BLOG
Anthropic expanded its Cyber Verification Program on October 6, 2026. The program offers qualified security professionals a route to advanced model capabilities with safeguards and verification appropriate to their work. A small agency that maintains client websites should not treat this as an automatic Claude subscription feature or as permission to test systems it does not own. Eligibility, authorization, and the scope of any assessment remain central.
Why did Anthropic change the program?
Anthropic says defensive teams need strong capabilities to find and fix vulnerabilities, while similar capabilities can be misused. Its expanded program uses access tiers with different verification and controls. The company describes the change as a way to serve qualified defenders, red teams, and other eligible groups. This is the vendor’s stated program rationale, not an independent guarantee that a model will find every issue.
The current CVP help page should be checked before applying. Requirements and available models can change. Do not assume that a developer with a normal Claude seat has the same access or that joining one tier grants every cyber capability.
Understand the access tiers
Anthropic’s announcement describes three tiers. Defense Access is aimed at authorized defensive work, including incident response and vulnerability analysis. Red Team Access adds authorized adversarial testing. Higher access requires additional review and controls. Read the current program terms for the exact tier names, permitted activities, and verification steps rather than using a headline as an application checklist.
Authorization matters regardless of tier. A website agency may be allowed to assess its own staging environment but not a customer’s production system without a clear scope. Record the assets, dates, methods, contact person, and stop conditions in writing before any active test. A model’s ability to suggest a test does not create legal or contractual permission to perform it.
| Before a security use case | Required decision |
|---|---|
| Program access | Eligible organization, tier, and approved account |
| Target | Written authorization and system scope |
| Data | What may be submitted to the model |
| Findings | Validation, severity, fix owner, and disclosure |
Example: review a client integration before launch
An agency has built a WordPress form that sends a lead to a CRM through a webhook. It wants to review authentication, logging, and what happens if the CRM fails. A security professional can describe the architecture and test cases using sanitized material. They check whether the webhook accepts unauthenticated writes, whether duplicate submissions create duplicate records, and whether secrets appear in logs. The model can help structure questions; a human must verify the system’s actual behavior.
Keep tests in a controlled environment, with permission from the customer and a backup. An agent should not autonomously change production settings. The reviewer records evidence for each issue, reproduces it, and distinguishes a confirmed vulnerability from a hypothetical concern. Only an approved fix is merged, tested, and deployed.
How to judge the results
Count confirmed findings, false positives, missed issues discovered later, and time spent validating reports. A fluent explanation is not proof. For each claim, ask for a reproducible path, affected version, and condition under which the risk occurs. Check whether a suggested patch blocks the issue without breaking legitimate use. Review with someone who understands the application’s business rules.
Do not use a model as the sole security boundary. Continue normal controls: dependency updates, least-privilege credentials, access reviews, logging, backups, and incident handling. The CVP is an access program for security work, not a certification that a customer site is secure.
Availability, price, and data handling
Keep a copy of the approved program terms and the account’s access tier with the security project’s records. If the team changes staff or the scope of authorized testing expands, recheck whether the existing approval covers the new work. A tier assigned to one organization should not be treated as a transferable permission for unrelated customer systems.
Apply through Anthropic’s current program route and confirm the terms for your organization. The announcement does not mean every applicant is accepted or that all use is free. Check model access, rate limits, account plan, retention, and who may view prompts and findings. If customer information is involved, obtain the appropriate permission before submitting it to any external service.
Who should follow the program?
Keep the assessment within an approved scope
Write a short authorization document before each active assessment. Name the target domains, repositories, and test accounts; the period during which testing is allowed; methods that are prohibited; and the person to contact if a test causes disruption. If a vendor hosts part of the system, confirm whether the customer’s permission covers that infrastructure. Do not let a model expand the target list from a link it discovers. Pause and ask the owner when the next step would touch an asset outside the written scope.
Separate passive review from active testing in the work plan. Reading code and configuration may be permitted where exploitation is not. If an agent proposes a command that changes records, sends a request, or extracts data, a reviewer should know which category it falls into before executing it. Keep logs of the exact actions taken, with secrets removed from shared reports. This protects the client and helps the team reproduce a verified finding without repeating a risky test.
Turn findings into a repair plan
For each confirmed issue, record the affected component, severity reasoning, evidence, owner, proposed fix, test result, and deployment date. If an issue involves a third-party plugin or platform, coordinate with the vendor rather than publishing sensitive detail prematurely. Check whether a credential needs rotation or whether old logs contain exposed information. The final report should distinguish fixed, accepted, deferred, and unconfirmed findings. That distinction is more useful to a small business than a raw count of AI-generated alerts.
Security teams and authorized maintainers with a defined defensive workload are the natural audience. A small web agency may first improve its ordinary security process and then evaluate whether it qualifies for the appropriate tier. The October announcement is relevant, but the decision to test a system still depends on written authorization, a valid scope, and human validation of every finding.
