Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Anthropic’s Cyber Verification Program (CVP) is an application-based access program for verified security professionals. It offers different levels of access to cyber capabilities and, on selected Claude models, less restrictive cyber classifiers than ordinary access. It is not unrestricted offensive access: every tier has eligibility checks, security requirements and continuing limits on activities that could enable physical harm or mass disruption.
The program announced on October 6, 2026 has three tiers. Defense Access covers defensive security work and can include qualified individual researchers. Red Team Access adds authorized penetration testing but is currently limited to organizations. Specialized Access is a tightly reviewed option for organizations testing safety-sensitive systems such as power grids, flight systems or interbank infrastructure.
As an Amazon Associate I earn from qualifying purchases.
What Anthropic’s Cyber Verification Program is
Anthropic describes CVP as an expanded program that combines its earlier Cyber Verification Program with Project Glasswing. The goal is to give more legitimate defenders access to advanced cyber capabilities while managing the dual-use risk of vulnerability research. Anthropic’s announcement puts the issue plainly: “Cybersecurity is inherently dual use: the same capabilities that enable a security team to find and fix a vulnerability can also help a malicious actor exploit it.”
CVP access is tied to the kind of work an applicant performs, the systems involved and the controls the applicant can demonstrate. Anthropic says it verifies every applicant and asks for evidence of the security controls required for the relevant tier. Approval therefore does not mean a general bypass of safety systems, and applying does not guarantee acceptance.
#1 Best Overall
The October announcement names Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1 and future models as included models. Exact model, platform and feature availability can change, so applicants should check the current application and Help Center terms before relying on a particular model.
The three CVP access tiers
| Tier | Work covered | Who may apply | Review expectation | Important boundary |
|---|---|---|---|---|
| Defense Access | Security operations, incident response, malware reverse-engineering, vulnerability analysis and validation | Organizations and qualified individual researchers with a vulnerability-reporting record | Anthropic says many defensive teams may qualify and aims to respond within a few days; this is an estimate, not a promise | Defensive scope and the program’s safety blocks remain active |
| Red Team Access | Defense work plus authorized penetration testing and red-teaming | Organizations only; individuals are currently excluded | Anthropic expects review to take a few weeks because eligibility and controls are stricter | Testing must target systems the organization is authorized to test |
| Specialized Access | Testing safety-sensitive systems whose failure could affect lives or disrupt markets | A limited set of verified organizations | In-depth review in collaboration with the US government | Reserved for approved work on high-consequence systems; it is not a general offensive tier |
Defense Access
Defense Access is the broadest route for legitimate defensive work. Anthropic gives examples including security teams at companies, nonprofits, universities and government bodies defending systems they own or maintain; critical-infrastructure operators such as regional hospitals and municipal utilities; smaller security firms; open-source maintainers; and individual researchers with a record of reported vulnerabilities.
Typical activities include investigating incidents, operating a security operations center, reversing malware and validating whether a reported vulnerability is real and exploitable. The examples describe the kinds of applicants Anthropic is targeting, not an automatic eligibility decision. Anthropic says it expects many organizations doing defensive cyber work to qualify and aims to respond within a few days, but an applicant should treat that as a stated target rather than a service-level commitment.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Red Team Access
Red Team Access adds authorized adversarial testing to the defensive work allowed under Defense Access. In-house red teams, government red teams and security or penetration-testing firms are the examples Anthropic names. The organization must have authority to test the target systems; permission to use Claude does not create permission to test someone else’s infrastructure.
Individuals cannot currently apply for this tier. An organization seeking Red Team Access is enrolled in Defense Access while its Red Team application is reviewed. The additional review is expected to take a few weeks because Anthropic applies higher eligibility requirements and controls.
Specialized Access
Specialized Access is for a small number of verified organizations authorized to test systems where a failure could threaten lives or cause major economic disruption. Anthropic’s examples include flight operating systems, power grids, telecommunications networks, interbank transfer infrastructure and government administrative networks.
