Anthropic puts Opus 5.5, Sonnet 5.5 and Mythos 5.1 behind three tiers of cyber verification

The thing that gets verified is the organization. It completes verification through a dedicated CVP Verification Portal ^[3]. It then attests to its relevant security controls and agrees to usage requirements that differ by tier ^[4]. According to a dev.to write-up of Anthropic's program guidance, the program is aimed at defensive security work, and its safeguards and usage rules change from tier to tier ^[13].

The design follows from dual use. The same general class of capability that helps defenders needs careful controls, the write-up notes ^[16], and the tiered structure puts eligibility, access and guardrails into one process ^[18]. I think that is the right call for a vendor shipping this kind of model, because the check attaches to who is asking and what they have attested. Anthropic says the framework is built to take on more cyber-capable models as the program develops, so access is no longer one fixed entitlement ^[8]. The old arrangement was a single access level for Opus and Sonnet ^[2]. Existing participants have a path into the new structure ^[7].

Planning breaks at the next step. A company cannot work out its tier, its model limits or its configuration from the public model list; those come from its own CVP administration view and from platform or regional conditions, according to the write-up ^[9]. Public materials do not include a universal set of tier names or limits, and regional or platform restrictions may apply ^[10]. A security lead therefore cannot know, before enrolling, whether the attestations it is able to make reach Mythos 5.1 or stop at a lower tier ^[10]. Anthropic also indicates that model availability and tier capabilities will change over time ^[11].

Retention needs the same care. The program supports access across cloud environments ^[5], and zero data retention is available in some configurations ^[6]. The write-up says zero retention is not a universal program setting and should be confirmed for a specific environment before a workflow is designed around it ^[12]. For a team feeding security information into a model, the chosen cloud configuration determines how that data is retained ^[12].

For once, the hard part of adopting a model is the paperwork before the first prompt. The write-up says CVP should be judged as a controlled access program, not as a standard software subscription ^[14]. It lists four questions for buyers, and each depends on the answer before it ^[17]:

1. Can the organization complete the required verification and control attestations? 2. Which tier and models appear in its own administrative view? 3. Are those models, and the retention options it needs, available in its intended cloud or region? 4. Which narrowly defined defensive workflow can be tested with meaningful human oversight?

Enrollment gives a route to the models. Whether a given workflow is useful, secure or appropriate for its environment is left to the team ^[15]. That team still has to define inputs, human review, escalation paths and limits on sensitive information, according to the write-up ^[15].