The Two-Tier Cyber Defense Problem: Vetted AI Access

Key Takeaways

Between September 1 and 2, 2026, Google, Anthropic, and OpenAI each disclosed frontier-capable cybersecurity models paired with restricted “vetted access” programs — Google’s Fairwind Program, Anthropic’s Cyber Verification Program (CVP) and the expanded Project Glasswing initiative, and OpenAI’s Daybreak Blue program — reflecting a shared industry judgment that these models’ offensive capability now exceeds what general availability can responsibly carry [1]. A survey of eight comparable programs across five labs, including Microsoft and Z.ai, finds that only two publish pricing and that eligibility criteria for most of the surveyed programs favor governments, critical infrastructure operators, and organizations that already maintain dedicated internal security teams [2].

The result, in this note’s assessment, is a structural two-tier defense market: a narrow set of well-resourced, pre-vetted organizations gains early access to frontier-level defensive AI, while the much larger population of mid-market enterprises, regional managed security service providers (MSSPs), and under-resourced public-sector bodies is left on generally available (GA) tooling that lags the frontier at precisely the moment allied intelligence agencies have warned that the gap between vulnerability discovery and weaponized exploitation is collapsing [3]. This research note examines the September 2026 disclosures, situates them against CSA’s existing concentration-risk research, and recommends how security leaders — whether inside or outside the vetted tier — should adjust posture and vendor risk assessments accordingly.

Background

The September disclosures followed a similar structural logic across all three labs, even though their programs differ in mechanics. Google introduced Gemini 3.8 Flash Cyber through its Fairwind Program, describing it as the company’s most capable cybersecurity model and pairing it with CodeMender, a vulnerability-fixing harness that can identify, validate, and patch a flaw inside a secure cloud environment within minutes [4]. Google is staging access in three groups — national cyber authorities, operators of critical infrastructure such as healthcare, energy, and telecommunications, and providers of widely used software platforms — and says it is currently working with more than 650 partners, including CrowdStrike, Datadog, Menlo Security, Palo Alto Networks, and Snowflake [1][4]. Participating organizations must limit use to internal security, incident response, or penetration testing staff and deploy controls such as multi-factor authentication, effectively requiring a baseline of security maturity as a precondition of eligibility [4].

Anthropic took a differentiated approach across two models. Claude Fable 5.1 is generally available but redirects higher-risk requests — penetration testing, exploit generation, and binary-based vulnerability scanning — to more tightly gated Opus-tier handling, while Claude Mythos 5.1 is restricted entirely to trusted access programs in cybersecurity and life sciences [1]. Anthropic’s Cyber Verification Program, which currently serves only U.S. organizations while the company works to expand internationally, and its parallel Project Glasswing initiative — which Anthropic has previously credited with helping partners identify more than 10,000 high- or critical-severity vulnerabilities and which it expanded to roughly 150 organizations across more than fifteen countries earlier in 2026 — together constitute the practical channel through which an organization can obtain Mythos-level access [5]. Anthropic paired these programs with Enterprise Frontier Safeguards, a framework combining privacy protections with misuse detection while giving customer organizations some control over how their data is handled [1].

OpenAI’s disclosure carried the starkest capability signal. The company said its upcoming Astra model is the first to cross the “Critical” threshold on its internal Preparedness Framework — a designation reserved for models that can independently discover and exploit zero-day vulnerabilities across well-defended systems or execute a complete attack chain against a hardened target from a high-level instruction alone [6]. In testing, Astra achieved a perfect score on ExploitBench, discovered two previously unknown zero-day vulnerabilities during a separate evaluation, and in expert-led red-teaming built a full browser-compromise chain that escaped a sandbox and executed commands on the host, along with a local privilege-escalation chain against a hardened operating system [6]. Because of that capability, OpenAI is routing Astra’s most advanced functions through the Daybreak Blue program, which requires identity verification, legal attestations, approved-use restrictions, and ongoing account monitoring, and says the model declines roughly 91.5% of jailbreak attempts as a further safeguard [1][6].

The pattern extends beyond the three most prominent labs. Microsoft embedded its own MAI-Cyber-1-Flash model inside MDASH, a multi-agent vulnerability-discovery harness that reached 95.95% on the CyberGym benchmark at roughly half the cost of competing configurations, and gates access at the product level — through enterprise controls such as role-based access, tenant isolation, and sandboxed, network-isolated execution — rather than through individual vetting of named users [7][8]. Z.ai took a third approach entirely, releasing its open-weight GLM-5.3 model to the general public after a two-week internal safety evaluation window rather than restricting access indefinitely [2]. Taken together, the market now offers defenders three distinct gating models — vetted-individual programs (Google, Anthropic, OpenAI), product-embedded access (Microsoft), and time-delayed open release (Z.ai) — each of which allocates frontier-level defensive capability differently. Phased, vetted rollout is a defensible operational response to genuine review-bandwidth and trust-building constraints, not necessarily evidence of indifference to who is left out; even so, none of the five programs appears, from the eligibility criteria disclosed to date, to have been designed with equitable distribution across the defender population as a primary goal.

