Check Whether Individual Security Researchers Can Apply to the Claude Cyber Verification Program
This page contains Coupang Partners affiliate links; the operator may earn a commission.
Key Takeaway
Individual security researchers can apply to the Claude Cyber Verification Program (CVP), but not for every tier. Defense Access names individuals as eligible, while Red Team Access is for organizations only.
How are the access tiers divided by type of work?
The official announcement presents three tiers according to the scope of security work.
| Tier | Who the announcement describes it for |
|---|---|
| Defense Access | Defensive work, incident response, and vulnerability analysis and verification |
| Red Team Access | The above, plus authorized penetration testing and red-team work |
| Specialized Access | Limited vetted organizations with authorization to test high-risk safety systems |
The date checked is 2026-10-10. A higher tier does not mean you can test any system you like. Red Team Access is limited to systems you have been authorized to test.
What should individual researchers and small security teams prepare?
Examples for Defense Access include small security firms, open-source maintainers, and individual researchers with a disclosure track record. The official help article describes applying by choosing the program in the Verification Portal.
Before you apply, write down your research history, the systems you maintain, and the scope of work you need. That makes it easier to judge which tier to choose.
Do I need to check data retention terms too?
Yes. The announcement requires participating organizations to have their data retained for abuse monitoring, with an exception for some existing customers with zero-retention access. It says customer-controlled cloud retention (Enterprise Frontier Safeguards) is planned for this fall. Be careful not to read terms already under contract and features still to come as the same conditions.
Do the conditions differ depending on the cloud I use?
They do. It says the program is available on Claude Platform, Google Cloud Vertex AI, and Microsoft Foundry, while Amazon Bedrock is limited to customers who qualify for Enterprise Frontier Safeguards. Before connecting it to your work, confirm that approval for the tier you need and the actual workspace permission assignment are both complete.
Frequently Asked Questions
Can an individual researcher apply for Red Team Access?
The October 6 announcement limits that tier to organizations and excludes individual researchers. The tier that mentions possible eligibility for individuals is Defense Access.
Do I need CVP to do security code review?
Anthropic says you can keep doing code review, fixing known issues, finding vulnerabilities in source you own, and triaging security alerts with the generally available models.
Do I get access as soon as I apply?
Applicant verification and evidence of security controls for the tier are required. The review time the announcement mentions is not a guarantee of approval or a fixed processing deadline.
Sources & Verification Date
- Expanding the Cyber Verification Program (2026-10-06) · Verified
- Cyber Verification Program · Verified
All materials have been verified from official announcements and may have changed since verification.