Anthropic expands its verification program for cybersecurity professionals with three tiers of access to Claude
In 30 seconds
Anthropic has reorganized its Cyber Verification Program into three tiers, giving vetted security specialists its top models with fewer restrictions. It now offers defensive access, a tier that also allows authorized pentesting, and a third for a few organizations probing critical infrastructure, vetted with the US government. Anthropic expects to answer defensive applications within days and pentesting ones within weeks.
Anthropic is opening its most capable models to more security teams, with fewer blocks.
The company has expanded its Cyber Verification Program, the program that gives verified security professionals access. It now has three tiers: one for defensive work, another that adds authorized penetration testing, and a third, with the fewest blocks, for a limited set of organizations that test critical systems such as power grids, reviewed together with the US government.
It matters because the models available to everyone block most cybersecurity work to curb malicious use. Anthropic aims to respond to applications for the defensive tier within a few days; those for the penetration testing tier will take a few weeks. Enrolled organizations will have to accept that their data is retained to monitor for misuse; later this fall, eligible organizations will be able to store it in cloud infrastructure they control.
Why it matters · analysis and opinion
Models open to the public block most cybersecurity work to prevent abuse, and that also shuts out the people defending systems. With three tiers, Anthropic separates those protecting their own network, those running agreed intrusion tests and those reviewing critical infrastructure. It affects security consultancies, in-house systems teams and firms that sell audits. A small business that hires such audits can ask its provider whether it is enrolled; a professional can apply for the defensive tier, with a response expected within a few days. It is worth reading the condition that data is retained to monitor for misuse first, especially when handling client information. In our view, verified access makes sense, but each company should decide which sensitive data goes through the program until it can store it in a cloud it controls.
Official source: Anthropic · Written with the help of AI: how we make the news
