Anthropic Cyber Verification Program: 5 Powerful Benefits | Osto<\/title>\n<meta name=\"description\" content=\"Osto joins the Anthropic Cyber Verification Program, enabling legitimate dual-use AI security research for sharper VAPT, threat modeling and remediation.\">\n<meta name=\"keywords\" content=\"Anthropic Cyber Verification Program, Anthropic CVP, AI security research, AI assisted penetration testing, dual use cybersecurity\">\n<link rel=\"canonical\" href=\"https:\/\/osto.one\/resources\/announcement\/anthropic-cyber-verification-program\/\">\n\n<style>\n:root{\n --osto-blue:#1C267A;\n --osto-blue-dark:#16205F;\n --text:#344054;\n --ink:#101828;\n --muted:#667085;\n --line:#E4E7EC;\n --soft:#F8FAFC;\n --white:#FFFFFF;\n --pastel-blue:#EEF3FF;\n --pastel-blue-2:#F6F8FF;\n}\n*{box-sizing:border-box}\n.osto-resource, .osto-resource *{font-family:inherit;}\nhtml{scroll-behavior:smooth}\nbody{\n margin:0;\n background:linear-gradient(180deg,#FBFCFF 0%,#FFFFFF 18%,#FFFFFF 100%);\n color:var(--text);\n font-family:Inter, ui-sans-serif, -apple-system, BlinkMacSystemFont, \"Segoe UI\", Arial, sans-serif;\n font-size:17px;\n line-height:1.72;\n -webkit-font-smoothing:antialiased;\n}\nimg{max-width:100%;display:block}\na{color:var(--osto-blue);text-decoration-thickness:1px;text-underline-offset:3px}\n.osto-resource{\n width:min(1040px, calc(100% - 36px));\n margin:0 auto;\n padding:56px 0 92px;\n}\n.hero{\n position:relative;\n overflow:hidden;\n padding:48px 48px 34px;\n border:1px solid var(--line);\n border-radius:28px;\n background:\n radial-gradient(circle at 14% 22%, rgba(238,243,255,.95) 0%, rgba(238,243,255,0) 28%),\n linear-gradient(135deg,#FFFFFF 0%,#F8FAFF 100%);\n box-shadow:0 16px 40px rgba(16,24,40,.06);\n}\n\n.eyebrow{\n margin:0 0 12px;\n color:var(--osto-blue);\n font-size:13px;\n line-height:1;\n font-weight:800;\n letter-spacing:.12em;\n text-transform:uppercase;\n}\n.hero-intro{\n max-width:860px;\n margin:22px 0 18px;\n color:#475467;\n font-size:20px;\n line-height:1.62;\n}\n.byline{\n display:flex;\n flex-wrap:wrap;\n gap:10px 18px;\n align-items:center;\n color:var(--muted);\n font-size:14px;\n font-weight:600;\n}\n.byline span+span:before{\n content:\"\u2022\";\n margin-right:18px;\n color:#98A2B3;\n}\n.hero-grid{\n display:grid;\n grid-template-columns:1fr;\n gap:22px;\n margin-top:30px;\n}\n.hero-card,\n.hero-panel{\n border:1px solid var(--line);\n border-radius:22px;\n background:rgba(255,255,255,.85);\n backdrop-filter:blur(2px);\n}\n.hero-card{padding:24px}\n.hero-panel{padding:0;overflow:hidden}\n.kicker{\n display:inline-flex;\n align-items:center;\n gap:8px;\n padding:9px 12px;\n border-radius:999px;\n font-size:12px;\n font-weight:800;\n letter-spacing:.06em;\n text-transform:uppercase;\n color:var(--osto-blue);\n background:var(--pastel-blue);\n}\n.hero-card h2{\n margin:18px 0 8px;\n color:var(--ink);\n font-size:26px;\n line-height:1.2;\n letter-spacing:-.025em;\n}\n.hero-card p{margin:0 0 14px}\n.mini-stats{\n display:grid;\n grid-template-columns:repeat(3,1fr);\n gap:12px;\n margin-top:18px;\n}\n.mini-stat{\n padding:14px 12px;\n border-radius:16px;\n border:1px solid var(--line);\n}\n.mini-stat:nth-child(1),\n.mini-stat:nth-child(2),\n.mini-stat:nth-child(3){background:var(--pastel-blue);}\n.mini-stat strong{\n display:block;\n color:var(--ink);\n font-size:22px;\n line-height:1.1;\n}\n.mini-stat span{\n display:block;\n margin-top:5px;\n color:#475467;\n font-size:12px;\n font-weight:600;\n}\n.content{\n width:100%;\n max-width:none;\n margin:36px auto 0;\n}\n.chips{\n display:flex;\n gap:10px;\n flex-wrap:wrap;\n margin:0 0 28px;\n}\n.chip{\n display:inline-flex;\n align-items:center;\n padding:8px 12px;\n border-radius:999px;\n border:1px solid var(--line);\n background:#fff;\n color:#475467;\n font-size:12px;\n font-weight:700;\n}\n.card{\n width:100%;\n max-width:none;\n margin:0 0 32px;\n padding:28px 30px;\n border-radius:22px;\n border:1px solid var(--line);\n background:#fff;\n box-shadow:0 8px 24px rgba(16,24,40,.04);\n}\n.card.pastel-blue{background:linear-gradient(180deg,#FDFEFF 0%,#F7FAFF 100%)}\n.card.pastel-mix{background:linear-gradient(135deg,#FFFFFF 0%,#FBFCFF 38%,#FFFFFF 100%)}\n.tldr{\n border-left:0;\n background:linear-gradient(135deg,var(--pastel-blue) 0%, #FFFFFF 100%);\n}\n.tldr h2, .toc-card h2, .faq-title, .related-title{\n margin:0 0 10px;\n color:var(--ink);\n font-size:22px;\n line-height:1.25;\n letter-spacing:-.02em;\n}\n.card p:last-child{margin-bottom:0}\n.toc-card{\n background:linear-gradient(135deg,var(--pastel-blue) 0%, #FFFFFF 100%);\n}\n.toc-grid{\n display:grid;\n grid-template-columns:repeat(2,minmax(0,1fr));\n gap:12px;\n margin-top:14px;\n}\n.toc-item{\n display:flex;\n gap:12px;\n align-items:flex-start;\n padding:14px 15px;\n border-radius:16px;\n background:rgba(255,255,255,.86);\n border:1px solid var(--line);\n text-decoration:none;\n}\n.toc-item b{\n display:grid;\n place-items:center;\n min-width:28px;\n width:28px;\n height:28px;\n border-radius:50%;\n background:var(--osto-blue);\n color:#fff;\n font-size:12px;\n}\n.toc-item span{\n color:#475467;\n font-size:14px;\n line-height:1.45;\n}\n.article{width:100%;max-width:none;}\n.article p{margin:0 0 24px}\n.article .lede{\n color:#344054;\n font-size:19px;\n}\n.article h2{\n margin:64px 0 18px;\n color:var(--ink);\n font-size:34px;\n line-height:1.18;\n letter-spacing:-.028em;\n}\n.article h3{\n margin:30px 0 12px;\n color:var(--ink);\n font-size:23px;\n line-height:1.28;\n letter-spacing:-.016em;\n}\n.highlight-note{\n margin:26px 0 34px;\n padding:18px 20px;\n border-radius:16px;\n background:var(--pastel-blue-2);\n border:1px solid #DDE5FA;\n color:#344054;\n}\n.infographic{\n margin:30px 0 34px;\n padding:22px;\n border:1px solid var(--line);\n border-radius:22px;\n background:#fff;\n}\n.section-label{\n margin:0 0 16px;\n color:#667085;\n font-size:12px;\n font-weight:800;\n letter-spacing:.1em;\n text-transform:uppercase;\n}\n.tier-grid{\n display:grid;\n grid-template-columns:repeat(3,minmax(0,1fr));\n gap:14px;\n}\n.tier{\n padding:22px 18px;\n border-radius:18px;\n border:1px solid var(--line);\n}\n.tier:nth-child(1){background:var(--pastel-blue)}\n.tier:nth-child(2){background:var(--pastel-blue-2)}\n.tier:nth-child(3){background:var(--pastel-blue-2)}\n.tier .num{\n display:grid;\n place-items:center;\n width:34px;\n height:34px;\n margin-bottom:14px;\n border-radius:50%;\n background:rgba(28,38,122,.92);\n color:#fff;\n font-size:13px;\n font-weight:800;\n}\n.tier strong{\n display:block;\n margin-bottom:8px;\n color:var(--ink);\n font-size:18px;\n}\n.tier p{\n margin:0;\n color:#475467;\n font-size:14px;\n line-height:1.58;\n}\n.split-grid{\n display:grid;\n grid-template-columns:1.05fr .95fr;\n gap:18px;\n align-items:stretch;\n margin:30px 0 36px;\n}\n.split-card{\n padding:22px;\n border-radius:20px;\n border:1px solid var(--line);\n background:#fff;\n}\n.split-card.pastel-1{background:linear-gradient(180deg,#FFFFFF 0%,#F9FBFF 100%)}\n.split-card.pastel-2{background:linear-gradient(180deg,#FFFFFF 0%,#FFFFFF 100%)}\n.graph-caption{\n margin-top:12px;\n color:#667085;\n font-size:13px;\n line-height:1.55;\n}\n.compare{\n width:100%;\n margin:28px 0 34px;\n border-collapse:separate;\n border-spacing:0;\n overflow:hidden;\n border:1px solid var(--line);\n border-radius:18px;\n}\n.compare th, .compare td{\n padding:16px 18px;\n border-bottom:1px solid var(--line);\n text-align:left;\n vertical-align:top;\n}\n.compare th{\n background:#F8F9FC;\n