Security Analysis

In this note’s assessment, the dual-use dilemma behind these programs is genuine rather than a marketing frame. A model that can autonomously chain zero-day discovery into a working exploit, as Astra demonstrated, or that has already helped identify more than 10,000 critical vulnerabilities in production software, as Project Glasswing has, is capable of causing serious harm in the wrong hands, and allied intelligence agencies have documented how the discovery-to-weaponization window has already compressed from years to months, and in specific cases to hours, as AI tooling automates exploit generation at a scale no human analyst can match [3]. Restricting the most capable configurations of these models to vetted defenders is a reasonable response to that risk on its own terms. The concentration problem is not that vetting exists, but that the vetting criteria observed across all three vetted-access programs appear to favor organizations that are already well resourced: national governments, regulated critical infrastructure operators, and enterprises with dedicated internal security teams large enough to satisfy background-check and access-control requirements [2][4]. A regional hospital system, a mid-market manufacturer, or a small MSSP serving dozens of small-business clients would, based on the disclosed criteria, appear structurally less likely to qualify for any of the three programs than a national cyber authority or a Fortune 500 security operations center, even though the smaller organizations arguably face the same compressed attack timeline with fewer resources to compensate.

That skew is compounded by an opacity problem. Of the eight vetted or restricted programs surveyed, only two publish pricing, and eligibility criteria are disclosed unevenly, which means an organization considering whether to apply cannot easily budget for the possibility of acceptance or compare programs against one another [2]. This is a meaningful departure from how enterprises typically evaluate a new security tool, where published pricing and documented requirements let a security leader make a go/no-go decision before committing scarce staff time to an application process. The practical effect is that organizations without an existing relationship to a major cloud or AI vendor — precisely the organizations least likely to have an account team already advocating internally on their behalf — face the highest search cost for finding out whether they even qualify.

The asymmetry matters most when set against who does not need to apply at all. Vetting gates the population of benign defenders who are willing to identify themselves, attest to authorized use, and accept monitoring; it does not gate a well-resourced attacker, who has no reason to apply for a defensive access program in the first place. Nation-state and organized-crime actors seeking offensive AI capability can pursue jailbreaks of generally available models, invest in their own capability development, or adopt open-weight models that, per CSA’s concentration-risk research, currently trail the closed frontier by a matter of months rather than years. The vetting gate therefore filters out primarily the defenders who lack the resources or relationships to clear it, while doing comparatively little to filter out the attackers with the resources to route around it — an outcome that leaves the population least able to absorb the compressed attack timeline with the least access to defensive tooling, even though filtering out benign applicants was not the programs’ intent.

This access-tiering problem sits alongside, but is analytically distinct from, the frontier-model dependency risk CSA has previously documented. That earlier work examined what happens when an enterprise builds its operations around one of a small number of frontier providers and that provider’s access is disrupted — as occurred in June 2026, when a U.S. export control directive forced Anthropic to suspend foreign national access to Claude Fable 5 and Mythos 5, reportedly within about ninety minutes of the order being issued [9][10]. The concentration risk described in this note operates one layer upstream of that scenario: it is not about what happens after an organization has dependency-level access to a frontier model, but about which organizations are granted defensive-tier access to begin with, and on what basis. The two risks reinforce one another, at least as a foreseeable extension rather than a demonstrated one: no vetted-access program has yet had a grant revoked or paused, but the same regulatory leverage that suspended general API access to Fable 5 and Mythos 5 in June 2026 could plausibly be applied to a vetted-tier grant as well, which would make inclusion in the privileged tier a favorable but fragile position rather than a settled one.

Recommendations

Immediate Actions

Security leaders at organizations not currently inside a vetted-access program should apply to the programs most relevant to their sector now rather than assume ineligibility, since Google, Anthropic, and Microsoft have each signaled active expansion of their partner and customer bases, and eligibility criteria differ enough across programs that an organization excluded from one may qualify for another. Organizations should also inventory their current reliance on any vetted-tier access alongside their existing frontier-model dependency documentation, since the same regulatory leverage that suspended general API access to Fable 5 and Mythos 5 in June 2026 could plausibly be applied to a vetted-tier grant as well — a foreseeable extension of that incident rather than a failure mode that has yet occurred, but one worth planning for regardless.

