OrcaRouter this week launched OrcaCyber Zero 1.5, a cybersecurity model claiming 100% on Cybench and 95.8% on a CVE-Bench subset.
Key Takeaways
OrcaRouter launched OrcaCyber Zero 1.5, claiming 100% on Cybench and 95.8% on a CVE-Bench subset
The model has a 1 million token context window and costs $3.00 per million input tokens
OrcaRouter reports a 2,947 millisecond average response time for OrcaCyber Zero 1.5
OrcaRouter has not disclosed training data sources or independent third-party verification of its benchmark scores
The model carries a 1 million token context window, letting it process entire codebases, log files or incident reports in a single pass. OrcaRouter prices it at $3.00 per million input tokens with a 2,947 millisecond average response time, per the specifications it published.
Cybench and CVE-Bench are two of the standard yardsticks security researchers use to grade how well an AI model can replicate the reasoning of a human penetration tester.
Cybench asks a model to complete capture-the-flag style hacking challenges end to end, while CVE-Bench tests whether a model can identify and reason about known software vulnerabilities cataloged in the Common Vulnerabilities and Exposures database.
A perfect Cybench score means OrcaCyber Zero 1.5 completed every challenge in that test set without human intervention, a result few general-purpose models reach because the tasks require multi-step exploitation chains rather than single-shot answers.
Why A Narrow Model Beats A General One Here
OrcaCyber Zero 1.5 is built specifically for what OrcaRouter calls “complex, multi-step security workflows” rather than general chat or coding. That specialization matters because frontier general models from the big labs routinely underperform narrower, domain-tuned systems on adversarial security benchmarks, where a single missed step breaks the whole exploit chain.
The 1 million token context lets the model read an entire log dump, a multi-file codebase or a full incident report at once, instead of the chunked summaries narrower-context tools require.
For security operations teams, that removes a step where human analysts previously had to pre-digest material before handing it to a model.
Also Read: StarkWare CEO Warns Quantum Threat Is Near, STRK Rallies 20% In Two Days
The practical comparison is Sophos‘s recently disclosed use of OpenAI‘s Daybreak tool, which cut threat investigation time by 96% largely by automating triage, not full exploitation. OrcaCyber Zero 1.5 is pitched at a different point on that spectrum, closer to autonomous offensive testing than defensive triage.
From General Chatbots To Purpose-Built Security Tools
The broader AI industry has moved from general-purpose chat assistants toward task-specific models tuned for narrow, high-stakes domains such as coding, legal review and now offensive security testing.
OrcaRouter itself operates as a model aggregation and routing layer, letting developers switch between more than 200 models through a single API rather than integrating each provider separately.
The company also runs an open-source routing gateway and a public archive of real-world AI agent incidents, positioning itself as infrastructure for teams running multiple models at scale rather than a single-model lab.
What Enterprise Buyers Should Watch Next
OrcaRouter has not disclosed training data sources or independent third-party verification of the Cybench and CVE-Bench scores beyond its own model card. Security teams evaluating the model will want to see results replicated on an independent benchmark run, and watch whether rivals such as general frontier labs respond with their own narrow security variants.
Pricing at $3.00 per million input tokens positions it below many frontier general models, a detail that will matter most to security operations centers running high query volumes.
Read Next: Upstage’s Solar Mini 4 Hits 208 Tokens/Sec Free In Cline, Tops AAII Score