color:var(--ink);\n font-size:14px;\n}\n.compare tr:last-child td{border-bottom:0}\n.compare td{font-size:15px}\n.work-grid{\n display:grid;\n grid-template-columns:repeat(2,minmax(0,1fr));\n gap:15px;\n margin:28px 0 36px;\n}\n.work-card{\n padding:20px;\n border-radius:18px;\n border:1px solid var(--line);\n}\n.work-card:nth-child(odd){background:var(--pastel-blue);}\n.work-card:nth-child(even){background:var(--pastel-blue-2);}\n.work-card h3{\n margin:0 0 8px;\n font-size:19px;\n}\n.work-card p{margin:0;color:#475467;font-size:14px;line-height:1.6}\n.client-list{\n list-style:none;\n margin:28px 0 36px;\n padding:0;\n}\n.client-list li{\n display:grid;\n grid-template-columns:26px 1fr;\n gap:12px;\n align-items:flex-start;\n padding:16px 0;\n border-bottom:1px solid var(--line);\n}\n.check{\n display:grid;\n place-items:center;\n width:24px;\n height:24px;\n margin-top:2px;\n border-radius:50%;\n background:var(--osto-blue);\n color:#fff;\n font-size:12px;\n font-weight:800;\n}\n.bar-cards{\n display:grid;\n grid-template-columns:repeat(2,minmax(0,1fr));\n gap:16px;\n margin:24px 0 30px;\n}\n.bar-card{\n padding:20px;\n border-radius:18px;\n border:1px solid var(--line);\n background:#fff;\n}\n.bar-card h3{margin:0 0 12px;font-size:18px}\n.cta{\n margin:72px 0 62px;\n padding:38px 40px;\n border-radius:24px;\n background:\n radial-gradient(circle at 85% 18%, rgba(255,255,255,.16) 0%, rgba(255,255,255,0) 22%),\n linear-gradient(135deg,#1C267A 0%,#2636A3 100%);\n color:#fff;\n}\n.cta h2{\n margin:0 0 10px;\n color:#fff;\n font-size:32px;\n line-height:1.2;\n}\n.cta p{\n max-width:690px;\n margin:0 0 22px;\n color:#fff;\n}\n.cta a{\n display:inline-flex;\n align-items:center;\n padding:12px 18px;\n border-radius:12px;\n background:#fff;\n color:var(--osto-blue);\n font-size:14px;\n font-weight:800;\n text-decoration:none;\n}\n.faq-title, .related-title{margin-top:0}\n.faq{\n border-top:1px solid var(--line);\n}\n.faq details{\n border-bottom:1px solid var(--line);\n}\n.faq summary{\n list-style:none;\n position:relative;\n cursor:pointer;\n padding:20px 44px 20px 0;\n color:var(--ink);\n font-size:17px;\n font-weight:760;\n}\n.faq summary::-webkit-details-marker{display:none}\n.faq summary:after{\n content:\"+\";\n position:absolute;\n right:2px;\n top:16px;\n color:var(--osto-blue);\n font-size:28px;\n font-weight:400;\n line-height:1;\n}\n.faq details[open] summary:after{content:\"\u2212\"}\n.faq details p{\n padding:0 34px 22px 0;\n color:#475467;\n}\n.related{\n display:grid;\n grid-template-columns:repeat(3,minmax(0,1fr));\n gap:14px;\n}\n.related a{\n min-height:180px;\n display:flex;\n flex-direction:column;\n justify-content:space-between;\n padding:20px;\n border-radius:18px;\n border:1px solid var(--line);\n text-decoration:none;\n color:var(--ink);\n background:#fff;\n}\n.related a:nth-child(1),\n.related a:nth-child(2),\n.related a:nth-child(3){background:linear-gradient(180deg,#FFFFFF 0%,#F6F8FF 100%);}\n.related small{\n color:var(--osto-blue);\n font-size:11px;\n font-weight:800;\n letter-spacing:.1em;\n text-transform:uppercase;\n}\n.related strong{\n font-size:16px;\n line-height:1.5;\n}\n.related span{\n color:#667085;\n font-size:13px;\n}\n.source-note{\n margin-top:26px;\n color:#667085;\n font-size:13px;\n}\n@media (max-width:900px){\n .hero-grid,\n .split-grid,\n .tier-grid,\n .work-grid,\n .bar-cards,\n .related,\n .toc-grid{\n grid-template-columns:1fr;\n }\n}\n@media (max-width:640px){\n body{font-size:16px}\n .osto-resource{width:min(100% - 24px,1040px);padding-top:28px}\n .hero{padding:28px 20px 20px}\n h1{font-size:38px}\n .hero-intro{font-size:18px}\n .mini-stats{grid-template-columns:1fr}\n .content{margin-top:24px}\n .card{padding:22px 18px}\n .article h2{font-size:29px;margin-top:52px}\n .cta{padding:30px 22px}\n .byline span+span:before{margin-right:12px}\n}\n<\/style>\n<\/head>\n<body>\n<main class=\"osto-resource\">\n\n <header class=\"hero\">\n <p class=\"eyebrow\">Announcement<\/p>\n <p class=\"hero-intro\"><strong>Osto has been accepted into the Anthropic Cyber Verification Program.<\/strong> For a security company working across VAPT, red teaming, cloud security and detection engineering, verified access improves the research and reasoning layer behind authorized security work.<\/p>\n <div class=\"byline\">\n <span>Osto Security Team<\/span>\n <span>7 min read<\/span>\n <span>Company News<\/span>\n <\/div>\n\n <div class=\"hero-grid single\">\n <div class=\"hero-card\">\n <span class=\"kicker\">Why it matters<\/span>\n <h2>Better security reasoning inside authorized work<\/h2>\n <p>Osto’s work often requires exploitability analysis, adversary simulation and offensive-style reasoning in legitimate, scoped engagements. The Anthropic Cyber Verification Program helps reduce interruptions while prohibited uses remain blocked.<\/p>\n <div class=\"mini-stats\">\n <div class=\"mini-stat\">\n <strong>Dual-use<\/strong>\n <span>Legitimate cyber work supported with verification<\/span>\n <\/div>\n <div class=\"mini-stat\">\n <strong>Human-led<\/strong>\n <span>Research stays under expert review<\/span>\n <\/div>\n <div class=\"mini-stat\">\n <strong>Scoped<\/strong>\n <span>Authorization boundaries do not change<\/span>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/header>\n\n <div class=\"content\">\n <div class=\"chips\">\n <span class=\"chip\">Announcement<\/span>\n <span class=\"chip\">AI Security<\/span>\n <span class=\"chip\">Security Research<\/span>\n <\/div>\n\n <section class=\"card tldr\">\n <h2>TL;DR<\/h2>\n <p>Osto has been accepted into the <strong>Anthropic Cyber Verification Program<\/strong>, a free, application-based program designed for legitimate cybersecurity work that can overlap with high-risk dual-use activity.<\/p>\n <p>For Osto, this matters because our work often requires exploitability analysis, adversary simulation and offensive-style reasoning inside explicitly authorized engagements. Verified access reduces unnecessary interruptions while the same authorization and human-review boundaries remain in place.<\/p>\n <\/section>\n\n <section class=\"card toc-card\">\n <h2>On this page<\/h2>\n <div class=\"toc-grid\">\n <a class=\"toc-item\" href=\"#cvp\"><b>1<\/b><span>What the Anthropic Cyber Verification Program is<\/span><\/a>\n <a class=\"toc-item\" href=\"#matters\"><b>2<\/b><span>Why acceptance matters<\/span><\/a>\n <a class=\"toc-item\" href=\"#osto\"><b>3<\/b><span>Why this matters specifically for Osto<\/span><\/a>\n <a class=\"toc-item\" href=\"#work\"><b>4<\/b><span>Where it shows up in our work<\/span><\/a>\n <a class=\"toc-item\" href=\"#attackers\"><b>5<\/b><span>The other direction<\/span><\/a>\n <a class=\"toc-item\" href=\"#clients\"><b>6<\/b><span>What it means for clients<\/span><\/a>\n <\/div>\n <\/section>\n\n <article class=\"article\">\n <p class=\"lede\">Security work has an unusual problem. The same reasoning that helps a defender understand an attack path can look offensive to a general-purpose AI safeguard. A penetration tester and an intruder can ask technically similar questions, even though only one is operating under authorization.<\/p>\n\n <h2 id=\"cvp\">What the Anthropic Cyber Verification Program is<\/h2>\n\n <p>The <strong>Anthropic Cyber Verification Program<\/strong>, or CVP, is Anthropic’s route for verified cybersecurity professionals whose legitimate work can otherwise be affected by safeguards around high-risk dual-use cyber activity.