Access Is Not Sovereignty: Who Controls Your Cybersecurity AI?

In just three days, Anthropic made two significant moves in cybersecurity.

On 6 October 2026, the company expanded its Cyber Verification Program, opening access to advanced cybersecurity capabilities for a broader range of verified security professionals. On 8 October, it launched Anthropic Cyber Mission, extending its efforts into operational technology, critical infrastructure and open-source security.

OpenAI is pursuing a parallel strategy through Codex Security and its Daybreak programme, offering increasingly capable models for vulnerability research, security operations and authorised testing.

These developments represent meaningful progress. Frontier AI is becoming a practical component of cybersecurity, moving beyond code assistance towards vulnerability validation, threat investigation and multi-step security workflows.

Yet they also expose a strategic question that capability benchmarks alone cannot answer:

For CISOs, CTOs and business leaders, this is becoming an architectural and procurement decision, not simply a model-selection exercise.

Advanced cybersecurity AI comes with access conditions

OpenAI and Anthropic are developing sophisticated cybersecurity offerings, but their products and access programmes serve different purposes.

OpenAI’s Codex Security helps teams examine repositories, investigate potential vulnerabilities, validate findings and prepare reviewable fixes. It is a security application, not unrestricted access to every specialised cybersecurity model.

Daybreak addresses a different requirement: permission to use additional cybersecurity capabilities.

Under OpenAI’s Daybreak programme, Blue supports verified defensive activities such as vulnerability triage, malware analysis and incident response. Red extends access to advanced authorised penetration testing, red teaming and exploit validation.

GPT-5.6-Cyber requires additional model-specific approval beyond ordinary Red access. Daybreak also restricts downstream customer-facing use, with separate arrangements for organisations building products or services for others.

Anthropic makes comparable distinctions.

Claude Security provides code-security scanning and remediation workflows. Organisations can use the application without receiving independent access to the specialised model powering its scans.

Anthropic’s Cyber Verification Program (CVP) offers Defense, Red Team and Specialized access, with different verification requirements and permitted activities. The Specialized tier is intended for particularly sensitive environments, including systems whose compromise could have physical or systemic consequences.

Anthropic also confirms that generally available Claude models remain usable for ordinary secure coding, vulnerability discovery in owned code and other defensive tasks.

Not all cybersecurity AI requires special approval, but access to certain advanced capabilities does.

These controls have legitimate purposes. Cybersecurity technology is inherently dual-use, and reducing the risk of misuse is a serious responsibility.

However, the operational consequence remains: the provider determines which specialised capabilities are available, to whom and under what conditions.

The more those capabilities become embedded in critical security processes, the more important that dependency becomes.

Permission is not operational continuity

Access can change for reasons unrelated to technical performance.

In June 2026, US export controls forced Anthropic to suspend access to Claude Fable 5 and Mythos 5. The restrictions were subsequently lifted and access restored, but the interruption demonstrated how external regulatory decisions can affect a customer’s ability to use an advanced model.

Alias Robotics examined that incident in June. The significance for cybersecurity was not that the models had failed technically, but that access had become dependent on decisions beyond customers’ control.

The dispute between Anthropic and the US Department of Defense illustrates a different dimension of the same issue. A September 2026 appeals-court decision upheld the Pentagon’s supply-chain-risk designation amid disagreement over restrictions involving autonomous weapons and mass surveillance. Separate litigation concerning other government measures reached a different result.

This was a legal and policy conflict, not evidence of insecure models or compromised customer data.

For security organisations, the relevant question is what happens when an approved capability is no longer available under the same conditions:

• Can an alternative model continue the workflow?
• Are agent tools and evaluation procedures portable?
• Can a sensitive task move to infrastructure controlled by the organisation?

Data protection is not the same as data sovereignty

Sensitive cybersecurity operations create unusually consequential data flows.

A model-assisted investigation can involve source code, network relationships, internal hostnames, technical logs, credentials, infrastructure details and information about unresolved vulnerabilities.

