CVP, Revised: Tiers, Teeth, and a Hard Deadline

Back in August I wrote about applying to Anthropic’s Cyber Verification Program and what it unlocked for CTF and defensive tooling work. That post is still accurate about the idea behind CVP. It is no longer an accurate description of the program itself. Anthropic has substantially rewritten it, and the support article carries its own “Updated today” stamp as of this writing. This is the deep dive on what actually changed, and why the shape of the change matters more than any single new rule in it.

Part I

The Article Got a New Name

The smallest fact here is also the most telling one. The official documentation used to live at a URL titled “Real time cyber safeguards on Claude Opus and Sonnet”. That page is still there, same article ID, but it now redirects to a URL titled plainly “Cyber Verification Program”, and the content behind it has been rewritten to match. A safeguard that used to be framed as a setting on two models is now a named, standalone program that covers three models by name (Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1) and reads like a compliance document rather than a feature description.

Here is the shape of that promotion, side by side with what the program looked like when I applied in July.

Part II

Four Tiers, Not One

The new structure sorts applicants by what they are actually doing and how much organizational infrastructure stands behind them, rather than approving or rejecting a single flat request.

• Defense Access. The organizational baseline. MFA is required immediately, phishing resistant MFA by the cutoff date, and no default seat limit.
• Defense Access for Individuals. The tier that actually applies to a solo researcher or student rather than a company. One person, one grant: sign in is restricted to a Google account or equivalent identity provider, and zero data retention is explicitly unavailable at this tier. Every request an individual makes under CVP is retained and monitored, full stop.
• Red Team Access. Capped at 25 Approved Users per workspace, org domain sign in only, background checks for every approved user including contractors, managed devices, and network egress restricted to an allow list enforced off the host for any offensive or agentic work.
• Specialized Access. Everything Red Team requires, plus mandatory SSO federation (no personal or non federated accounts at all) and mandatory malware protection (application allow listing, or an EDR agent in block or prevent mode) on every device that reaches the grant.

Whatever tier you’re aiming for, the actual verification step runs through Persona, Anthropic’s identity partner: an individual submits a government issued photo ID plus a live selfie from a phone camera, an organization submits business information alongside the same for a responsible individual. Anthropic states it does not use that identity data to train its models, and that it stays between you, Anthropic, and its fraud prevention partners except where legally required.

Part III

The Real Change Is the Contract

Every access level, including the individual one, now comes with a baseline set of obligations: a documented way to revoke a compromised credential, suspected breaches reported within 72 hours (24 for a security incident specifically), cooperation with any Anthropic investigation within 48 hours, and no shared sign ins, ever. For an individual grant, the org facing items (a named security contact, 30 day notice of posture changes) are explicitly waived; incident reporting, cooperation, and producing compliance evidence on request are not.

The headline item, and the one most likely to actually break somebody’s workflow, is credential management. By December 15, 2026, static or long lived API keys stop being a valid way to reach a CVP covered model, across every first party and cloud surface:

• Anthropic first party (Console, Claude Code, the API). No static API keys at all, interactive or programmatic.
• Google Vertex. No downloaded service account JSON key files.
• Amazon Bedrock. No IAM user access key pairs, except short term Bedrock keys that expire within 12 hours or the session, whichever is shorter.
• Microsoft Azure AI Foundry. No API keys and no exported service principal secrets or certificates.

Until the cutoff, a single interim key is tolerated, but only if it lives in a secrets manager or password manager, belongs to exactly one person or workload, never touches source code, and gets rotated at least every seven days. Anthropic reserves the right to shorten that lifetime to seven days unilaterally, or disable keys on a workspace outright once the cutoff passes. For an individual, OAuth covers Claude Code, Console, and claude.ai; anything programmatic is expected to move to Workload Identity Federation, where the platform offers it.

Phishing resistant MFA follows the same deadline and the same bar: a FIDO2 or WebAuthn security key, a passkey, or a smartcard or PIV. The article is explicit that SMS, voice calls, emailed codes, authenticator app TOTP codes, and push approvals do not qualify, and that email magic link sign in has to be disabled outright. That is a meaningfully higher bar than “turn on 2FA,” and it is worth checking now rather than on December 14th.