<\/p>\n\n <p>The important distinction is that verification does not make every cyber request permissible. It gives approved defenders more room to perform legitimate work while prohibited activities remain prohibited.<\/p>\n\n <section class=\"infographic\">\n <p class=\"section-label\">How the boundary works<\/p>\n <div class=\"tier-grid\">\n <div class=\"tier\">\n <div class=\"num\">1<\/div>\n <strong>Standard defensive<\/strong>\n <p>Secure code review, hardening guidance, policy work and lower-risk defensive analysis.<\/p>\n <\/div>\n <div class=\"tier\">\n <div class=\"num\">2<\/div>\n <strong>High-risk dual-use<\/strong>\n <p>Exploitability research, adversary simulation and certain offensive security tooling in legitimate contexts.<\/p>\n <\/div>\n <div class=\"tier\">\n <div class=\"num\">3<\/div>\n <strong>Prohibited<\/strong>\n <p>Activities such as mass data exfiltration or ransomware development remain blocked.<\/p>\n <\/div>\n <\/div>\n <\/section>\n\n <div class=\"highlight-note\"><strong>The part worth reading twice:<\/strong> verification widens access for legitimate dual-use security work. It does not remove the floor.<\/div>\n\n <h2 id=\"matters\">Why Anthropic Cyber Verification Program acceptance matters<\/h2>\n\n <p>For us, the significance is operational. Security work becomes less useful when analysis ends at \u201ca vulnerability exists.\u201d Clients need to understand whether the weakness is reachable, what an attacker could chain it with, which asset becomes exposed and what should be fixed first.<\/p>\n\n <p>That is the gap between a finding and a real risk.<\/p>\n\n <div class=\"split-grid\">\n <div class=\"split-card pastel-1\">\n <p class=\"section-label\">From finding to decision<\/p>\n <svg viewBox=\"0 0 520 250\" width=\"100%\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"Find reason prioritise security analysis flow\">\n <rect width=\"520\" height=\"250\" fill=\"#FFFFFF\"\/>\n <rect x=\"26\" y=\"72\" width=\"132\" height=\"76\" rx=\"16\" fill=\"#EEF3FF\" stroke=\"#DDE5FA\"\/>\n <text x=\"92\" y=\"101\" text-anchor=\"middle\" fill=\"#101828\" font-size=\"15\" font-family=\"Arial, Helvetica, sans-serif\" font-weight=\"700\">Find<\/text>\n <text x=\"92\" y=\"124\" text-anchor=\"middle\" fill=\"#667085\" font-size=\"11\" font-family=\"Arial, Helvetica, sans-serif\">Identify weakness<\/text>\n\n <rect x=\"194\" y=\"72\" width=\"132\" height=\"76\" rx=\"16\" fill=\"#F6F8FF\" stroke=\"#DDE5FA\"\/>\n <text x=\"260\" y=\"101\" text-anchor=\"middle\" fill=\"#101828\" font-size=\"15\" font-family=\"Arial, Helvetica, sans-serif\" font-weight=\"700\">Reason<\/text>\n <text x=\"260\" y=\"124\" text-anchor=\"middle\" fill=\"#667085\" font-size=\"11\" font-family=\"Arial, Helvetica, sans-serif\">Assess attack path<\/text>\n\n <rect x=\"362\" y=\"72\" width=\"132\" height=\"76\" rx=\"16\" fill=\"#EEF3FF\" stroke=\"#DDE5FA\"\/>\n <text x=\"428\" y=\"101\" text-anchor=\"middle\" fill=\"#101828\" font-size=\"15\" font-family=\"Arial, Helvetica, sans-serif\" font-weight=\"700\">Prioritise<\/text>\n <text x=\"428\" y=\"124\" text-anchor=\"middle\" fill=\"#667085\" font-size=\"11\" font-family=\"Arial, Helvetica, sans-serif\">Focus remediation<\/text>\n\n <path d=\"M160 110 L188 110\" stroke=\"#1C267A\" stroke-width=\"3\"\/>\n <polygon points=\"188,110 179,105 179,115\" fill=\"#1C267A\"\/>\n <path d=\"M328 110 L356 110\" stroke=\"#1C267A\" stroke-width=\"3\"\/>\n <polygon points=\"356,110 347,105 347,115\" fill=\"#1C267A\"\/>\n\n <text x=\"26\" y=\"196\" fill=\"#667085\" font-size=\"12\" font-family=\"Arial, Helvetica, sans-serif\">The analysis layer turns technical findings into clearer remediation decisions.<\/text>\n <\/svg>\n <\/div>\n\n <div class=\"split-card pastel-2\">\n <p class=\"section-label\">What deeper reasoning improves<\/p>\n <svg viewBox=\"0 0 520 270\" width=\"100%\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"Bar chart of deeper security reasoning benefits\">\n <rect width=\"520\" height=\"270\" fill=\"#FFFFFF\"\/>\n\n <text x=\"24\" y=\"44\" fill=\"#344054\" font-size=\"12\" font-family=\"Arial, Helvetica, sans-serif\">Exploitability context<\/text>\n <rect x=\"24\" y=\"55\" width=\"430\" height=\"14\" rx=\"7\" fill=\"#EEF3FF\"\/>\n <rect x=\"24\" y=\"55\" width=\"286\" height=\"14\" rx=\"7\" fill=\"#1C267A\"\/>\n\n <text x=\"24\" y=\"108\" fill=\"#344054\" font-size=\"12\" font-family=\"Arial, Helvetica, sans-serif\">Attack-path clarity<\/text>\n <rect x=\"24\" y=\"119\" width=\"430\" height=\"14\" rx=\"7\" fill=\"#EEF3FF\"\/>\n <rect x=\"24\" y=\"119\" width=\"344\" height=\"14\" rx=\"7\" fill=\"#1C267A\"\/>\n\n <text x=\"24\" y=\"172\" fill=\"#344054\" font-size=\"12\" font-family=\"Arial, Helvetica, sans-serif\">Actionable prioritisation<\/text>\n <rect x=\"24\" y=\"183\" width=\"430\" height=\"14\" rx=\"7\" fill=\"#EEF3FF\"\/>\n <rect x=\"24\" y=\"183\" width=\"387\" height=\"14\" rx=\"7\" fill=\"#1C267A\"\/>\n\n <text x=\"24\" y=\"232\" fill=\"#667085\" font-size=\"11\" font-family=\"Arial, Helvetica, sans-serif\">Illustrative comparison of where deeper analysis adds value. Not a measured performance claim.<\/text>\n <\/svg>\n <\/div>\n <\/div>\n\n <p>The <strong>Anthropic Cyber Verification Program<\/strong> helps approved defensive organizations use advanced model reasoning with fewer interruptions when that work legitimately crosses into dual-use territory.<\/p>\n\n <h2 id=\"osto\">Why this matters specifically for Osto<\/h2>\n\n <p>Osto works across web and API <a href=\"https:\/\/www.osto.one\/resources\/glossary\/vapt\/\">VAPT<\/a>, cloud infrastructure assessment, red team exercises, source code review and detection engineering. A meaningful part of that work requires thinking about what an attacker would actually do with a weakness.<\/p>\n\n <p>Consider an assessment that returns 80 findings. A severity score can help sort them, but it cannot tell a client whether an issue is actually exposed, protected by compensating controls, reachable from the internet or useful as part of a larger attack path.<\/p>\n\n <p>That is why verified access matters most after a vulnerability has already been discovered. It strengthens the reasoning layer that turns a list of findings into a remediation plan.<\/p>\n\n <table class=\"compare\">\n <thead>\n <tr>\n <th>Without deeper attack-path reasoning<\/th>\n <th>With scoped adversarial analysis<\/th>\n <\/tr>\n <\/thead>\n <tbody>\n <tr>\n <td>Severity-led triage<\/td>\n <td>Reachability and real-world impact considered alongside severity<\/td>\n <\/tr>\n <tr>\n <td>Detection based mainly on static indicators<\/td>\n <td>Detection logic informed by modeled attacker behavior<\/td>\n <\/tr>\n <tr>\n <td>Individual findings treated separately<\/td>\n <td>Weaknesses evaluated as possible attack chains<\/td>\n <\/tr>\n <\/tbody>\n <\/table>\n\n <h2 id=\"work\">Where this shows up in our work<\/h2>\n\n <div class=\"work-grid\">\n <div class=\"work-card\">\n <h3>Exploitability analysis<\/h3>\n <p>Separating findings that are realistically reachable from findings that exist mainly on paper.<\/p>\n <\/div>\n <div class=\"work-card\">\n <h3>Detection engineering<\/h3>\n <p>Reasoning about attacker behavior across signals instead of depending only on static signatures.<\/p>\n <\/div>\n <div class=\"work-card\">\n <h3>Threat modeling<\/h3>\n <p>Pressure-testing assumptions, trust boundaries and control gaps before an attacker discovers them.<\/p>\n <\/div>\n <div class=\"work-card\">\n <h3>Red team research<\/h3>\n <p>Studying realistic attacker paths inside a clearly agreed and explicitly authorized scope.