A provider’s data-protection commitments are therefore important. But several controls that appear similar are not interchangeable:

OpenAI provides meaningful enterprise protections. Its API data controls state that API customer data is not used to train models by default. Eligible customers can also request additional retention controls, including Zero Data Retention, subject to approval and feature-specific restrictions.

Anthropic similarly states that it does not train on enterprise customer data without explicit permission.

Its Enterprise Frontier Safeguards, announced in September, is designed to give eligible customers greater control over monitoring-data storage, encryption keys and review procedures within their own cloud environments. Availability is being introduced progressively.

These are substantive safeguards. It would be inaccurate to claim that customers of large frontier laboratories have no control over their information.

However, controlling the retention of certain data does not necessarily mean controlling model execution or the infrastructure delivering it.

What Alias Robotics’ own research reveals

The importance of this distinction is supported by operational evidence.

In the Cybersecurity AI (CAI) Dataset study, Alias Robotics analysed 230,935 cybersecurity AI session logs collected over fourteen months.

The study identified 1,059 sessions, approximately 0.46% of the analysed corpus, containing credential information submitted within operator prompts, according to its detection methodology.

The finding is narrower, but important: sensitive security information can enter AI workflows through normal operator activity.

The implication extends beyond credentials. Source code, incident evidence, asset information and tool outputs may enter the model context during security investigations.

For organisations handling sensitive operations, the question is not merely whether a provider has appropriate privacy policies. It is also which information needs to cross an external inference boundary at all.

The distinction within Alias Robotics

Alias offers different operating models with different control characteristics.

CSI PRO includes Alias-hosted model access and a locally orchestrated security workflow architecture. It can also route requests to supported third-party or custom model backends, depending on configuration and applicable conditions.

This provides useful integration flexibility, but locally orchestrated agents do not automatically mean locally executed inference. When a hosted backend processes an inference request, the information included in that request reaches the backend.

CSI PRO’s current public terms also matter. Clause 4.8 of the Product License permits specified collection and processing of Usage Data, including for model improvement, benchmarking and research, under the stated conditions and with anonymised and aggregated use for those latter purposes.

The exclusion described as Zero-Data for training is reserved for certain Enterprise subscriptions upon request. It is not an automatic entitlement of ordinary CSI PRO and must not be confused with Zero Data Retention.

This means CSI PRO’s standard commercial advantage should not be presented as a universal privacy advantage over OpenAI’s default API training policy.

CSI On-Premise addresses a different requirement: customer-controlled infrastructure, including deployments where sensitive inference and the wider cybersecurity AI stack must remain within an approved environment. The CSI PRO versus On-Premise deployment analysis explains these boundaries in greater detail.

The strongest sovereignty argument is therefore not that one provider always protects data better than another. It is that organisations should be able to choose an architecture and contractual arrangement appropriate to the sensitivity of their operations.

The economics: what does a security investigation actually cost?

Digital sovereignty also has an economic dimension.

Cybersecurity AI workloads can be highly variable. A straightforward investigation may involve limited model activity, while a complex incident can require repeated reasoning, code analysis, tool execution, validation and coordination between agents.

When those activities produce additional billable inference, investigative complexity can increase operational expenditure.

The current API prices of two advanced cybersecurity models illustrate this billing structure:

Published API inference rates as of October 2026, not total product prices or a direct comparison of security effectiveness.

OpenAI’s model documentation also describes caching rates and conditions affecting long-context pricing. Anthropic’s Mythos documentation sets out additional caching and batch-processing rates.

The commercial arrangements around security products also differ. Anthropic states that Claude Security scans are charged at direct token cost without an additional platform fee. That does not establish identical billing for every OpenAI or Anthropic product.

Nor is the market limited to standard pay-per-token pricing. In September, OpenAI announced a $1 billion commitment to subsidised Daybreak access, training and technical support for frontline defenders. It also offers reserved-capacity arrangements for qualifying API customers. Anthropic’s October Cyber Mission includes free security scanning for eligible open-source projects.

These initiatives provide meaningful alternatives for selected users. They should be recognised rather than omitted from the comparison.

