Anthropic Unlocks Claude's Advanced Cyber Capabilities for DefectDojo
Claude's advanced cyber capabilities are locked for almost everyone. Anthropic just unlocked them for DefectDojo, and we're pointing them at defense.
Anthropic has cleared DefectDojo for Claude's advanced cyber capabilities. Exploit development. Red teaming. Penetration testing. Bug bounty work. Claude screens every cybersecurity request in real time and blocks that entire category by default, for everyone, because in the wrong hands it is an attack.
Anthropic decided ours are the right hands. DefectDojo is now in Anthropic's Cyber Verification Program, and the advanced capabilities are on for our team.
Why it matters
AI is finding zero-days in every major operating system and every major browser. Not someday. Anthropic reported it in April. Thousands of high and critical bugs, surfaced by a model, still working through disclosure.
Attackers will have that. They don't ask permission and nobody vets them.
Defenders, meanwhile, were getting told no by their own AI. Halfway through proving a finding is exploitable, while the hole sits open, the safety filter kicks in and the engineer following the rules eats the cost.
Picture it. An engineer has a critical finding from a scanner and needs to know if it's real before the team spends a sprint on it. The fastest way to know is to try the exploit against a test target. Ask Claude for help with that and the safety filter sees an attack in progress. The engineer gets a refusal, the finding stays unverified, and the actual vulnerability sits there either way.
That's the fight DefectDojo was built for, and it just got a lot more even.
Why DefectDojo
Open any DefectDojo test file and it reads like an attacker's notebook. SQL injection strings. Cross-site scripting payloads. Proof-of-concept exploits. Attack paths. That is what 500+ scanners send us every single day, and we build from it.
That's not a quirk of our test suite. It's the whole product. DefectDojo exists to pull in the output of every scanner a team runs, SAST, DAST, SCA, container, cloud, secrets and the rest, and turn it into one queue. Scanner output is exploit evidence: the payload that worked, the path an attacker would take, the proof-of-concept that shows a CVE is reachable. We parse it, deduplicate it, prioritize it, and build our tests from it. Working with attack data all day is the job description.
To a safety filter, our day job looks like an attack. Anthropic looked past the filter. They checked who we are, reviewed the work we do, and said yes.
Plenty of security vendors say they work for defenders. It's on the website, right next to the lock icon. Anthropic verified it.
The strings
The access covers the work we described. It's monitored, and Anthropic can pull it the day we drift. I asked for that. Our users hand us a map of everything wrong with their systems. We would rather be held to account than handed a badge.
Same fight, sharper edge
None of this changes what DefectDojo is. Community Edition is still free and still carries an OSI-approved license. Your findings are still yours. We still fight the lock-in, the pricing games and every roadblock between you and real security.
Matt Tesauro and I built DefectDojo because we were done asking permission to defend our own systems. That was over a decade ago, and the Community Edition has been free with an OSI-approved license since the start. Pro has to earn its keep every day, and if it ever stops, the Community Edition is right there. Ask your other vendors to put that in writing.
The other side has AI. Now the people fixing things have it at full strength, with an outside check on which side we're on.
Fight AI with AI. Our team just got cleared for the advanced stuff.
Greg Anderson
CEO & Co-Founder, DefectDojo