<\/p>\n <\/div>\n <div class=\"work-card\">\n <h3>VAPT prioritization<\/h3>\n <p>Turning dozens of findings into a clearer view of which issues need action first and why.<\/p>\n <\/div>\n <\/div>\n\n <p>Across every engagement, the difficult part is rarely producing a longer report. It is establishing a defensible line between a technical finding and a business-relevant security risk.<\/p>\n\n <h2 id=\"attackers\">The other direction: AI is changing the attacker too<\/h2>\n\n <p>AI is not only improving defensive workflows. Attackers have access to increasingly capable automation and reasoning tools as well. Any security program that models only yesterday’s attacker will eventually fall behind.<\/p>\n\n <p>Verified access helps legitimate researchers study offensive capability within a controlled process so defenses can reflect what is possible now, not what was common several years ago.<\/p>\n\n <p>The goal is not offensive capability for its own sake. The goal is better defense.<\/p>\n\n <h2 id=\"clients\">What it means for clients<\/h2>\n\n <p>Clients should not expect the dashboard to look different tomorrow. The improvement happens upstream, in the research and analysis feeding VAPT reports, code-security findings, cloud assessments and cross-module detection.<\/p>\n\n <ul class=\"client-list\">\n <li><span class=\"check\">\u2713<\/span><span><strong>Sharper triage.<\/strong> Fewer findings that lead nowhere and a clearer line between critical exposure and noise.<\/span><\/li>\n <li><span class=\"check\">\u2713<\/span><span><strong>Better attack-path context.<\/strong> Guidance considers what an attacker could realistically chain together, not only the isolated score of each issue.<\/span><\/li>\n <li><span class=\"check\">\u2713<\/span><span><strong>More useful remediation.<\/strong> Recommendations are shaped by likely impact and control context rather than generic checklist language.<\/span><\/li>\n <li><span class=\"check\">\u2713<\/span><span><strong>Research that keeps pace.<\/strong> Defensive analysis can better reflect the way AI-assisted attack capability is evolving.<\/span><\/li>\n <li><span class=\"check\">\u2713<\/span><span><strong>The same authorization boundaries.<\/strong> Verified access changes the quality of analysis, not what Osto is permitted to touch.<\/span><\/li>\n <\/ul>\n\n <h2>The authorization boundary does not change<\/h2>\n\n <p>Every client engagement continues to operate within its agreed scope and written authorization. Systems outside that scope remain outside it. Human security professionals continue to review analysis before it reaches a client.<\/p>\n\n <p>AI supports the research and reasoning layer. It does not replace professional judgment, client authorization or engagement controls.<\/p>\n\n <p>Acceptance into the <strong>Anthropic Cyber Verification Program<\/strong> strengthens that research layer without changing those fundamentals.<\/p>\n\n <section class=\"cta\">\n <h2>Put verified AI-assisted security research to work.<\/h2>\n <p>See how Osto combines expert-led testing with advanced exploitability analysis, adversary simulation and clearer remediation guidance, within the same strict authorization boundaries.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" target=\"_blank\" rel=\"noopener\">Book a Demo<\/a>\n <\/section>\n\n <section class=\"card pastel-blue\">\n <h2 class=\"faq-title\">Frequently asked questions<\/h2>\n <div class=\"faq\">\n <details>\n <summary>Does verification lift every cyber restriction?<\/summary>\n <p>No. CVP is intended to reduce interruptions for legitimate dual-use cybersecurity work. Prohibited cyber activity remains restricted regardless of verification status.<\/p>\n <\/details>\n\n <details>\n <summary>Does this mean AI now runs Osto’s penetration tests?<\/summary>\n <p>No. Osto’s <a href=\"https:\/\/www.osto.one\/resources\/glossary\/penetration-testing\/\">penetration testing<\/a> remains expert-led. AI can improve research, exploitability reasoning, threat modeling and prioritization, while human security professionals remain responsible for the engagement and client-facing output.<\/p>\n <\/details>\n\n <details>\n <summary>Does verification change what Osto can test?<\/summary>\n <p>No. Testing remains limited to systems Osto owns or is explicitly authorized to assess under the agreed engagement scope.<\/p>\n <\/details>\n\n <details>\n <summary>Who can apply to the Anthropic Cyber Verification Program?<\/summary>\n <p>Anthropic describes CVP as a free, application-based program for cybersecurity professionals with legitimate use cases that can be affected by cyber safeguards.<\/p>\n <\/details>\n\n <details>\n <summary>Does the Anthropic Cyber Verification Program remove safeguards completely?<\/summary>\n <p>No. The program provides greater room for approved dual-use defensive work. It does not remove restrictions around prohibited cyber activity.<\/p>\n <\/details>\n <\/div>\n <\/section>\n\n <section class=\"card pastel-mix\">\n <h2 class=\"related-title\">Related reading<\/h2>\n <div class=\"related\">\n <a href=\"https:\/\/www.osto.one\/resources\/blog\/vapt-vs-vulnerability-scanning\/\">\n <small>Blog<\/small>\n <strong>VAPT vs Vulnerability Scanning: Why a Scan Isn’t a Pentest<\/strong>\n <span>Read article \u2192<\/span>\n <\/a>\n <a href=\"https:\/\/www.osto.one\/resources\/blog\/how-to-read-a-vapt-report\/\">\n <small>Blog<\/small>\n <strong>How to Read a VAPT \/ Pentest Report: A Practical Guide<\/strong>\n <span>Read article \u2192<\/span>\n <\/a>\n <a href=\"https:\/\/www.osto.one\/resources\/blog\/vapt-for-startups-first-pentest\/\">\n <small>Blog<\/small>\n <strong>VAPT for Startups: When You Need Your First Pentest<\/strong>\n <span>Read article \u2192<\/span>\n <\/a>\n <\/div>\n <\/section>\n\n <p class=\"source-note\">Primary program reference: Anthropic’s Cyber Verification Program documentation. The program affects access to supported AI capabilities. It does not change the authorization scope of a client security engagement.<\/p>\n <\/article>\n <\/div>\n<\/main>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>Anthropic Cyber Verification Program: 5 Powerful Benefits | Osto Announcement Osto has been accepted into the Anthropic Cyber Verification Program.\u2026<\/p>\n","protected":false},"author":8,"featured_media":1045,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[51],"tags":[490,489,488],"class_list":["post-1044","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-announcement","tag-ai-assisted-penetration-testing","tag-ai-security-research","tag-anthropic-cvp"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1044","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1044"}],"version-history":[{"count":3,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1044\/revisions"}],"predecessor-version":[{"id":1048,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1044\/revisions\/1048"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1045"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1044"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1044"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1044"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":1044,"date":"2026-08-31T08:51:43","date_gmt":"2026-08-31T08:51:43","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=1044"},"modified":"2026-08-31T10:40:55","modified_gmt":"2026-08-31T10:40:55","slug":"anthropic-cyber-verification-program","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/announcement\/anthropic-cyber-verification-program\/","title":{"rendered":"Osto Joins Anthropic Cyber Verification Program: A Major Milestone for AI Security Research"},"content":{"rendered":"\n\n\n\n\n\nAnthropic Cyber Verification Program: 5 Powerful Benefits | Osto<\/title>\n<meta name=\"description\" content=\"Osto joins the Anthropic Cyber Verification Program, enabling legitimate dual-use AI security research for sharper VAPT, threat modeling and remediation.