After studying this material, you should be able to:
- Explain why cybersecurity AI tools require tiered access controls
- Identify the three CVP access tiers and their distinct purposes
- Distinguish which organizations qualify for each tier
- Understand how safeguard effectiveness was measured and what results showed
- Recognize the real-world impact of AI-assisted vulnerability detection
Step-by-Step Teaching
Step 1: The Core Problem — Why Tiers Exist
The Dual-Use Dilemma
Cybersecurity AI is inherently double-edged:
Same Capability
↓
Security Team → Finds & fixes vulnerability ✅
Malicious Actor → Exploits vulnerability ❌
This creates a tension:
| Goal | Requirement |
|---|---|
| Block bad actors | Conservative safeguards |
| Help defenders | Powerful, unrestricted capabilities |
Key Insight: You cannot fully serve both needs with a single access level. This is why tiers exist.
Step 2: Understanding the Three Tiers
Think of tiers as concentric circles of trust and capability:
[Specialized Access] ← fewest blocks, highest scrutiny
[Red Team Access] ← offensive testing allowed
[Defense Access] ← defensive work only
[General Public] ← most restricted
Tier 1: Defense Access
What it allows:
- Security operations center (SOC) work
- Incident response
- Reverse-engineering malware
- Analyzing and validating vulnerabilities
Who qualifies:
- Company/nonprofit/university security teams
- Hospital or municipal utility operators
- Smaller security firms
- Individual researchers with documented vulnerability history
Processing time: A few days
Think of it as: A professional security license — broad but bounded to your own systems
Tier 2: Red Team Access
Adds to Defense Access:
- Authorized penetration testing
- Red-teaming against systems you have permission to attack
Who qualifies:
- In-house red teams
- Government red teams
- Penetration testing firms
Hard limits remain:
Still BLOCKED even at this tier:
❌ Deploying ransomware
❌ Damaging physical systems
❌ Testing high-risk safety systems
Processing time: A few weeks
Important note: Individuals are NOT eligible — organizations only
Tier 3: Specialized Access
What it allows:
- Testing safety-critical systems that affect lives or markets
Examples of covered systems:
- Flight operating systems
- Power grids
- Telecom networks
- Interbank transfer infrastructure
- Government administrative networks
Who qualifies:
- Very limited, verified organizations
- Reviewed in collaboration with the US government
Think of it as: A top-security clearance — rare, deeply vetted, maximum capability
Step 3: How Effectiveness Was Measured
Anthropic used CyScenarioBench — a test simulating realistic multi-stage cyber operations.
Test setup:
- Model: Claude Opus 5.5
- 10 challenges × 5 attempts = 50 trials per tier
Results:
| Access Tier | Blocks Encountered | Tasks Completed |
|---|---|---|
| No CVP (General) | Blocked on first prompt, every time | 0/50 |
| Defense Access | 46/50 trials blocked at some point | 4/50 |
| Red Team Access | Zero blocks | 34/50 (68%) |
| Specialized Access | Equivalent to Red Team | ~67.6% |
What this proves:
- The tiers work as designed
- Defense tier successfully stops offensive operations
- Red Team tier enables legitimate security work without interference
Step 4: Real-World Impact
Project Glasswing (the predecessor program) demonstrated measurable results:
April–July 2026:
129,000 verified software vulnerabilities found by partners
+
5,500 found through Anthropic's own open-source scanning
= 134,500+ total verified vulnerabilities
Of those: 33,000+ rated CRITICAL or HIGH severity
Partner feedback on speed improvement:
Without Claude Mythos, finding the same vulnerabilities would have taken months to years longer
Why this matters:
- Vulnerabilities found = vulnerabilities that can be patched
- Faster detection = less time attackers can exploit them
- CVP scales this impact to more organizations
Step 5: Data and Privacy Controls
Default requirement: Data retention is mandatory for monitoring misuse
Exception pathway — Enterprise Frontier Safeguards (EFS):
Standard CVP → Data retained by Anthropic
EFS (coming fall) → Data stored in organization's own cloud
+ Zero data retention option
+ Same robust safeguards
This matters for organizations with strict data privacy requirements (healthcare, finance, government).
Summary: The Big Picture
PROBLEM: AI cyber tools are dual-use
↓
SOLUTION: Tiered access based on verified trust
↓
TIERS:
Defense → Protect your own systems
Red Team → Attack systems you're authorized to test
Specialized → Test critical national infrastructure
↓
EVIDENCE: Benchmarks + 134,500 real vulnerabilities found
↓
GOAL: Give defenders a permanent advantage
Quick Self-Check Questions
- Why can't Anthropic simply remove all cyber safeguards for everyone?
- What is the key difference between Defense and Red Team access?
- Why does Specialized Access require US government collaboration?
- What does a 46/50 block rate in Defense tier tell you about its design intent?
- Why is data retention required, and what does EFS change about that?