Learn what Anthropic’s Cyber Verification Program (CVP) is, how it works, and how defensive security teams apply to keep their work unblocked.
By Secure.com
AI models are getting better at cybersecurity tasks. That is good news for defenders. It is also a problem, because the same skills that help a security team can help an attacker. To manage this, Anthropic added real time cyber safeguards to its most capable Claude models. These safeguards watch for requests that look like prohibited or high risk use and block them.
The catch is that a lot of honest security work looks similar to attacker work on the surface. A red teamer writing an exploit for a client and a criminal writing the same exploit can type nearly the same request. The Cyber Verification Program exists to sort out the honest users from the rest.
Understanding what the CVP is and how it works helps security teams keep their tools running without surprise blocks in the middle of a job.
What Is a Cyber Verification Program (CVP)?
The Cyber Verification Program is a free application based program from Anthropic. It is built for its Opus models. The program lets vetted security professionals keep working on legitimate dual use tasks while the safeguards stay on for everyone else.
Here is the core idea. Some cybersecurity requests are blocked by default because they can cause real harm. A defender with a real business reason can apply to the CVP. If approved, the block is lifted for their approved use case, so their legitimate work is no longer interrupted.
The program only applies to one specific category of activity, which is covered below. It does not remove every safeguard, and it is not a free pass.
How the Cyber Verification Program Works
The Two Categories of Blocked Activity
The cyber safeguards block two kinds of activity, and only one of them can be adjusted through the CVP.
Prohibited use covers activities that are almost always malicious and have little to no honest defensive value. Examples include mass data theft and writing ransomware code. These stay blocked no matter what. The CVP cannot unlock them.
High risk dual use covers activities that have real defensive value but can also be misused. Examples include vulnerability exploitation and building offensive security tooling. These are blocked by default too, but a defender can apply to have the block adjusted for a legitimate use case. This is the only category the CVP can open up.
Applying to the Program
The way a team applies depends on how they access Claude.
Teams using Anthropic directly, through Claude.ai, Claude Code, or the Anthropic API, find their Organization ID in their account settings and fill out the Cyber Use Case Form. An authorized admin of the organization has to submit it.
Teams using a third party platform that runs on Claude have to check with that platform. Not every platform takes part in the program.
Teams on Microsoft Foundry apply through the same form using their Azure Tenant ID and Subscription ID.
The program is not available on Amazon Bedrock or Google Vertex AI at this time. Bring your own key customers follow the same path as direct Anthropic users.
After a team submits an application, Anthropic aims to send an email with a decision within two business days.
After Approval
Approval is tied to a specific organization ID. It is not tied to a person or a personal workspace. If a user hits a block while signed in to a different organization than the one that was approved, the approval does not carry over.
Approval also only lifts blocks on dual use activity. Prohibited activity stays blocked even for approved users.
Key Characteristics of the CVP
Free to apply: There is no cost to submit a CVP application.
Application based: Access is granted through review, not automatically. A human decision is made on each application.
Opus focused: The program is designed for Anthropic’s Opus models.
Organization scoped: Approval attaches to one organization ID and does not follow a user across accounts.
Limited in scope: The program only adjusts high risk dual use blocks. It never unlocks prohibited use.
Who Should Consider the CVP
The program is aimed at practitioners whose real work overlaps with the dual use category. This includes penetration testers, red teams, exploit developers, and security researchers who need to build or test offensive tooling for defensive reasons.
If a security team keeps running into blocks on legitimate work, and that work falls into the dual use bucket rather than the prohibited bucket, the CVP is the intended path to fix it.
One limit is worth knowing. Organizations on Zero Data Retention are not currently eligible to join the CVP. Teams with a Sales Managed ZDR account are pointed to their Anthropic sales representative instead.
Challenges and Risks
- Wrong organization blocks: Because approval is tied to one organization ID, users can still get blocked if they sign in under a different organization, such as a personal workspace instead of the team account.
- Occasional wrong decisions: Anthropic notes that it expects to sometimes decline eligible applications by mistake, and that approved users may still see blocks on legitimate work.
- Category confusion: Applicants sometimes expect the CVP to unlock prohibited activity. It does not. Only dual use blocks can be adjusted.
- Platform gaps: Not every access path supports the program. Some third party platforms and cloud marketplaces do not offer it yet.
Appeals and False Positives
Anthropic acknowledges that the system is not perfect. Approved users may still hit blocks, and some good applications may be declined.
Before appealing, a team is advised to check two things. First, confirm they are signed in to the approved organization, since approval does not carry across organizations. Second, confirm the blocked task is actually dual use and not prohibited, because prohibited tasks stay blocked regardless of CVP status.
If both checks pass and the block still seems wrong, the team can submit a report or appeal form. This feedback is used to refine the safeguards over time.
How This Connects to Broader Security Governance
The CVP sits inside a larger trend. As AI tools take on more security work, organizations need clear ways to prove that a given use is legitimate and to keep an audit trail of who is approved for what. That is a governance question as much as a technical one.
For teams thinking about how to track approvals, ownership, and access across their security tooling, a Risk and Governance Teammate can help maintain identity inventory, access reviews, and policy oversight so that program approvals like the CVP are documented and mapped to the right owners rather than living in scattered email threads.
Conclusion
The Cyber Verification Program is Anthropic’s way of keeping strong cyber safeguards on for everyone while giving vetted defenders a path to do legitimate high risk work without constant interruption. It is free, it is application based, and it is limited to dual use activity, never prohibited activity.
For security teams that rely on Claude’s Opus models for offensive security work with a defensive purpose, understanding the CVP means fewer surprise blocks and a cleaner way to prove their work is legitimate. As AI becomes a bigger part of security operations, programs like this one point to a future where verified access and clear governance sit at the center of how teams use powerful tools safely.