\">\n<meta name=\"keywords\" content=\"Anthropic Cyber Verification Program, Anthropic CVP, AI security research, AI assisted penetration testing, dual use cybersecurity\">\n<link rel=\"canonical\" href=\"https:\/\/osto.one\/resources\/announcement\/anthropic-cyber-verification-program\/\">\n\n<style>\n:root{\n --osto-blue:#1C267A;\n --osto-blue-dark:#16205F;\n --text:#344054;\n --ink:#101828;\n --muted:#667085;\n --line:#E4E7EC;\n --soft:#F8FAFC;\n --white:#FFFFFF;\n --pastel-blue:#EEF3FF;\n --pastel-blue-2:#F6F8FF;\n}\n*{box-sizing:border-box}\n.osto-resource, .osto-resource *{font-family:inherit;}\nhtml{scroll-behavior:smooth}\nbody{\n margin:0;\n background:linear-gradient(180deg,#FBFCFF 0%,#FFFFFF 18%,#FFFFFF 100%);\n color:var(--text);\n font-family:Inter, ui-sans-serif, -apple-system, BlinkMacSystemFont, \"Segoe UI\", Arial, sans-serif;\n font-size:17px;\n line-height:1.72;\n -webkit-font-smoothing:antialiased;\n}\nimg{max-width:100%;display:block}\na{color:var(--osto-blue);text-decoration-thickness:1px;text-underline-offset:3px}\n.osto-resource{\n width:min(1040px, calc(100% - 36px));\n margin:0 auto;\n padding:56px 0 92px;\n}\n.hero{\n position:relative;\n overflow:hidden;\n padding:48px 48px 34px;\n border:1px solid var(--line);\n border-radius:28px;\n background:\n radial-gradient(circle at 14% 22%, rgba(238,243,255,.95) 0%, rgba(238,243,255,0) 28%),\n linear-gradient(135deg,#FFFFFF 0%,#F8FAFF 100%);\n box-shadow:0 16px 40px rgba(16,24,40,.06);\n}\n\n.eyebrow{\n margin:0 0 12px;\n color:var(--osto-blue);\n font-size:13px;\n line-height:1;\n font-weight:800;\n letter-spacing:.12em;\n text-transform:uppercase;\n}\n.hero-intro{\n max-width:860px;\n margin:22px 0 18px;\n color:#475467;\n font-size:20px;\n line-height:1.62;\n}\n.byline{\n display:flex;\n flex-wrap:wrap;\n gap:10px 18px;\n align-items:center;\n color:var(--muted);\n font-size:14px;\n font-weight:600;\n}\n.byline span+span:before{\n content:\"\u2022\";\n margin-right:18px;\n color:#98A2B3;\n}\n.hero-grid{\n display:grid;\n grid-template-columns:1fr;\n gap:22px;\n margin-top:30px;\n}\n.hero-card,\n.hero-panel{\n border:1px solid var(--line);\n border-radius:22px;\n background:rgba(255,255,255,.85);\n backdrop-filter:blur(2px);\n}\n.hero-card{padding:24px}\n.hero-panel{padding:0;overflow:hidden}\n.kicker{\n display:inline-flex;\n align-items:center;\n gap:8px;\n padding:9px 12px;\n border-radius:999px;\n font-size:12px;\n font-weight:800;\n letter-spacing:.06em;\n text-transform:uppercase;\n color:var(--osto-blue);\n background:var(--pastel-blue);\n}\n.hero-card h2{\n margin:18px 0 8px;\n color:var(--ink);\n font-size:26px;\n line-height:1.2;\n letter-spacing:-.025em;\n}\n.hero-card p{margin:0 0 14px}\n.mini-stats{\n display:grid;\n grid-template-columns:repeat(3,1fr);\n gap:12px;\n margin-top:18px;\n}\n.mini-stat{\n padding:14px 12px;\n border-radius:16px;\n border:1px solid var(--line);\n}\n.mini-stat:nth-child(1),\n.mini-stat:nth-child(2),\n.mini-stat:nth-child(3){background:var(--pastel-blue);}\n.mini-stat strong{\n display:block;\n color:var(--ink);\n font-size:22px;\n line-height:1.1;\n}\n.mini-stat span{\n display:block;\n margin-top:5px;\n color:#475467;\n font-size:12px;\n font-weight:600;\n}\n.content{\n width:100%;\n max-width:none;\n margin:36px auto 0;\n}\n.chips{\n display:flex;\n gap:10px;\n flex-wrap:wrap;\n margin:0 0 28px;\n}\n.chip{\n display:inline-flex;\n align-items:center;\n padding:8px 12px;\n border-radius:999px;\n border:1px solid var(--line);\n background:#fff;\n color:#475467;\n font-size:12px;\n font-weight:700;\n}\n.card{\n width:100%;\n max-width:none;\n margin:0 0 32px;\n padding:28px 30px;\n border-radius:22px;\n border:1px solid var(--line);\n background:#fff;\n box-shadow:0 8px 24px rgba(16,24,40,.04);\n}\n.card.pastel-blue{background:linear-gradient(180deg,#FDFEFF 0%,#F7FAFF 100%)}\n.card.pastel-mix{background:linear-gradient(135deg,#FFFFFF 0%,#FBFCFF 38%,#FFFFFF 100%)}\n.tldr{\n border-left:0;\n background:linear-gradient(135deg,var(--pastel-blue) 0%, #FFFFFF 100%);\n}\n.tldr h2, .toc-card h2, .faq-title, .related-title{\n margin:0 0 10px;\n color:var(--ink);\n font-size:22px;\n line-height:1.25;\n letter-spacing:-.02em;\n}\n.card p:last-child{margin-bottom:0}\n.toc-card{\n background:linear-gradient(135deg,var(--pastel-blue) 0%, #FFFFFF 100%);\n}\n.toc-grid{\n display:grid;\n grid-template-columns:repeat(2,minmax(0,1fr));\n gap:12px;\n margin-top:14px;\n}\n.toc-item{\n display:flex;\n gap:12px;\n align-items:flex-start;\n padding:14px 15px;\n border-radius:16px;\n background:rgba(255,255,255,.86);\n border:1px solid var(--line);\n text-decoration:none;\n}\n.toc-item b{\n display:grid;\n place-items:center;\n min-width:28px;\n width:28px;\n height:28px;\n border-radius:50%;\n background:var(--osto-blue);\n color:#fff;\n font-size:12px;\n}\n.toc-item span{\n color:#475467;\n font-size:14px;\n line-height:1.45;\n}\n.article{width:100%;max-width:none;}\n.article p{margin:0 0 24px}\n.article .lede{\n color:#344054;\n font-size:19px;\n}\n.article h2{\n margin:64px 0 18px;\n color:var(--ink);\n font-size:34px;\n line-height:1.18;\n letter-spacing:-.028em;\n}\n.article h3{\n margin:30px 0 12px;\n color:var(--ink);\n font-size:23px;\n line-height:1.28;\n letter-spacing:-.016em;\n}\n.highlight-note{\n margin:26px 0 34px;\n padding:18px 20px;\n border-radius:16px;\n background:var(--pastel-blue-2);\n border:1px solid #DDE5FA;\n color:#344054;\n}\n.infographic{\n margin:30px 0 34px;\n padding:22px;\n border:1px solid var(--line);\n border-radius:22px;\n background:#fff;\n}\n.section-label{\n margin:0 0 16px;\n color:#667085;\n font-size:12px;\n font-weight:800;\n letter-spacing:.1em;\n text-transform:uppercase;\n}\n.tier-grid{\n display:grid;\n grid-template-columns:repeat(3,minmax(0,1fr));\n gap:14px;\n}\n.tier{\n padding:22px 18px;\n border-radius:18px;\n border:1px solid var(--line);\n}\n.tier:nth-child(1){background:var(--pastel-blue)}\n.tier:nth-child(2){background:var(--pastel-blue-2)}\n.tier:nth-child(3){background:var(--pastel-blue-2)}\n.tier .num{\n display:grid;\n place-items:center;\n width:34px;\n height:34px;\n margin-bottom:14px;\n border-radius:50%;\n background:rgba(28,38,122,.92);\n color:#fff;\n font-size:13px;\n font-weight:800;\n}\n.tier strong{\n display:block;\n margin-bottom:8px;\n color:var(--ink);\n font-size:18px;\n}\n.tier p{\n margin:0;\n color:#475467;\n font-size:14px;\n line-height:1.58;\n}\n.split-grid{\n display:grid;\n grid-template-columns:1.05fr .95fr;\n gap:18px;\n align-items:stretch;\n margin:30px 0 36px;\n}\n.split-card{\n padding:22px;\n border-radius:20px;\n border:1px solid var(--line);\n background:#fff;\n}\n.split-card.pastel-1{background:linear-gradient(180deg,#FFFFFF 0%,#F9FBFF 100%)}\n.split-card.pastel-2{background:linear-gradient(180deg,#FFFFFF 0%,#FFFFFF 100%)}\n.graph-caption{\n margin-top:12px;\n color:#667085;\n font-size:13px;\n line-height:1.55;\n}\n.compare{\n width:100%;\n margin:28px 0 34px;\n border-collapse:separate;\n border-spacing:0;\n