Anthropic’s expanded Cyber Verification Program gives approved security teams three levels of access to Claude for defensive work, authorized penetration testing and testing of high-risk systems. For a small-business IT team, the practical takeaway is to check ownership, written authorization, data retention and misuse escalation before using reduced safeguards.
What happened
Anthropic announced on October 6, 2026 that its Cyber Verification Program and Project Glasswing had been combined into one program with three access tiers. Each tier has its own verification requirements, security controls, permitted activities and remaining restrictions.
The expansion gives approved defenders fewer automated blocks for tasks such as incident response, malware analysis, vulnerability validation and authorized penetration testing. Generally available Claude models remain available for code review, patching known issues, finding vulnerabilities in owned source code and triaging security alerts, but their conservative safeguards block most other cyber work.
Does my business qualify for Defense Access?
Defense Access is intended for defensive work, including security operations, incident response, reverse-engineering malware, and analyzing and validating vulnerabilities. According to Anthropic, eligible applicants include company security teams, nonprofits, universities and government bodies that defend systems they own or maintain.
Critical infrastructure operators of any size, including regional hospitals and municipal utilities, may also qualify, along with smaller security firms, open-source maintainers and individual researchers with a record of reporting vulnerabilities. Anthropic expects many organizations conducting defensive cybersecurity work to qualify and aims to respond to Defense Access applications within a few days.
Can our internal team run authorized penetration tests?
Red Team Access adds authorized penetration testing and simulated attacks to the defensive work covered by Defense Access. It is for in-house red teams, government red teams and security or penetration-testing firms. Individual researchers are not currently eligible for this tier.
Participants may perform adversarial testing only against systems they are authorized to test, including information technology systems in critical industries. Anthropic says reviews may take a few weeks, with qualifying organizations receiving Defense Access while their Red Team Access application is reviewed.
Is specialized access relevant to critical infrastructure?
Specialized Access has the fewest cyber blocks, but Anthropic reserves it for a limited group of verified organizations authorized to test safety systems whose disruption could affect people’s lives or markets. Examples include flight operating systems, power grids, telecom networks, interbank transfer infrastructure and government administrative networks.
Anthropic reviews each applicant for this tier in collaboration with the US government. Existing Project Glasswing members transition to Specialized Access without reapproval for the models they already use.
How do the three access tiers compare?
| Tier | Eligible applicants | Permitted use | Approval timing | Remaining safeguards | Data retention |
|---|---|---|---|---|---|
| Defense Access | Defensive security teams, eligible critical infrastructure operators, smaller security firms, open-source maintainers and qualifying individual researchers | Incident investigation, malware analysis, vulnerability analysis and validation | Anthropic aims to respond within a few days | Multi-stage offensive work can still be blocked | Retention is required for Anthropic to monitor for cybersecurity misuse |
| Red Team Access | In-house red teams, government red teams and security or penetration-testing firms | Defensive work plus authorized penetration testing and simulated attacks | Reviews may take a few weeks; qualifying organizations receive Defense Access during review | Real-time blocks remain for ransomware deployment, physical-system damage and penetration testing of high-risk safety systems | Retention is required under the program |
| Specialized Access | A limited number of verified organizations may test critical safety systems. | Authorized testing may involve safety systems that could affect people’s lives or disrupt markets. | Anthropic does not state a review time; review occurs in collaboration with the US government | Has the fewest cyber blocks | Retention is required under the program |
What small businesses and their IT teams should check now
Before considering CVP, assign an owner to each system your team maintains. Confirm that the security team or testing provider has written authorization before testing any system it does not own. Ask the service provider what security data it can retain, where that data is stored and how it is used for monitoring misuse. Keep an escalation contact available for suspected misuse or an incident involving the service. Consider these checks when evaluating security tools and cloud services.
What did the CyScenarioBench benchmark show?
Anthropic evaluated Claude Opus 5.5 on CyScenarioBench, a benchmark that measures whether a model can plan and execute multistage cyber operations under realistic constraints. The company used safeguards configured for each CVP tier and made five attempts at each of the benchmark’s 10 challenges, for 50 trials per tier, according to its program announcement.
Anthropic reported that without CVP access, all 50 trials were blocked at the first prompt. Under Defense Access, 46 trials were blocked at some point and four succeeded. Under Red Team Access, Anthropic reported no blocks, with Claude Opus 5.5 completing 34 of the 50 tasks. It described that result as equivalent to a 67.6% success rate with no safeguards applied, a setting it used to represent Specialized Access.
The vendor-reported figures measure how completion performed under the stated safeguards, challenge conditions and access settings.
What vulnerabilities did Project Glasswing partners find?
Anthropic reported that Project Glasswing partners used Claude Mythos models to identify at least 129,000 verified software vulnerabilities in their own systems between April and July 2026. Separately, Anthropic said open-source scanning from April through October 2026 identified 5,500 vulnerabilities.
Anthropic reported that more than 33,000 vulnerabilities in the combined findings were rated critical or high severity. The company said the total likely undercounts the results because the data came from only a subset of Glasswing partners.
How is access available?
The program is available through the Claude Platform, Google Cloud’s Vertex AI and Microsoft Foundry. Access through Amazon Bedrock is limited to customers eligible for Enterprise Frontier Safeguards.
Applicants must complete verification and provide evidence of the security controls required for their selected tier. Existing CVP members will be evaluated automatically for access to Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1, with their previous model settings retained.
Anthropic says Enterprise Frontier Safeguards is expected later in the fall. It is intended to let eligible companies store data in cloud infrastructure they control while maintaining misuse safeguards. Until that release, organizations approved to use Claude Fable 5.1 or Claude Mythos 5.1 with zero data retention may also use CVP with zero data retention.
FAQ
What is the Anthropic Cyber Verification Program?
It is an expanded program for approved cybersecurity professionals that provides access to advanced Claude capabilities with fewer automated blocks for tasks such as malware analysis, vulnerability testing and authorized penetration testing. It combines the former Cyber Verification Program and Project Glasswing into one program with three access tiers.
How many vulnerabilities did Project Glasswing partners find?
Anthropic reported that partners used Claude Mythos models to uncover at least 129,000 verified software vulnerabilities in their systems between April and July 2026. Anthropic identified another 5,500 through open-source scanning between April and October, and more than 33,000 of the combined findings were rated critical or high severity.
What did the CyScenarioBench benchmark show by tier?
Anthropic reported that all 50 trials without CVP access were blocked at the first prompt. Defense Access allowed four of 50 to succeed, while Red Team Access recorded no blocks and enabled Claude Opus 5.5 to complete 34 of 50 tasks.
BizScoreAI
BizScoreAI scores how visible a business is to AI search and shows what its listing looks like to the engines people ask. Open the free listing check.