Anthropic says each organization is reviewed in depth in collaboration with the US government. Existing Project Glasswing members move to Specialized Access without reapproval for current models. That transition does not mean that every Glasswing participant, or every organization working in critical infrastructure, automatically qualifies for the tier.
Who can apply?
Organizations doing defensive security
Organizations that own or maintain systems, or that are contracted to defend them, are the main audience for CVP. The examples span commercial security teams, public-sector bodies, universities, nonprofits, hospitals, utilities, open-source projects and security vendors. The relevant question is not the organization’s size but whether it performs legitimate security work and can show the controls required for the requested tier.
Individual security researchers
Individual researchers can be considered for Defense Access when they have a track record of reporting vulnerabilities. That is different from Red Team Access, which Anthropic currently limits to organizations. A researcher who wants to perform authorized adversarial testing should therefore apply through an eligible organization rather than assume an individual Red Team route exists.
Organizations testing high-consequence systems
Specialized Access is not an application shortcut for ordinary penetration testing. It is intended for organizations with authorization to test safety systems whose compromise could affect lives or markets. Applicants should expect substantially deeper scrutiny and should be prepared to establish both their authority over the systems and the safeguards surrounding the work.
Rank #3
How the application and review process works
Anthropic directs applicants to the CVP application and Help Center for the current requirements. Because application fields and controls can change, the following is a practical sequence rather than a permanent checklist.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Select the tier that matches the work. Use Defense Access for defensive analysis and response, Red Team Access for organizational penetration testing, and Specialized Access only for authorized testing of safety-sensitive systems.
- Describe the systems and authorization. Red Team and Specialized applicants need to establish that the organization is authorized to test the relevant systems. Do not present a client’s or third party’s infrastructure as an approved target without documented authority.
- Provide identity and organization information. Anthropic says it verifies every applicant. Organizations should be ready to identify the legal entity, responsible administrators and the people who will use the access.
- Show the required security controls. Anthropic requests proof of the controls associated with the requested tier. The exact evidence is governed by the current application materials; applicants should not assume that a generic security policy will satisfy every tier.
- Wait for the tier-specific review. Defense reviews may receive a response within a few days according to Anthropic’s stated expectation. Red Team reviews are expected to take a few weeks. Specialized reviews are described as in-depth and involve collaboration with the US government.
- Have an administrator assign access. Anthropic says administrators assign CVP access to specific workspaces. Approval of an organization therefore does not necessarily give every employee access to every workspace.
Acceptance is discretionary. A complete application can still be declined, limited to a different tier or asked for additional information.
What participants can expect after approval
Safety restrictions remain in force
CVP is not a promise of unrestricted cyber capability. Anthropic says users can still encounter real-time blocks for actions that could cause physical harm or mass disruption. Its examples include deploying ransomware, damaging physical systems and penetration testing of high-risk safety systems outside the approved context.
Red Team authorization is also narrow. Anthropic describes the boundary this way: “Organizations in this tier can only perform adversarial testing against systems they are authorized to test, including IT systems in critical industries.” A team cannot use its approval as a general license to scan unrelated internet hosts, attack a customer without written permission or move from a lab environment into production without authorization.
Model and platform availability
The October 6 announcement says CVP is available on the Claude Platform, Google Cloud Vertex AI and Microsoft Foundry. Amazon Bedrock access is limited to customers eligible for Enterprise Frontier Safeguards (EFS). Administrators assign access to specific workspaces, and model availability can differ by platform and organization.
Recommended Free Tools
Anthropic named Opus 5.5, Sonnet 5.5 and Mythos 5.1, along with future models, in its announcement. These names describe the models included in that announcement, not a permanent promise that every model will remain available to every tier.
Data retention and zero-data-retention arrangements
Anthropic says retention is required for enrolled organizations so it can monitor for cyber misuse. The same October announcement describes zero-data-retention cases for organizations using Claude Fable 5.1 or Claude Mythos 5.1 with zero data retention, and says EFS combining zero data retention with safeguards was expected later in fall 2026.
