Cyber verification program splits into three tiers: defenders can apply for fewer blocks, red teams keep real-time stops

Security teams can now apply for different levels of model access based on the scope of their cyber work, with higher tiers carrying fewer cyber blocks. Previously, generally available models carried conservative cyber safeguards that blocked most cyber work, so defenders faced the same limits as malicious actors. The expanded program integrates Project Glasswing and CVP into Defense, Red Team, and Specialized tiers, each with different verification requirements and security controls, covering Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and new models moving forward.

The tier differences are implemented through cyber block classifiers on the models, so stricter verification unlocks more cyber operations. Defense Access covers security operations, incident response, malware reverse engineering, and vulnerability analysis, and explicitly lists individual researchers with a track record of reported vulnerabilities as qualifying applicants; Red Team Access adds authorized penetration testing and red-teaming; Specialized Access has the fewest blocks and is reserved for verified organizations authorized to test systems such as flight operating systems, power grids, telecom networks, interbank transfer infrastructure, and government administrative networks. Red Team Access still applies real-time blocks to actions that could cause physical harm or mass disruption, such as deploying ransomware, damaging physical systems, or pen testing high-risk safety systems, and is currently for organizations only, with individual researchers not eligible.

A multi-stage cyber operations evaluation is used to check whether each tier's blocks behave as intended. The evaluation measures whether models can plan and execute multi-stage cyber operations under realistic constraints, so significant blocks are expected on the generally available model and in Defense Access, with no blocks in Red Team Access and Specialized Access. Across five attempts at each of the 10 CyScenarioBench challenges per tier, every task was blocked on the first prompt without CVP access; Defense Access blocked 46 of 50 trials at some point with four successes; Red Team Access saw no blocks and completed 34 of 50, effectively equivalent to the 67.6% success rate with no safeguards.

The program targets organizations doing defensive work, authorized red-teaming, and specialized security testing; Defense Access explicitly lists individual researchers with a track record of reported vulnerabilities as qualifying applicants, while Red Team Access is currently for organizations only. The evaluation covers 10 CyScenarioBench challenges with five attempts per tier, focused on multi-stage cyber operations. The program is available on the Claude Platform, Google Cloud's Vertex AI, and Microsoft Foundry, and on Amazon Bedrock only for customers eligible for Enterprise Frontier Safeguards.

The program says it will continue to refine its tier-based classifiers over time, so the current tiers are not final. Specialized Access is currently reviewed in depth in collaboration with the US government, which shapes how quickly organizations enter that tier. Data retention is required for enrolled organizations, and until Enterprise Frontier Safeguards becomes available later this fall, organizations with zero data retention access to Claude Fable 5.1 or Claude Mythos 5.1 can also use CVP with zero data retention.