations are available?
• What evidence supports the conclusion?
• And what should the security team do next?

A CVSS score cannot answer all of that.

A search engine cannot reliably assemble all of it.

And an LLM that knows something about cybersecurity is not automatically a cybersecurity investigation system.

This is the problem behind Oyster

At Red Orca, we are building Oyster around a different assumption.

The future of cybersecurity AI should not simply be:

Give an AI access to hacking tools and tell it to attack something.

Autonomous penetration-testing platforms are emerging. Continuous security validation platforms are becoming more capable. AI systems can increasingly assist with reconnaissance, vulnerability discovery and attack-path validation.

That progress matters. But it addresses only part of the problem.

Security professionals also need an intelligence layer between the enormous body of cybersecurity knowledge and the decisions they make.

That is the direction of Oyster.

Think less “AI scanner.” Think cybersecurity intelligence workspace.

Oyster is being developed to bring security knowledge, reasoning and authorised testing workflows into one environment.

Instead of forcing a security professional to move manually between disconnected sources, Oyster is designed to connect the evidence.

A researcher investigating a vulnerability should be able to move from:

asset → technology → vulnerability → exploitation evidence → attack technique → testing methodology → evidence → remediation → report

without rebuilding the research context at every step.

Oyster is being built around cybersecurity-specific knowledge rather than generic web search alone. Its planned knowledge work includes structured security sources and frameworks covering vulnerability intelligence, attack techniques, web security, defensive rules, testing methodologies and exploitation knowledge.

That distinction matters.

A general-purpose AI can explain what SQL injection is.

A cybersecurity system should help a professional understand: whether this particular environment may be vulnerable, what evidence supports that conclusion, how it relates to known techniques, what authorised validation makes sense and what should happen next.

Those are fundamentally different problems.

The pentester's browser-tab problem

Ask experienced security professionals how research happens during an engagement and you will often find an enormous collection of tabs, terminals, scripts, notes and bookmarks.

Some of that complexity is unavoidable. Cybersecurity itself is heterogeneous.

But a significant amount of expert time is spent not performing sophisticated exploitation, but retrieving, correlating and reformatting information.

The tester knows what they are looking for. The knowledge exists. The problem is assembling it quickly enough.

That becomes particularly painful when findings need to become evidence.

A penetration test does not end when someone discovers a weakness.

• Someone has to establish what happened.
• Someone has to document it.
• Someone has to determine severity and business relevance.
• Someone has to recommend remediation.
• Someone may need to reproduce it.
• Someone eventually needs to verify that the remediation worked.

The intelligence surrounding a vulnerability therefore matters almost as much as detecting it.

This is where software can create leverage: not by replacing expertise, but by reducing the friction between discovery, investigation, validation and communication.

AI penetration testing is arriving — but trust remains unresolved

The cybersecurity market is rapidly experimenting with autonomous testing.

For example, Horizon3.ai's NodeZero markets autonomous penetration testing and describes capabilities including identifying exploitable attack paths, supporting remediation and validating fixes. Other vendors are developing products in adjacent categories, including autonomous penetration testing, continuous security validation and attack-path analysis.

The direction is clear: security validation is becoming more continuous and more automated.

But autonomy introduces a second problem: control.

Cybersecurity is one of the worst possible environments for unconstrained AI actions.

The difference between a useful test and an incident can be one command executed against the wrong target.

Useful cybersecurity agents therefore need boundaries.

• Scope matters.
• Authorisation matters.
• Human approval matters.
• Auditability matters.
• Evidence matters.

Oyster's direction is not based on removing the security professional from the loop. It is based on giving that professional considerably more leverage while preserving control over consequential actions.

The opportunity is not another chatbot

Cybersecurity already has AI assistants. It has vulnerability scanners. It has attack-surface management platforms. It has autonomous pentesting products. It has threat-intelligence platforms. It has enormous public and private knowledge bases.

The opportunity is not to add another interface to one of those categories. It is to connect the work that currently happens between them.

A system capable of reasoning across cybersecurity knowledge while supporting the actual investigation workflow.

• One that can understand documents, code, logs and findings.
• One that can connect vulnerability information with exploitation and threat context.
• One that can assist authorised testing rather than blindly executing it.
• One that preserves evidence and helps transform technical discoveries into defensible findings.
• And eventually, one that becomes more useful as the security world's collective knowledge becomes larger and harder for any individual human to navigate.

That is a different product thesis from simply putting a chatbot beside a vulnerability scanner.

Why now?

Because the economics of cybersecurity knowledge are changing.

The amount of vulnerability information is increasing, as reflected in NIST's reported growth in CVE submissions and its resulting changes to NVD operations.

The speed at which vulnerabilities can be researched is increasing.

The speed at which attackers can operationalise information is increasing.

AI is accelerating both sides.

Yet the human responsible for making the final security decision still has roughly the same number of hours in a day.

That creates an intelligence bottleneck.

The next generation of cybersecurity tooling will not be defined only by its ability to produce more alerts. Its value will increasingly depend on its ability to turn fragmented information into the right context at the right moment.

That is the bet behind Oyster.

• Not replacing penetration testers.
• Not replacing security researchers.
• Not pretending cybersecurity can be reduced to a prompt.

Building infrastructure that allows them to investigate faster, connect more information, preserve evidence and make better decisions.

The cybersecurity industry spent decades building extraordinary databases, frameworks, tools and research communities.

Now it needs a better way to reason across them.

The internet gave security professionals access to the world's cybersecurity knowledge.

Oyster is our attempt to make that knowledge usable as one intelligence layer.

Oyster is being developed by Red Orca as an AI-powered cybersecurity intelligence and authorised security-testing platform. Product capabilities described here include functionality under active development. References to NIST, CISA, NodeZero and broader market activity distinguish publicly documented facts or vendor claims from Red Orca's interpretation and Oyster's product vision.