overflow:hidden;\n border:1px solid var(--line);\n border-radius:18px;\n}\n.compare th, .compare td{\n padding:16px 18px;\n border-bottom:1px solid var(--line);\n text-align:left;\n vertical-align:top;\n}\n.compare th{\n background:#F8F9FC;\n color:var(--ink);\n font-size:14px;\n}\n.compare tr:last-child td{border-bottom:0}\n.compare td{font-size:15px}\n.work-grid{\n display:grid;\n grid-template-columns:repeat(2,minmax(0,1fr));\n gap:15px;\n margin:28px 0 36px;\n}\n.work-card{\n padding:20px;\n border-radius:18px;\n border:1px solid var(--line);\n}\n.work-card:nth-child(odd){background:var(--pastel-blue);}\n.work-card:nth-child(even){background:var(--pastel-blue-2);}\n.work-card h3{\n margin:0 0 8px;\n font-size:19px;\n}\n.work-card p{margin:0;color:#475467;font-size:14px;line-height:1.6}\n.client-list{\n list-style:none;\n margin:28px 0 36px;\n padding:0;\n}\n.client-list li{\n display:grid;\n grid-template-columns:26px 1fr;\n gap:12px;\n align-items:flex-start;\n padding:16px 0;\n border-bottom:1px solid var(--line);\n}\n.check{\n display:grid;\n place-items:center;\n width:24px;\n height:24px;\n margin-top:2px;\n border-radius:50%;\n background:var(--osto-blue);\n color:#fff;\n font-size:12px;\n font-weight:800;\n}\n.bar-cards{\n display:grid;\n grid-template-columns:repeat(2,minmax(0,1fr));\n gap:16px;\n margin:24px 0 30px;\n}\n.bar-card{\n padding:20px;\n border-radius:18px;\n border:1px solid var(--line);\n background:#fff;\n}\n.bar-card h3{margin:0 0 12px;font-size:18px}\n.cta{\n margin:72px 0 62px;\n padding:38px 40px;\n border-radius:24px;\n background:\n radial-gradient(circle at 85% 18%, rgba(255,255,255,.16) 0%, rgba(255,255,255,0) 22%),\n linear-gradient(135deg,#1C267A 0%,#2636A3 100%);\n color:#fff;\n}\n.cta h2{\n margin:0 0 10px;\n color:#fff;\n font-size:32px;\n line-height:1.2;\n}\n.cta p{\n max-width:690px;\n margin:0 0 22px;\n color:#fff;\n}\n.cta a{\n display:inline-flex;\n align-items:center;\n padding:12px 18px;\n border-radius:12px;\n background:#fff;\n color:var(--osto-blue);\n font-size:14px;\n font-weight:800;\n text-decoration:none;\n}\n.faq-title, .related-title{margin-top:0}\n.faq{\n border-top:1px solid var(--line);\n}\n.faq details{\n border-bottom:1px solid var(--line);\n}\n.faq summary{\n list-style:none;\n position:relative;\n cursor:pointer;\n padding:20px 44px 20px 0;\n color:var(--ink);\n font-size:17px;\n font-weight:760;\n}\n.faq summary::-webkit-details-marker{display:none}\n.faq summary:after{\n content:\"+\";\n position:absolute;\n right:2px;\n top:16px;\n color:var(--osto-blue);\n font-size:28px;\n font-weight:400;\n line-height:1;\n}\n.faq details[open] summary:after{content:\"\u2212\"}\n.faq details p{\n padding:0 34px 22px 0;\n color:#475467;\n}\n.related{\n display:grid;\n grid-template-columns:repeat(3,minmax(0,1fr));\n gap:14px;\n}\n.related a{\n min-height:180px;\n display:flex;\n flex-direction:column;\n justify-content:space-between;\n padding:20px;\n border-radius:18px;\n border:1px solid var(--line);\n text-decoration:none;\n color:var(--ink);\n background:#fff;\n}\n.related a:nth-child(1),\n.related a:nth-child(2),\n.related a:nth-child(3){background:linear-gradient(180deg,#FFFFFF 0%,#F6F8FF 100%);}\n.related small{\n color:var(--osto-blue);\n font-size:11px;\n font-weight:800;\n letter-spacing:.1em;\n text-transform:uppercase;\n}\n.related strong{\n font-size:16px;\n line-height:1.5;\n}\n.related span{\n color:#667085;\n font-size:13px;\n}\n.source-note{\n margin-top:26px;\n color:#667085;\n font-size:13px;\n}\n@media (max-width:900px){\n .hero-grid,\n .split-grid,\n .tier-grid,\n .work-grid,\n .bar-cards,\n .related,\n .toc-grid{\n grid-template-columns:1fr;\n }\n}\n@media (max-width:640px){\n body{font-size:16px}\n .osto-resource{width:min(100% - 24px,1040px);padding-top:28px}\n .hero{padding:28px 20px 20px}\n h1{font-size:38px}\n .hero-intro{font-size:18px}\n .mini-stats{grid-template-columns:1fr}\n .content{margin-top:24px}\n .card{padding:22px 18px}\n .article h2{font-size:29px;margin-top:52px}\n .cta{padding:30px 22px}\n .byline span+span:before{margin-right:12px}\n}\n<\/style>\n<\/head>\n<body>\n<main class=\"osto-resource\">\n\n <header class=\"hero\">\n <p class=\"eyebrow\">Announcement<\/p>\n <p class=\"hero-intro\"><strong>Osto has been accepted into the Anthropic Cyber Verification Program.<\/strong> For a security company working across VAPT, red teaming, cloud security and detection engineering, verified access improves the research and reasoning layer behind authorized security work.<\/p>\n <div class=\"byline\">\n <span>Osto Security Team<\/span>\n <span>7 min read<\/span>\n <span>Company News<\/span>\n <\/div>\n\n <div class=\"hero-grid single\">\n <div class=\"hero-card\">\n <span class=\"kicker\">Why it matters<\/span>\n <h2>Better security reasoning inside authorized work<\/h2>\n <p>Osto’s work often requires exploitability analysis, adversary simulation and offensive-style reasoning in legitimate, scoped engagements. The Anthropic Cyber Verification Program helps reduce interruptions while prohibited uses remain blocked.<\/p>\n <div class=\"mini-stats\">\n <div class=\"mini-stat\">\n <strong>Dual-use<\/strong>\n <span>Legitimate cyber work supported with verification<\/span>\n <\/div>\n <div class=\"mini-stat\">\n <strong>Human-led<\/strong>\n <span>Research stays under expert review<\/span>\n <\/div>\n <div class=\"mini-stat\">\n <strong>Scoped<\/strong>\n <span>Authorization boundaries do not change<\/span>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/header>\n\n <div class=\"content\">\n <div class=\"chips\">\n <span class=\"chip\">Announcement<\/span>\n <span class=\"chip\">AI Security<\/span>\n <span class=\"chip\">Security Research<\/span>\n <\/div>\n\n <section class=\"card tldr\">\n <h2>TL;DR<\/h2>\n <p>Osto has been accepted into the <strong>Anthropic Cyber Verification Program<\/strong>, a free, application-based program designed for legitimate cybersecurity work that can overlap with high-risk dual-use activity.<\/p>\n <p>For Osto, this matters because our work often requires exploitability analysis, adversary simulation and offensive-style reasoning inside explicitly authorized engagements. Verified access reduces unnecessary interruptions while the same authorization and human-review boundaries remain in place.<\/p>\n <\/section>\n\n <section class=\"card toc-card\">\n <h2>On this page<\/h2>\n <div class=\"toc-grid\">\n <a class=\"toc-item\" href=\"#cvp\"><b>1<\/b><span>What the Anthropic Cyber Verification Program is<\/span><\/a>\n <a class=\"toc-item\" href=\"#matters\"><b>2<\/b><span>Why acceptance matters<\/span><\/a>\n <a class=\"toc-item\" href=\"#osto\"><b>3<\/b><span>Why this matters specifically for Osto<\/span><\/a>\n <a class=\"toc-item\" href=\"#work\"><b>4<\/b><span>Where it shows up in our work<\/span><\/a>\n <a class=\"toc-item\" href=\"#attackers\"><b>5<\/b><span>The other direction<\/span><\/a>\n <a class=\"toc-item\" href=\"#clients\"><b>6<\/b><span>What it means for clients<\/span><\/a>\n <\/div>\n <\/section>\n\n <article class=\"article\">\n <p class=\"lede\">Security work has an unusual problem. The same reasoning that helps a defender understand an attack path can look offensive to a general-purpose AI safeguard. A penetration tester and an intruder can ask technically similar questions, even though only one is operating under authorization.