A Critical Capability Level is a safety threshold used to judge when an AI system has gained enough cyber capability to require stronger controls. In practice, it is a policy line: below it, a model may be usable for limited security tasks; at or above it, the model may need tighter access, monitoring, testing, and deployment restrictions.
This matters because cyber-capable models can be dual-use. The same features that help defenders, such as code analysis, vulnerability discovery, or remediation support, can also help attackers automate reconnaissance, exploit development, or phishing workflows. Security teams use thresholds like this to decide when a model should be gated behind human review, logged more aggressively, or kept in restricted pilots. In defense workflows, the level helps separate useful automation from capabilities that are too risky to release broadly.