Anthropic updated Claude Security on October 21, and the change is more significant than a typical point release. The tool went from a one-shot scanner — run it, get findings, watch them age — to a continuous monitor that rescans as code changes, tracks every finding until it closes, and reopens issues if they regress. If you’re on Claude Enterprise, it’s live now. And if you haven’t evaluated it yet, there’s a $25,000/month credit offer running through December 31 that makes the cost of trying it effectively zero.
Four Things That Actually Changed #
1. Continuous Scanning
Claude Security now runs a deep baseline scan of all connected repositories, then rescans automatically when code changes — prioritizing by risk and complexity. Most teams don’t run security scans between PRs, which means findings go stale within days. Continuous scanning closes that gap without requiring workflow changes from the team.
Support covers GitHub, GitHub Enterprise Server, GitLab, and other Git providers via access tokens. Projects support up to eight repositories, which means cross-service vulnerability detection — finding the flaw that spans your API gateway and your auth service — is now possible without manual effort.
2. Fix Tracking
When a fix merges, Claude Security marks the finding resolved automatically. If the issue regresses, it reopens. No manual ticket closure, no stale backlog entries claiming a vulnerability is open when the fix shipped six sprints ago. Security backlogs that lose credibility kill triage discipline — and fix tracking is the mechanism that keeps the list accurate without human maintenance.
3. Per-Project Threat Modeling
Each project now generates a customizable threat model based on the codebase. Teams can edit it with context code alone can’t show: deployment environment, compliance frameworks, existing controls. Severity ratings then calibrate against your threat model, not a vendor-defined CVE score. The practical effect: fewer “critical” findings for vulnerabilities that exist in the code but can’t actually be reached from your production attack surface.
4. API, Webhooks, and the MCP Connector
The API handles the full findings lifecycle: list, read, resolve, reopen, manage projects. Webhooks push findings to Slack or Jira. The MCP connector integrates Claude Security directly into Claude.ai and Claude Code — an engineer can surface a finding, discuss it with Claude, write the fix, and mark it resolved without leaving their Claude session.
That last part is where Claude Security starts feeling less like a security product and more like a security layer inside Claude. The procurement advantage is real regardless: enterprise teams skip weeks of DPA negotiations and architecture reviews because this runs inside the Claude tenant they already approved.
What It Still Doesn’t Cover #
Claude Security catches the class of vulnerability that pattern-matching SAST tools miss — the logic flaw where a value enters via a webhook, transits through a cache, and lands in a database query without escaping, across three services, in three files that no single-file scanner reads together. Vanta’s security director noted it “found logic flaws that none of our other tools had caught.” An IonQ engineer found issues “a traditional pen test conducted at the same time missed.”
That said: it does not cover runtime monitoring, dependency vulnerabilities, infrastructure misconfiguration, or container scanning. It’s not a replacement for Snyk or GitHub Advanced Security — it’s a complement for the class of vulnerability those tools structurally can’t find.
ZDR Requirement? Use the Plugin Instead #
The hosted Claude Security service doesn’t support Zero Data Retention. If your organization requires ZDR, Anthropic ships the same scanner technology as a Claude Code plugin that runs entirely in your own session — source code never leaves your environment. Same detection capability, different deployment model.
The $25K Credits Offer Is Worth Taking Seriously #
Claude Enterprise customers can get up to $25,000/month in usage credits for two months through December 31, 2026. Running a baseline scan on a production codebase has asymmetric value: the cost is one or two engineer-hours to set up, and the floor outcome is a complete picture of what your SAST tools have been missing. Even if you decide continuous scanning isn’t in your security stack permanently, the baseline data has lasting value for backlog prioritization.
Enable it from Claude Enterprise settings. Full documentation and API reference are at claude.com/product/claude-security.