<\/p>\n\n <h2 id=\"cvp\">What the Anthropic Cyber Verification Program is<\/h2>\n\n <p>The <strong>Anthropic Cyber Verification Program<\/strong>, or CVP, is Anthropic’s route for verified cybersecurity professionals whose legitimate work can otherwise be affected by safeguards around high-risk dual-use cyber activity.<\/p>\n\n <p>The important distinction is that verification does not make every cyber request permissible. It gives approved defenders more room to perform legitimate work while prohibited activities remain prohibited.<\/p>\n\n <section class=\"infographic\">\n <p class=\"section-label\">How the boundary works<\/p>\n <div class=\"tier-grid\">\n <div class=\"tier\">\n <div class=\"num\">1<\/div>\n <strong>Standard defensive<\/strong>\n <p>Secure code review, hardening guidance, policy work and lower-risk defensive analysis.<\/p>\n <\/div>\n <div class=\"tier\">\n <div class=\"num\">2<\/div>\n <strong>High-risk dual-use<\/strong>\n <p>Exploitability research, adversary simulation and certain offensive security tooling in legitimate contexts.<\/p>\n <\/div>\n <div class=\"tier\">\n <div class=\"num\">3<\/div>\n <strong>Prohibited<\/strong>\n <p>Activities such as mass data exfiltration or ransomware development remain blocked.<\/p>\n <\/div>\n <\/div>\n <\/section>\n\n <div class=\"highlight-note\"><strong>The part worth reading twice:<\/strong> verification widens access for legitimate dual-use security work. It does not remove the floor.<\/div>\n\n <h2 id=\"matters\">Why Anthropic Cyber Verification Program acceptance matters<\/h2>\n\n <p>For us, the significance is operational. Security work becomes less useful when analysis ends at \u201ca vulnerability exists.\u201d Clients need to understand whether the weakness is reachable, what an attacker could chain it with, which asset becomes exposed and what should be fixed first.<\/p>\n\n <p>That is the gap between a finding and a real risk.<\/p>\n\n <div class=\"split-grid\">\n <div class=\"split-card pastel-1\">\n <p class=\"section-label\">From finding to decision<\/p>\n <svg viewBox=\"0 0 520 250\" width=\"100%\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"Find reason prioritise security analysis flow\">\n <rect width=\"520\" height=\"250\" fill=\"#FFFFFF\"\/>\n <rect x=\"26\" y=\"72\" width=\"132\" height=\"76\" rx=\"16\" fill=\"#EEF3FF\" stroke=\"#DDE5FA\"\/>\n <text x=\"92\" y=\"101\" text-anchor=\"middle\" fill=\"#101828\" font-size=\"15\" font-family=\"Arial, Helvetica, sans-serif\" font-weight=\"700\">Find<\/text>\n <text x=\"92\" y=\"124\" text-anchor=\"middle\" fill=\"#667085\" font-size=\"11\" font-family=\"Arial, Helvetica, sans-serif\">Identify weakness<\/text>\n\n <rect x=\"194\" y=\"72\" width=\"132\" height=\"76\" rx=\"16\" fill=\"#F6F8FF\" stroke=\"#DDE5FA\"\/>\n <text x=\"260\" y=\"101\" text-anchor=\"middle\" fill=\"#101828\" font-size=\"15\" font-family=\"Arial, Helvetica, sans-serif\" font-weight=\"700\">Reason<\/text>\n <text x=\"260\" y=\"124\" text-anchor=\"middle\" fill=\"#667085\" font-size=\"11\" font-family=\"Arial, Helvetica, sans-serif\">Assess attack path<\/text>\n\n <rect x=\"362\" y=\"72\" width=\"132\" height=\"76\" rx=\"16\" fill=\"#EEF3FF\" stroke=\"#DDE5FA\"\/>\n <text x=\"428\" y=\"101\" text-anchor=\"middle\" fill=\"#101828\" font-size=\"15\" font-family=\"Arial, Helvetica, sans-serif\" font-weight=\"700\">Prioritise<\/text>\n <text x=\"428\" y=\"124\" text-anchor=\"middle\" fill=\"#667085\" font-size=\"11\" font-family=\"Arial, Helvetica, sans-serif\">Focus remediation<\/text>\n\n <path d=\"M160 110 L188 110\" stroke=\"#1C267A\" stroke-width=\"3\"\/>\n <polygon points=\"188,110 179,105 179,115\" fill=\"#1C267A\"\/>\n <path d=\"M328 110 L356 110\" stroke=\"#1C267A\" stroke-width=\"3\"\/>\n <polygon points=\"356,110 347,105 347,115\" fill=\"#1C267A\"\/>\n\n <text x=\"26\" y=\"196\" fill=\"#667085\" font-size=\"12\" font-family=\"Arial, Helvetica, sans-serif\">The analysis layer turns technical findings into clearer remediation decisions.<\/text>\n <\/svg>\n <\/div>\n\n <div class=\"split-card pastel-2\">\n <p class=\"section-label\">What deeper reasoning improves<\/p>\n <svg viewBox=\"0 0 520 270\" width=\"100%\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"Bar chart of deeper security reasoning benefits\">\n <rect width=\"520\" height=\"270\" fill=\"#FFFFFF\"\/>\n\n <text x=\"24\" y=\"44\" fill=\"#344054\" font-size=\"12\" font-family=\"Arial, Helvetica, sans-serif\">Exploitability context<\/text>\n <rect x=\"24\" y=\"55\" width=\"430\" height=\"14\" rx=\"7\" fill=\"#EEF3FF\"\/>\n <rect x=\"24\" y=\"55\" width=\"286\" height=\"14\" rx=\"7\" fill=\"#1C267A\"\/>\n\n <text x=\"24\" y=\"108\" fill=\"#344054\" font-size=\"12\" font-family=\"Arial, Helvetica, sans-serif\">Attack-path clarity<\/text>\n <rect x=\"24\" y=\"119\" width=\"430\" height=\"14\" rx=\"7\" fill=\"#EEF3FF\"\/>\n <rect x=\"24\" y=\"119\" width=\"344\" height=\"14\" rx=\"7\" fill=\"#1C267A\"\/>\n\n <text x=\"24\" y=\"172\" fill=\"#344054\" font-size=\"12\" font-family=\"Arial, Helvetica, sans-serif\">Actionable prioritisation<\/text>\n <rect x=\"24\" y=\"183\" width=\"430\" height=\"14\" rx=\"7\" fill=\"#EEF3FF\"\/>\n <rect x=\"24\" y=\"183\" width=\"387\" height=\"14\" rx=\"7\" fill=\"#1C267A\"\/>\n\n <text x=\"24\" y=\"232\" fill=\"#667085\" font-size=\"11\" font-family=\"Arial, Helvetica, sans-serif\">Illustrative comparison of where deeper analysis adds value. Not a measured performance claim.<\/text>\n <\/svg>\n <\/div>\n <\/div>\n\n <p>The <strong>Anthropic Cyber Verification Program<\/strong> helps approved defensive organizations use advanced model reasoning with fewer interruptions when that work legitimately crosses into dual-use territory.<\/p>\n\n <h2 id=\"osto\">Why this matters specifically for Osto<\/h2>\n\n <p>Osto works across web and API <a href=\"https:\/\/www.osto.one\/resources\/glossary\/vapt\/\">VAPT<\/a>, cloud infrastructure assessment, red team exercises, source code review and detection engineering. A meaningful part of that work requires thinking about what an attacker would actually do with a weakness.<\/p>\n\n <p>Consider an assessment that returns 80 findings. A severity score can help sort them, but it cannot tell a client whether an issue is actually exposed, protected by compensating controls, reachable from the internet or useful as part of a larger attack path.<\/p>\n\n <p>That is why verified access matters most after a vulnerability has already been discovered. It strengthens the reasoning layer that turns a list of findings into a remediation plan.<\/p>\n\n <table class=\"compare\">\n <thead>\n <tr>\n <th>Without deeper attack-path reasoning<\/th>\n <th>With scoped adversarial analysis<\/th>\n <\/tr>\n <\/thead>\n <tbody>\n <tr>\n <td>Severity-led triage<\/td>\n <td>Reachability and real-world impact considered alongside severity<\/td>\n <\/tr>\n <tr>\n <td>Detection based mainly on static indicators<\/td>\n <td>Detection logic informed by modeled attacker behavior<\/td>\n <\/tr>\n <tr>\n <td>Individual findings treated separately<\/td>\n <td>Weaknesses evaluated as possible attack chains<\/td>\n <\/tr>\n <\/tbody>\n <\/table>\n\n <h2 id=\"work\">Where this shows up in our work<\/h2>\n\n <div class=\"work-grid\">\n <div class=\"work-card\">\n <h3>Exploitability analysis<\/h3>\n <p>Separating findings that are realistically reachable from findings that exist mainly on paper.<\/p>\n <\/div>\n <div class=\"work-card\">\n <h3>Detection engineering<\/h3>\n <p>Reasoning about attacker behavior across signals instead of depending only on static signatures.