Anthropic Joins Accenture, Deloitte, and PwC for OT Defense

Anthropic launched the Anthropic Cyber Mission on Thursday (8), a long-term initiative that starts with two programs: one focused on operational technology (OT) that manages electrical grids, sanitation, and transportation, and a free vulnerability scanning service for open-source software. The first, named Critical Infrastructure Defense Program (CIDP), debuts with 11 founding partners: Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation.

The package includes access to Claude's cutting-edge models, Anthropic engineers allocated on-site, and the company's threat research. The publicly stated target is the vendors defending OT, not the utilities directly.

Why OT Became a Priority

The reasoning is in the announcement itself: industrial controllers and networks are built to last decades and often cannot be shut down for repairs. Known vulnerabilities remain open for years, and a poorly applied patch can bring a plant to a halt.

Partners echoed this sentiment. "Operational technology is the next frontier for autonomous attacks enabled by AI," said Andrew Turner of Booz Allen. Daniel Bernard from CrowdStrike summarized the business case: critical infrastructure facing machine-speed threats requires machine-speed defense. Dan Gunter, CEO of Insane Cyber, pointed out the operational bottleneck, the volume of data spread across remote substations, offshore platforms, and isolated plants, and stated that "Claude bridges this gap."

The announcement includes a rare admission for a launch. Regarding Project Glasswing, a previous vulnerability discovery program with partners, Anthropic states that "we have not yet achieved a sufficient reduction in cyber risk." Glasswing has been incorporated into the Cyber Verification Program, which expands defenders' access to the company's most capable models. Anthropic also notes that it has already provided models and technical support to more than half of the U.S. states, in a program for local governments launched in June.

Numbers from the Open Scanner

The second component, the OSS Scanner, offers periodic and free scans to open-source projects that sign up. According to Anthropic, its models have found over 29,000 candidate vulnerabilities in major projects in the past six months. Approximately 6,000 have undergone manual triage, and nearly 5,000 reports have been sent to maintainers.

The difference now is that reports arrive without human review. The company estimates a true positive rate above 90% and cites a sample: experts checked 97 critical and high-severity findings across 48 projects, and 85 of them (88%) met the coordinated disclosure standard. Of the 12 remaining, 11 were real but duplicates or already known, and one was a false positive. Todd Ouska from wolfSSL reported that out of 74 reports received, all but two were valid, with five turning into CVEs.

Anthropic acknowledges that model-generated reports can contain errors, such as miscalibrated severity, and limits the service to projects equipped to handle the volume. Others continue to receive human-verified disclosures.

Changes for Consultancies and Operators

The list of partners speaks more than the program itself. Accenture, Deloitte, and PwC enter as integrators: they sell OT projects in energy, sanitation, and manufacturing and will now have a cutting-edge model with field engineers from the manufacturer in their offerings. Harpreet Sidhu from Accenture advocated for bringing AI-based defense to organizations that keep energy, pharmaceuticals, food, and communications operational. For a utility CISO, the practical consequence is that the next OT security proposal will likely come with AI built into the scope and cost.

In the United States, where Booz Allen, Dragos, and Rockwell are located, the program fits into a market where government and private operators already collaborate. In Japan, the entry of Hitachi carries another significance. Hiroaki Koiwa from the company stated that the cyber resilience of OT supporting social infrastructure is a top priority. This statement comes in the same week a ransomware attack on the cloud of IDC Frontier, a subsidiary of SoftBank, impacted 495 companies and local governments in Japan, including the province of Ibaraki, whose website went offline.

The Japanese incident occurred in a corporate cloud, not in OT, but highlights the same vulnerability that Anthropic aims to address: shared infrastructure upon which hundreds of organizations depend without their own recovery plans. Anthropic has not disclosed the program's costs or timeline for expanding the partner list, and the effectiveness of the CIDP will only be evident when the first operator reports how long it took to fix a vulnerability that previously remained open for years.