Those statements apply to specific model and platform arrangements, not to every CVP account. Anthropic’s separate Mythos information page states that Mythos 5.1 uses a 30-day retention policy by default. Before submitting sensitive code or telemetry, an organization should confirm the current retention terms for its exact model, platform, workspace and contract.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What Anthropic has reported about results
Anthropic has published program figures, but they are company-reported counts and evaluations rather than independent estimates of what a new applicant will achieve.
| Measure | Reported result | Qualification |
|---|---|---|
| Verified software vulnerabilities found by partners | At least 129,000 | Anthropic report covering partner results from April through July 2026 |
| Additional verified vulnerabilities from open-source scanning | 5,500 | Anthropic’s open-source efforts from April through October 2026 |
| High- or critical-severity vulnerabilities | More than 33,000 | Based on partial data from 33 partner reports; Anthropic calls this likely an undercount |
| Defense Access safeguard evaluation | 46 of 50 trials blocked at some point | Claude Opus 5.5 across five attempts at each of 10 CyScenarioBench challenges |
| Red Team Access evaluation | 34 of 50 tasks completed | Anthropic reports a 67.6% success rate with no safeguards applied in that evaluation |
The vulnerability totals are lower bounds. Organizations used different triage methods, and fewer than half disclosed how many findings had been patched, often because fixes were still underway. Anthropic projects that the true impact could be at least five times higher, but that is Anthropic’s projection, not an independently established count.
Best Value
The benchmark also needs careful reading. It involved 10 distinct interactive challenges with five trials each, producing 50 trials. Anthropic says every task was blocked on the first prompt without CVP access, 46 of 50 Defense Access trials were blocked at some point, and Red Team Access completed 34 of 50 tasks. These results measure behavior on that evaluation; they do not guarantee success or failure in a particular organization’s environment and do not count vulnerabilities.
How Project Glasswing fits in
Project Glasswing was announced on April 7, 2026 as a defensive effort to secure critical software with Claude Mythos Preview. Anthropic named Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks as launch partners, and said access had been extended to more than 40 additional organizations building or maintaining critical software infrastructure.
Under the October CVP expansion, Glasswing is being integrated into the broader program and existing members move to Specialized Access. The partner list supplies context about the predecessor initiative; it is not evidence that those organizations endorse CVP, that they sponsor applications or that any general applicant receives their access.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsPrograms and products that are not CVP
Model Safety Bug Bounty Program
Anthropic’s Model Safety Bug Bounty Program is a separate, invitation- and acceptance-based program for selected participants who report specified model jailbreaks. It has its own application process and confidentiality obligations. Its eligibility rules should not be used to decide who qualifies for Cyber Verification Program access.
Claude Security
Claude Security is a separate product described in Anthropic’s Transparency Hub. It scans codebases for vulnerabilities and suggests targeted patches for human review. Using or evaluating that product does not by itself enroll an organization in CVP.
Which tier fits a typical security team?
- Choose Defense Access if your work is incident response, malware analysis, vulnerability validation or other defensive operations on systems you own or maintain.
- Seek Red Team Access if your organization performs authorized penetration tests or red-team exercises and needs capabilities beyond defensive analysis. Individuals cannot currently use this tier directly.
- Consider Specialized Access only when your organization is authorized to test safety-sensitive systems where failure could affect lives or disrupt markets, and can withstand an in-depth review.
The key decision is the authorized scope of work, not simply a desire for fewer blocks. Every tier remains subject to verification, workspace controls and restrictions against activities that could cause physical harm or mass disruption.
Bottom line
Anthropic’s CVP is a tiered, verified route to advanced cyber capabilities for legitimate defenders. Defense Access can include individual researchers with a demonstrated vulnerability-reporting record; Red Team Access is for organizations conducting authorized adversarial testing; and Specialized Access is reserved for a small group testing high-consequence systems. Applicants should prepare for identity, organization and security-control verification, and should confirm current model, platform and retention terms before using sensitive data. Approval expands access within an approved scope—it does not create unrestricted permission to attack systems or bypass Anthropic’s safety boundaries.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