<\/p>\n <\/div>\n <div class=\"work-card\">\n <h3>Threat modeling<\/h3>\n <p>Pressure-testing assumptions, trust boundaries and control gaps before an attacker discovers them.<\/p>\n <\/div>\n <div class=\"work-card\">\n <h3>Red team research<\/h3>\n <p>Studying realistic attacker paths inside a clearly agreed and explicitly authorized scope.<\/p>\n <\/div>\n <div class=\"work-card\">\n <h3>VAPT prioritization<\/h3>\n <p>Turning dozens of findings into a clearer view of which issues need action first and why.<\/p>\n <\/div>\n <\/div>\n\n <p>Across every engagement, the difficult part is rarely producing a longer report. It is establishing a defensible line between a technical finding and a business-relevant security risk.<\/p>\n\n <h2 id=\"attackers\">The other direction: AI is changing the attacker too<\/h2>\n\n <p>AI is not only improving defensive workflows. Attackers have access to increasingly capable automation and reasoning tools as well. Any security program that models only yesterday’s attacker will eventually fall behind.<\/p>\n\n <p>Verified access helps legitimate researchers study offensive capability within a controlled process so defenses can reflect what is possible now, not what was common several years ago.<\/p>\n\n <p>The goal is not offensive capability for its own sake. The goal is better defense.<\/p>\n\n <h2 id=\"clients\">What it means for clients<\/h2>\n\n <p>Clients should not expect the dashboard to look different tomorrow. The improvement happens upstream, in the research and analysis feeding VAPT reports, code-security findings, cloud assessments and cross-module detection.<\/p>\n\n <ul class=\"client-list\">\n <li><span class=\"check\">\u2713<\/span><span><strong>Sharper triage.<\/strong> Fewer findings that lead nowhere and a clearer line between critical exposure and noise.<\/span><\/li>\n <li><span class=\"check\">\u2713<\/span><span><strong>Better attack-path context.<\/strong> Guidance considers what an attacker could realistically chain together, not only the isolated score of each issue.<\/span><\/li>\n <li><span class=\"check\">\u2713<\/span><span><strong>More useful remediation.<\/strong> Recommendations are shaped by likely impact and control context rather than generic checklist language.<\/span><\/li>\n <li><span class=\"check\">\u2713<\/span><span><strong>Research that keeps pace.<\/strong> Defensive analysis can better reflect the way AI-assisted attack capability is evolving.<\/span><\/li>\n <li><span class=\"check\">\u2713<\/span><span><strong>The same authorization boundaries.<\/strong> Verified access changes the quality of analysis, not what Osto is permitted to touch.<\/span><\/li>\n <\/ul>\n\n <h2>The authorization boundary does not change<\/h2>\n\n <p>Every client engagement continues to operate within its agreed scope and written authorization. Systems outside that scope remain outside it. Human security professionals continue to review analysis before it reaches a client.<\/p>\n\n <p>AI supports the research and reasoning layer. It does not replace professional judgment, client authorization or engagement controls.<\/p>\n\n <p>Acceptance into the <strong>Anthropic Cyber Verification Program<\/strong> strengthens that research layer without changing those fundamentals.<\/p>\n\n <section class=\"cta\">\n <h2>Put verified AI-assisted security research to work.<\/h2>\n <p>See how Osto combines expert-led testing with advanced exploitability analysis, adversary simulation and clearer remediation guidance, within the same strict authorization boundaries.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" target=\"_blank\" rel=\"noopener\">Book a Demo<\/a>\n <\/section>\n\n <section class=\"card pastel-blue\">\n <h2 class=\"faq-title\">Frequently asked questions<\/h2>\n <div class=\"faq\">\n <details>\n <summary>Does verification lift every cyber restriction?<\/summary>\n <p>No. CVP is intended to reduce interruptions for legitimate dual-use cybersecurity work. Prohibited cyber activity remains restricted regardless of verification status.<\/p>\n <\/details>\n\n <details>\n <summary>Does this mean AI now runs Osto’s penetration tests?<\/summary>\n <p>No. Osto’s <a href=\"https:\/\/www.osto.one\/resources\/glossary\/penetration-testing\/\">penetration testing<\/a> remains expert-led. AI can improve research, exploitability reasoning, threat modeling and prioritization, while human security professionals remain responsible for the engagement and client-facing output.<\/p>\n <\/details>\n\n <details>\n <summary>Does verification change what Osto can test?<\/summary>\n <p>No. Testing remains limited to systems Osto owns or is explicitly authorized to assess under the agreed engagement scope.<\/p>\n <\/details>\n\n <details>\n <summary>Who can apply to the Anthropic Cyber Verification Program?<\/summary>\n <p>Anthropic describes CVP as a free, application-based program for cybersecurity professionals with legitimate use cases that can be affected by cyber safeguards.<\/p>\n <\/details>\n\n <details>\n <summary>Does the Anthropic Cyber Verification Program remove safeguards completely?<\/summary>\n <p>No. The program provides greater room for approved dual-use defensive work. It does not remove restrictions around prohibited cyber activity.<\/p>\n <\/details>\n <\/div>\n <\/section>\n\n <section class=\"card pastel-mix\">\n <h2 class=\"related-title\">Related reading<\/h2>\n <div class=\"related\">\n <a href=\"https:\/\/www.osto.one\/resources\/blog\/vapt-vs-vulnerability-scanning\/\">\n <small>Blog<\/small>\n <strong>VAPT vs Vulnerability Scanning: Why a Scan Isn’t a Pentest<\/strong>\n <span>Read article \u2192<\/span>\n <\/a>\n <a href=\"https:\/\/www.osto.one\/resources\/blog\/how-to-read-a-vapt-report\/\">\n <small>Blog<\/small>\n <strong>How to Read a VAPT \/ Pentest Report: A Practical Guide<\/strong>\n <span>Read article \u2192<\/span>\n <\/a>\n <a href=\"https:\/\/www.osto.one\/resources\/blog\/vapt-for-startups-first-pentest\/\">\n <small>Blog<\/small>\n <strong>VAPT for Startups: When You Need Your First Pentest<\/strong>\n <span>Read article \u2192<\/span>\n <\/a>\n <\/div>\n <\/section>\n\n <p class=\"source-note\">Primary program reference: Anthropic’s Cyber Verification Program documentation. The program affects access to supported AI capabilities. It does not change the authorization scope of a client security engagement.<\/p>\n <\/article>\n <\/div>\n<\/main>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>Anthropic Cyber Verification Program: 5 Powerful Benefits | Osto Announcement Osto has been accepted into the Anthropic Cyber Verification Program.\u2026<\/p>\n","protected":false},"author":8,"featured_media":1045,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[51],"tags":[490,489,488],"class_list":["post-1044","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-announcement","tag-ai-assisted-penetration-testing","tag-ai-security-research","tag-anthropic-cvp"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1044","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1044"}],"version-history":[{"count":3,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1044\/revisions"}],"predecessor-version":[{"id":1048,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1044\/revisions\/1048"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1045"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1044"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1044"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1044"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}