Eleven thousand eight hundred and ninety-five times in twenty-eight days, someone searched for `orca cyber`. Through OrcaRouter those searches land on a single card — OrcaCyber Zero 1.5 — and nineteen of them clicked through [OURS]. That ratio of one click in six hundred and twenty-six is not a story about a model nobody wants. It is a story about demand arriving faster than the page that serves it, and about what a reader actually finds when they land.
Searches are a proxy for intent, and the intent behind this one is unambiguous: a named security model, looked up by name. The question worth answering is what the person gets when they finally arrive.
What Zero 1.5 actually is
OrcaCyber Zero 1.5 was released 2026-10-10 as the successor to Zero 1.0. It is a frontier cybersecurity model post-trained for authorized security engineering: vulnerability research and reproduction, exploit development, penetration testing, security auditing, and multi-step cyber reasoning [OURS].
The specification is built for that work rather than for chat:
| Property | Value |
| Input / output per million | $3.00 / $7.50 |
| Cache read per million | $0.75 |
| Context window | 1,000,000 |
| Output ceiling | 128,000 |
| Modalities | text in, text out |
| Capabilities | tools, JSON, reasoning |
| Zero-data-retention option | yes |
Note what is absent: no image input. That is a deliberate difference from the Flash tier, which does accept screenshots and diagrams. Zero 1.5 is a text-reasoning card, and the 128,000-token output ceiling is sized for an audit report, not for a book.
Access is gated to the Security Research tier — trusted researchers, red teams, and authorized testing [OURS]. That gate exists because a model tuned for this work has no useful safety posture outside it, and the page says so rather than pretending otherwise.
The four rows it publishes
OrcaCyber reports four evaluations for this card, all from 2026-10-09 and none independently reproduced [VENDOR]:
- CVE-Bench, evaluable subset — 95.8%
- Cybench, unrestricted agent execution — 100%
- HumanEval+ — 93.9%
- SWE-bench Pro V2 — 76.5%
The 100 deserves a footnote rather than a headline. Cybench in unrestricted agent execution measures whether the model completes a set of security challenges when the harness lets it act freely. A perfect score says the model does not stop to argue with the harness. It does not say the model is perfect at security.
The pairing that carries more information is 95.8 on the evaluable CVE subset against 76.5 on SWE-bench Pro V2. The first is security reasoning; the second is engineering delivery. A twelve-or-so point gap in the direction of reasoning tells you the model is better at finding and explaining than at producing production-quality patches. That is a useful thing to know before you hand it a remediation backlog.
The serving numbers
Published benchmarks describe the model. Traffic describes the deployment, and for a security model that is the more decision-relevant half.
Over the seven days ending 2026-10-26, Zero 1.5 moved 30,631,363,967 tokens on our gateway — thirty point six billion, the largest weekly volume in the OrcaCyber family — with a p50 first token of 1,749 ms, a p95 of 10,000 ms, output throughput of 114.5 tokens per second, and an error rate of 0.075% [OURS].
Two readings. The error rate is the lowest of any card discussed in this series, which matters when the workload is a long audit that you cannot afford to restart. And 1,749 ms to first token on a model that is reasoning over a million-token context means the prefill is not the bottleneck — the reasoning is.
What changed from Zero 1.0
Zero 1.5 replaced a card released three weeks earlier, on 2026-09-17, at exactly the same price: $3.00 and $7.50 per million, one million tokens of context [OURS]. The prices did not move. The serving profile did, dramatically.
| Metric (7 days) | Zero 1.0 | Zero 1.5 |
| p50 first token | 10,000 ms | 1,749 ms |
| Output throughput | 237.4 tok/s | 114.5 tok/s |
| Error rate | 2.69% | 0.075% |
| Tokens | 5.98 B | 30.63 B |
Two of those rows deserve a sentence each.
The error rate fell by a factor of about thirty-six, from 2.69% to 0.075%. If you evaluated the predecessor and concluded that the family was unreliable, that conclusion is now out of date; the successor’s failure rate is in the same range as a well-run text endpoint.
The p50 first token fell from ten seconds — the platform’s reporting cap, which suggests the real figure was at or above it — to 1.75 seconds. That is the difference between a card you can put behind a person and a card you can only batch.
Throughput moved the other way, from 237 to 114 tokens per second. A trade, presumably: more careful generation for fewer tokens a second. For audit work that is the right direction, because the output is read rather than streamed.
Volume followed the improvement: five point nine eight billion tokens to thirty point six three billion in the two weeks either side of the release. People moved to the new card, which is the normal verdict on a successor that fixes reliability.
The lesson for anyone reading a model page is to check the date on the telemetry. A card’s reputation and its current behaviour can be three weeks apart.
Why the click rate is low, and why it will move
The page ranks around position six for its own brand-adjacent query. At that position a result is below the fold on most screens, competes with five other answers, and often loses to whatever the search engine has decided to show above the organic list.
The same query set contains a natural control. `orca cyber zero` — a shorter, more specific variant — lands on this page at position 1.6 and converts twenty-four clicks from seventy-nine impressions, a rate roughly a hundred and ninety times higher [OURS]. Same page, same searcher, different position.
Nothing about that arithmetic is unique to this model. It is the normal shape of a name query: demand concentrates at the top three results, and everything below position five is effectively a preview. The reason it is worth writing about here is that the gap is unusually large, because “orca cyber” is a name query with no dominant incumbent — there is no Wikipedia article, no vendor homepage from a decade ago, no incumbent product to displace. The page that ranks third inherits the query.
Who should look at it?
Three profiles fit this card rather than the cheaper Flash tier.
Teams auditing code they cannot send to a general model. The refusal-free behaviour is the point, and the gate exists to keep it scoped to authorized work.
Workflows that need one uninterrupted pass. A million-token context with a 128,000-token output ceiling covers a repository read plus a full report, without a retrieval layer and without stitching.
Pipelines that need structured output. JSON response format and native function calling mean the model’s findings can be parsed by the next step rather than pasted into a queue by hand.
The Flash tier is the right choice for the same work at higher volume and lower price, with image input and a wider output ceiling. The trade is per-token price against per-request cost at the ceiling — a subject for the pricing article in this set.
The takeaway
Zero 1.5 is the middle tier of a three-card security family: $3.00 and $7.50 per million, one million tokens of context, 128,000 tokens out, and a published profile of 95.8 on CVE-Bench and 76.5 on SWE-bench Pro V2. Thirty billion tokens a week pass through it on our gateway with an error rate under a tenth of a percent.
The search data says the demand for that name is real and the supply of answers is thin. For anyone evaluating a security model this month, that combination is worth a look — and the four published rows are specific enough to check against your own work.
Sourcing note: pricing, context, latency, traffic, and error rate are from the OrcaRouter model page and production telemetry for the seven days ending 2026-10-26 [OURS]. The four benchmark rows are OrcaCyber’s own published claims, evaluated 2026-10-09 and not independently reproduced [VENDOR]. Search impressions and positions are Search Console data for 2026-09-29 to 2026-10-26 [OURS].
Erin Durkheim is an author and content contributor at Gingerbread Nails, covering nail designs, nail care, beauty tips, fashion, and product-related topics. She focuses on creating practical, easy-to-understand content that helps readers explore nail trends, care routines, and everyday beauty ideas.