Anthropic expands its Cyber Verification Program into three tiers of access to advanced cyber capabilities on Opus 5.5, Sonnet 5.5 and Mythos 5.1
Generally available Claude models block most cyber work by default; verified security teams can now apply for one of three tiers of relaxed safeguards matched to their work.
// Key points
- Defense Access covers SOC work, incident response, malware reverse engineering and vulnerability analysis; companies, universities, government security teams, open-source maintainers and individual researchers with a disclosure record can apply, with responses targeted within a few days.
- Red Team Access adds authorized penetration testing and red-teaming, for organizations only, with reviews taking a few weeks; Specialized Access covers safety-critical systems such as flight software, power grids and telecom, reviewed case by case with the US government.
- On CyScenarioBench, the Defense tier blocked 46 of 50 tasks on Opus 5.5; the Red Team tier blocked none and completed 34 of 50, the same as with no safeguards.
- Enrolled organizations must retain data for misuse monitoring; once Enterprise Frontier Safeguards arrives this fall, they can store it in cloud infrastructure they control. CVP is available on the Claude Platform, Vertex AI and Microsoft Foundry.
Builder's takeIf your team keeps getting blocked when using Claude for code audits or security triage, this is the proper route: apply for the Defense tier first, since it's reviewed fastest. Note that enrolling means data retention, so for products handling private user files like my AI Cloud Drive, run security testing against a scrubbed copy rather than real user data.