Benefits of the Claude Cyber Verification Program

Ask a general-availability Claude model to pull apart a malware sample and it may stop halfway. Anthropic says that kind of work "may be interrupted by our safety classifiers". The Claude Cyber Verification Program (CVP) gives vetted security teams reduced blocking, and on October 6, 2026 Anthropic expanded it into three tiers.

How the Claude Cyber Verification Program tiers work

Every tier covers Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1 and future models.

| Tier | Who it is for | What it allows | | --- | --- | --- | | Defense Access | Teams defending systems they own or maintain, critical infrastructure operators, open-source maintainers | SOC and incident response, malware reverse engineering, vulnerability analysis and validation | | Red Team Access | In-house and government red teams, pen-testing firms | Everything in Defense, plus authorized pen testing and red teaming | | Specialized Access | A limited set of organizations testing safety systems, such as power grids or flight operating systems | Fewest cyber blocks |

Individuals can apply only for Defense Access, on a paid plan.

Five benefits of the Claude Cyber Verification Program

1. Defensive work stops hitting the classifier. Defense Access is built for daily SOC work: incident response, malware reverse engineering and validating vulnerabilities.

2. Authorized red teaming on a frontier model. Red Team Access adds penetration testing against systems you are authorized to test. Anthropic ran Claude Opus 5.5 through 10 challenges with five attempts each, so 50 trials per tier. These are Anthropic's numbers, from one model on one benchmark of offensive scenarios:

| Access | Result | | --- | --- | | No CVP access | Every task blocked on the first prompt | | Defense Access | 46 of 50 trials blocked at some point, four succeeded | | Red Team Access | No blocks, 34 of 50 tasks completed | | No safeguards | 67.6% success rate |

Anthropic calls the Red Team result effectively equivalent to the no-safeguards rate. Ransomware deployment, damaging physical systems and pen testing high-risk safety systems stay blocked even at Red Team level.

3. One grant that follows the models. Because every tier covers future models, existing members keep their settings for earlier models and are automatically evaluated for Opus 5.5, Sonnet 5.5 and Mythos 5.1.

4. It runs on the platforms you already use, with limits. CVP is available on Claude Platform, Google Cloud Vertex AI and Microsoft Foundry. An admin assigns it to specific workspaces, so reduced blocking does not spread across the organization. Amazon Bedrock is limited to customers eligible for Enterprise Frontier Safeguards and, per Anthropic's support page, lacks the human review of safety flags that CVP requires by default.

5. A security baseline you would want anyway. Defense Access requires MFA from day one. By December 15, 2026, accounts must use phishing-resistant MFA (a FIDO2/WebAuthn key, a passkey or a smartcard) and static credentials such as API keys must stop reaching the model. SMS codes, authenticator-app codes and push approvals do not qualify. The security requirements article lists the rules per platform, including no downloaded service account JSON keys on Vertex AI and no IAM access key pairs on Bedrock.

Audit your static credentials before you apply:

# Google Cloud: list user-managed (downloadable) keys on a service account
gcloud iam service-accounts keys list \
  --iam-account=<service-account-email> \
  --managed-by=user

# AWS: list long-lived access keys for an IAM user
aws iam list-access-keys --user-name <iam-user-name>

Anything these return that can call the model is a credential to replace before the cutoff. Red Team Access asks for more: at most 25 approved users, Customer-controlled devices, background checks and credentials that expire within 12 hours.

When the Claude Cyber Verification Program is not worth it

Skip it if your work is routine bug finding and fixing. The general-availability models stay usable for secure code review, threat modeling, patching known issues, finding vulnerabilities in your own code and triaging security alerts.

Skip it too if you plan to build a client-facing product on the grant, which needs a separate productization application. CVP also requires data retention so Anthropic can monitor misuse, and Anthropic may review, narrow or withdraw a grant.

Where to start

Apply through the Verification Portal, one application per organization, and start with Defense Access. Expect a response in a few days for Defense and a few weeks for Red Team; Red Team applicants are enrolled in Defense during review.

If you deploy AI into security operations, CVP decides whether the model finishes the job or stops halfway, so check your credentials and cloud platform before you apply.