Red Team and Specialized Access carry their own operational mechanics that the tier list in Part II only gestures at. A gateway or proxy sitting in front of the model has to use its own short lived credential, admit only Approved Users or their workload identities, and keep its logs restricted to Approved Users and the customer’s own security, IT administration, or trust and safety teams. Anything the customer’s own systems issue to reach the model has to expire within 12 hours. A compromised credential or identity has to be revocable within 24 hours, and a departed or reassigned Approved User has to come off the workspace within 3 business days. New seats beyond the default cap can be requested in writing, email is enough, but only a named administrator can actually add members, change roles, or create workload identities on the workspace. Government entities get one meaningful substitution: a FISMA Authority to Operate with an annual independent Inspector General assessment against NIST SP 800-53 satisfies the Managed Devices, Background Checks, and Incident Procedure requirements specifically. Everything else on the list still applies in full.

Part IV

Data Retention, EFS, and the ZDR Carve Out

CVP has always traded loosened default safeguards for Anthropic’s ability to watch for misuse, but the current article says so plainly: retained traffic is how the program detects bad actors, and at the individual tier zero data retention is not on offer at all. The stated long term fix is Enterprise Frontier Safeguards (EFS), a not yet available option that would let an eligible organization keep that data in cloud infrastructure it controls instead of Anthropic’s. Anthropic is taking interest registrations for it now via a form linked from the article.

There is one narrow bridge in the meantime: an organization that already holds a zero data retention exemption for Claude Fable or Claude Mythos can run CVP under that same ZDR on every CVP supported model, until EFS ships. It is a carve out for orgs that already cleared a separate bar, not a general option, and it is not available to individual grants regardless.

One piece of continuity: anyone already enrolled in Project Glasswing or the previous CVP does not need to reapply. Existing access keeps working on its existing terms while it transitions into the matching tier under the new structure. Anthropic is also running a live session on exactly this transition: “Inside the Cyber Verification Program: Tiers, Migration, and Best Practices,” October 14, 2026, 9 to 10am PT, covering tier walkthroughs, admin setup, and the terms, migration, and data retention questions above for existing Glasswing and CVP members specifically.

Part V

What This Means If You’re a Student, Not a Company

The accessibility argument from my first post still holds: CVP exists so that legitimate defensive and CTF adjacent work doesn’t get blocked by the same safeguard that stops an attacker asking the identical question. That has not changed. What changed is that the program now says, in a document you can actually read, what it costs to hold that access: your traffic is watched, your sign in has to clear a real MFA bar on a fixed date, and if you are the kind of practitioner who has a static API key sitting in a config file somewhere, CVP is telling you, in writing, that the clock on that habit runs out December 15th whether or not you are enrolled in the program at all. That last part is arguably the most useful thing to take from this update even if you never apply: it is Anthropic publishing, as policy, a credential hygiene bar that was already best practice everywhere else.

References

1. Cyber Verification Program Anthropic · official support documentation (retitled from “Real time cyber safeguards on Claude Opus and Sonnet,” same article ID) support.claude.com/en/articles/14604842-cyber-verification-program
2. Verification Portal: apply for and manage trust programs Anthropic · official application portal portal.anthropic.com/programs/cvp
3. Provisioning access using your Grants Anthropic · same support article, the section on turning on access per platform (Console or API, Enterprise, Bedrock, Vertex, Azure AI Foundry, third party) once approved support.claude.com/.../cyber-verification-program#h_ce0ef780bd
4. Identity verification on Claude Anthropic · official support documentation: how the identity check requirement behind CVP eligibility actually works (Persona, government ID, live selfie) support.claude.com/en/articles/14328960-identity-verification-on-claude
5. Inside the Cyber Verification Program: Tiers, Migration, and Best Practices Anthropic · official webinar, Oct 14, 2026, 9 to 10am PT claude.com/resources/webinars/inside-the-cyber-verification-program
6. Usage Policy Anthropic · the governing policy that applies in full to every CVP access level, effective Sept 15, 2025. CVP lifts default safeguard blocks, not Usage Policy prohibitions anthropic.com/legal/aup
7. CTFs, Local Models, and the Trust Boundary ECHO Club · our original CVP post, Aug 2026: the application story and the accessibility argument this update does not replace echoclub.org/blog-cvp-verification.html

All links verified reachable at the time of publication, October 2026. The Security Requirements text quoted above is Anthropic’s own, carried on the article above; it was last marked “Updated today” as of this post’s filing date, so check the live article for anything time sensitive, especially the December 15 cutoff.

Get in touch

Requests, collaborations, or concerns

If something here is wrong, or you want to work on it with us, say so. Corrections are welcome and get published.

Leave this empty:

Your name

Email

What is this about Request Collaboration Concern or correction

Message

Send it Email instead