Where CSI PRO differs

The standard published CSI PRO subscription offers:

• €350 per month, excluding VAT.
• €3,990 per year, excluding VAT.
• Unlimited included token usage with alias2-mini*, subject to the applicable licence terms.
• 500,000 tokens per minute (TPM) and 60 requests per minute (RPM) as standard published operating limits.

This means additional use of the included alias2-mini inference does not generate a separate marginal per-token charge within the applicable entitlement. For teams whose workloads fit that model, the inference subscription becomes more predictable even when investigative activity varies.

It does not mean unlimited throughput, free third-party inference, zero infrastructure costs or unlimited access to every model. The distinction is about how the commercial model allocates cost, not a claim that CSI PRO is universally cheaper. See the CSI PRO pricing FAQ for the full commercial terms.

Equally, the subscription price does not demonstrate that alias2-mini and the most advanced frontier models deliver equivalent outcomes.

A higher-priced model may solve a particular investigation with fewer calls, fewer retries or less human intervention. A specialised model with included usage may provide better economics for other workloads.

The only defensible comparison is one grounded in results:

Security buyers should benchmark models on their own authorised workflows, comparing validated outcomes, time to resolution, total inference cost and human review, rather than token prices or usage entitlements in isolation.

For example, an AppSec team could evaluate competing systems against the same authorised applications and vulnerability-validation tasks, measuring not only findings produced but confirmed exploitability, false positives, remediation quality and analyst review time.

The important commercial metric is not necessarily price per million tokens. It is cost per validated security outcome, assessed alongside quality, time and operational control. Alias Robotics explores those economics in Why Pay-Per-Token Pricing Doesn’t Scale for Continuous Cybersecurity.

The Alias alternative: choose the operating model, not just the model

The important distinction between CSI and a single hosted foundation-model service is not simply nationality or model ownership. It is the range of architectural choices available across the wider cybersecurity stack.

CSI combines cybersecurity-specialised models, scaffolds, agents, datasets, steering and benchmarking. These components can be configured and deployed according to different requirements, subject to the product, licensing and infrastructure arrangements involved.

Consider an organisation operating two categories of cybersecurity workflow:

• CSI PROFor routine, approved activities, CSI PRO may provide a suitable managed-inference option, with predictable included alias2-mini usage and local orchestration.
• CSI On-PremiseFor highly sensitive work, where investigation context cannot be transmitted to an external inference service, CSI On-Premise provides a different deployment architecture on customer-controlled infrastructure.

Those choices should not be interpreted as automatic workload portability or identical functionality under every plan. Models, licences, integrations and validation requirements still need to be assessed. But they demonstrate why deployment architecture matters independently of model capability.

The published Sovereign AI for National Cyber Defense case study describes a European national-defence organisation deploying CSI entirely on-premise while retaining control over its infrastructure, models, operational data and deployment lifecycle. That is a concrete example of a requirement that cannot be satisfied merely by selecting a provider with a favourable API price or standard retention policy.

At the same time, Alias remains an external supplier to its customers. Its products are governed by licences, contractual terms, maintenance arrangements and support dependencies. Choosing an On-Premise deployment can reduce reliance on the availability of external inference services, but it does not eliminate every supplier dependency.

Three decisions every Cybersecurity AI buyer should make

Before integrating Cybersecurity AI into critical operations, organisations should evaluate three questions separately.

These questions should shape the operating model. For CISOs, they define security risk and resilience requirements. For CTOs, they influence architecture and integration. For CEOs, they affect continuity, procurement exposure and the sustainability of increasingly important security capabilities.

The right answer may be managed AI for one workflow, customer-controlled deployment for another, or a carefully governed combination.

Security-first architecture means establishing these boundaries before critical operations become dependent on them.

Retaining the choice is the real advantage

OpenAI and Anthropic are making important contributions to cybersecurity. Their specialised models, security products, verification programmes and subsidised initiatives can help defenders work more effectively.

But powerful technology does not remove the need to govern its dependencies.

For European organisations, critical infrastructure operators and enterprises, the objective should be to benefit from advanced AI while maintaining appropriate control over essential security capabilities. That means evaluating not only what a model can do, but who determines its availability, how operational data is handled and what happens to costs as investigative demands increase.