Anthropic’s Cyber Verification Program Reduces Claude Security Blocks for Verified Defenders: Who on Your Team Should Hold the Badge

Picture this: your building hands out a new master key, and only people who pass a background check can get one. That sounds sensible until you are the one deciding which of your employees carries it, which doors it opens, and who reviews the log afterward. That is roughly the governance question Anthropic’s Cyber Verification Program now puts in front of security teams. The program reduces some Claude security blocks for verified defenders, and it hands each organization the job of deciding who internally gets the sharper tool.

Here is what Anthropic actually documents, what it does not, and the questions I would want answered before turning it on.

What the Anthropic Cyber Verification Program Changes for Claude Security Work

Anthropic’s October 6, 2026 announcement describes an “expanded version” of the Cyber Verification Program, or CVP. It says the CVP “makes advanced cyber capabilities and reduced blocking classifiers available to qualifying security professionals.” The starting point matters. Anthropic says its generally available models, such as Claude Opus 5.5, Claude Fable 5.1 and Claude Sonnet 5.5, “have conservative cyber safeguards that block most cyber work.” Its reasoning is that cybersecurity is “inherently dual use”: the same capability that helps a team find and fix a flaw can help an attacker exploit it.

The general models are not useless for security. Anthropic’s Help Center page for the program says they can still be used for secure code review, threat modeling, patching known issues, finding vulnerabilities in your own source code and triaging alerts. But it warns that “other cyber security work like malware analysis or exploit validation may be interrupted by our safety classifiers.” The CVP is the route for professionals whose legitimate work is getting blocked.

This is also a merger. Anthropic says that for the past six months it ran two programs: Project Glasswing, which gave organizations securing critical software access to Claude Mythos, and the original CVP, which gave vetted teams “access to reduced safeguards on Claude Opus and Claude Sonnet models.” The new CVP integrates both. Each tier includes Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1 and future models.

Three Tiers, Documented

Anthropic documents three access tiers, each with “different verification requirements and security controls”:

• Defense Access covers defensive work such as SOC and incident response tasks, reverse-engineering malware, and analyzing and validating vulnerabilities. Anthropic’s examples of qualifying organizations include corporate, nonprofit, university and government security teams defending their own systems; critical infrastructure operators of any size; smaller security firms; open-source maintainers; and individual researchers with a track record of reported vulnerabilities. It is the only tier open to individuals, and only on a paid plan.
• Red Team Access adds authorized penetration testing and red-teaming, for organizations only. Testing is limited to systems they are authorized to test. Anthropic says users “will still experience real-time blocks” on actions that could cause physical harm or mass disruption, such as deploying ransomware or damaging physical systems.
• Specialized Access “has the fewest cyber blocks.” It is reserved for a limited set of verified organizations authorized to test safety systems such as flight operating systems, power grids, telecom networks and interbank transfer infrastructure. Anthropic says it reviews every one of them “in depth in collaboration with the US government,” and existing Glasswing members move into this tier.

Anthropic also published results from its own evaluation, CyScenarioBench, run against Claude Opus 5.5 under each tier’s safeguards. It reported that without CVP every task was blocked on the first prompt, and that in Defense Access 46 of 50 trials were blocked at some point. In Red Team Access there were no blocks, and the model completed 34 of 50 tasks. That is vendor-run testing on a vendor-built benchmark, so read it as Anthropic’s evidence that the tiers behave differently, not as independent validation.

Who Checks the Badge

Here the documentation is useful but not complete. Anthropic says it “will verify all applicants and request proof of the required security controls for the relevant access tier.” The Help Center lists what an application needs: organization and applicant details for identity verification, a description of your security work, and “an attestation to the security controls applicable to your desired tier.” Organizations apply once, and admins then designate seats or assign the program to workspaces or custom roles. Anthropic aims to answer within seven business days and places each applicant “at the highest tier” its information supports. The announcement adds that Red Team reviews take “a few weeks.”

The Help Center also lists factors that can rule an organization out. These include the nature of the work, whether Anthropic can verify who the organization is, the legal and regulatory environment and the risk access “could be compelled,” and a more cautious approach for organizations that primarily serve military, intelligence or law enforcement customers.

A few strings stay attached. The Usage Policy “still applies in full.” Anthropic says it “may review, narrow, or withdraw a grant.” Data retention is required “so that we can monitor for cyber misuse,” with limited zero-data-retention exceptions until Anthropic’s Enterprise Frontier Safeguards option arrives. Defense Access members have until December 15, 2026 to adopt phishing-resistant MFA and stop using API keys. CVP access also cannot be used to build a client-facing product without a separate approval.

What is not public: the exact scoring behind tier placement, how attestations are checked in practice, and precisely which classifier behaviors change in each tier beyond Anthropic’s examples. SecurityWeek’s coverage matches Anthropic’s description of the three-tier structure, but I have not seen independent detail beyond that.

Opinion: The Real Badge Check Happens Inside Your Org

This section is my opinion. Anthropic is checking the organization. Once a grant lands, your admins decide which workspaces, roles and seats get it. That makes CVP an internal privileged-access problem as much as a vendor program, and I would govern it like one:

• Map the tier to job duties. Only people whose work actually needs malware analysis or exploit validation should sit in a CVP-enabled workspace.
• Treat the workspace like a privileged group. Use named seats, periodic access reviews, and removal on role change.
• Log on your side too. Anthropic retains data for misuse monitoring, but that is its monitoring, not yours. Keep your own record of who used the elevated workspace and for which engagement.
• Get the controls done early. Phishing-resistant MFA and moving off API keys are good hygiene anyway, and the deadline is documented.
• Write down scope. Red Team Access is limited to systems you are authorized to test. Keep that authorization paperwork next to the access list.

A sharper tool for defenders is a reasonable idea. The part that will decide whether it stays reasonable is the boring part: who holds the badge, and who reads the log.