What the expanded program offers
Anthropic’s 6 October announcement brings its Cyber Verification Program and Project Glasswing into an expanded offering with three tiers. Defense Access covers defensive activities. Red Team Access adds authorised adversarial testing for eligible organisations. Specialized Access is reserved for a smaller set of organisations working with high-risk systems and involves more extensive review.
The program changes which cyber tasks approved users can perform and which safeguards apply. It does not give permission to test systems belonging to someone else. Anthropic describes different verification requirements and controls for each tier.
Questions for an Australian business
A small business is more likely to encounter these tools through an external security provider than through its own specialist team. Ask the provider to explain the approved scope in ordinary language before a test begins.
- Identify the systems and accounts the provider is authorised to assess.
- Agree who approves potentially disruptive tests and when they can run.
- Establish where logs, source code and vulnerability evidence are processed.
- Confirm retention, access restrictions and the process for deleting sensitive evidence.
- Require human review of findings and a prioritised remediation plan.
Data handling needs a separate review
Anthropic says program data retention is required for misuse monitoring, with exceptions and future options described in its announcement. Do not assume an existing zero-retention arrangement automatically covers every model or access tier. Check the applicable contract and platform settings.
The practical takeaway
Evaluate the provider’s process alongside the model’s capabilities. Faster vulnerability discovery is useful only when findings are validated, fixes are owned and the business can verify that critical issues were addressed.
Source checked: Anthropic’s 6 October 2026 program announcement.