Short-Term Mitigations

Mid-market and regional organizations that cannot clear an individual vetting bar should evaluate product-embedded access models, such as Microsoft’s MDASH, as a more attainable near-term path to frontier-adjacent defensive capability, since that access is purchased through an enterprise product rather than granted through discretionary vetting of named individuals. Industry information sharing and analysis centers (ISACs) and MSSP associations should consider approaching vendors with an aggregated eligibility case on behalf of smaller members collectively; nothing in the disclosed program mechanics suggests a fixed policy against smaller organizations, and the review-bandwidth constraints Google and Anthropic have cited for their phased rollouts (see Background) may leave room for such a case. Organizations tracking capability gaps for compliance or budgeting purposes should also monitor the catch-up cadence of time-delayed open releases such as Z.ai’s GLM-5.3, since that model narrows the frontier gap on a predictable, if lagging, schedule that can inform interim risk acceptance decisions.

Strategic Considerations

CSA and allied industry bodies should advocate for published pricing and documented eligibility criteria across vetted-access cybersecurity AI programs, treating the current opacity as a governance gap comparable to the assurance gaps CSA’s STAR program was designed to address for cloud services generally. Enterprises should begin treating vetted-tier access itself as a distinct line item in vendor risk assessments and board-level AI governance reporting — not simply whether a frontier model is used, but whether the organization’s defensive posture depends on a grant of access that a small number of vendors could revise, narrow, or revoke with limited notice. Over a longer horizon, the combination of capability concentration among a handful of labs and access concentration among a handful of eligible defender categories may warrant the kind of pooling or backstop mechanisms CSA’s concentration-risk research has proposed for other systemic AI risks, applied here to ensure that under-resourced defenders are not left furthest behind at the exact moment attacker capability is accelerating fastest.

CSA Resource Alignment

This finding builds directly on CSA’s prior analysis of the June 2026 export-control suspension of Fable 5 and Mythos 5, which established that frontier AI access already functions as a regulated, revocable commodity rather than a stable utility; this note extends that lesson from access an organization already holds to access an organization is trying to obtain in the first place, showing that the same fragility applies to vetted-tier grants. It also draws on CSA’s companion research on enterprise concentration among three dominant frontier providers, which underpins the observation that vetted-access eligibility, like general API dependency, is itself concentrated in a small number of gatekeepers. The compressed discovery-to-weaponization window documented by allied intelligence agencies supplies the threat-tempo context that makes the equity gap consequential: it is the backdrop against which unequal distribution of frontier defensive tooling carries the greatest cost for under-resourced defenders [3]. CSA’s concentration-risk research also offers a systemic-risk framing — correlated loss arising from dependence on a small number of upstream providers — that this note applies to defender access rather than to insurance exposure, and its recommendation of aggregation-aware risk management is the model for the pooling mechanisms proposed above. Organizations applying these findings should map vendor risk assessments of vetted-access programs to the Supply Chain Management, Transparency, and Accountability domain of CSA’s AI Controls Matrix (AICM) v1.1, the current superset of the Cloud Controls Matrix, treating access-tier documentation as a control evidence requirement alongside conventional vendor due diligence [11].

References

[1] The Hacker News. “Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs.” The Hacker News, September 2026.

[2] Digital Applied. “Who Gets the Cyber-Capable AI Models: Every Vetting Programme Listed.” Digital Applied Blog, September 2026.

[3] Kiteworks. “Five Eyes Intelligence Alliance Warns AI-Fueled Cyberattacks Are Just Months Away.” Kiteworks, June 2026.

[4] Google. “Fairwind Program: Cyber Defense Tools for Trusted Partners.” Google Blog, September 2026.

[5] Anthropic. “Expanding Project Glasswing.” Anthropic, 2026.

[6] SecurityWeek. “OpenAI’s Astra Crosses ‘Critical’ Cyber Threshold After Finding Zero-Days.” SecurityWeek, September 2026.

[7] TechCrunch. “Microsoft Launches Its First Cybersecurity Model, Plus a New Agentic Cybersecurity System.” TechCrunch, July 27, 2026.

[8] The Hacker News. “Microsoft Says New Cybersecurity AI Model Helps MDASH Score 95.95% at Half the Cost.” The Hacker News, July 2026.

[9] Al Jazeera. “US Orders Anthropic to Disable AI Models for All Foreign Nationals.” Al Jazeera, June 13, 2026.

[10] Techmeme. “Source: Anthropic Was Given 90 Minutes to Comply and Was Not Provided with Detailed Concerns Before the Export Control Order Was Issued.” Techmeme, citing Financial Times, June 15, 2026.

[11] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” Cloud Security Alliance, 2026.