Claude Security adds continuous scans and tracks fixes

Listen to this article

Anthropic updated Claude Security on October 21, 2026, adding continuous repository monitoring, automatic fix tracking and integration controls. The updated service is available in public beta for Claude Enterprise customers.

The company says a baseline scan is followed by checks as code changes. Findings close when fixes land and reopen if the issue returns. Its API and MCP connector bring findings into other workflows, while webhooks announce new findings.

API tokens inherit the user’s permissions. Administrative controls determine who can create projects or view, triage and manage findings across the organization.

Projects need access and review

The setup guide requires an Enterprise account and a seat that includes Claude Code. Administrators control project creation. GitHub repositories need the Claude app and each user’s connected account. Other Git providers require repository credentials.

A project can contain up to eight repositories. Teams can choose branches, folder scopes and exclusions, and supply deployment context. Excluded folders can still be read for context, so narrowing a scan is not an absolute reading boundary.

Project roles separate Full management from Triage, which can update findings and start fixes, and View access. Suggested patches still go to people for review.

Deployment context shapes findings

Projects include a knowledge base for deployment details and security policies. Anthropic says generated threat models can be reviewed and edited, then used to prioritize findings and account for controls outside the code.

Continuous does not mean a fixed interval

The Help Center says scan timing depends on risk and complexity, with no fixed schedule. Runs are stochastic, so identical code can produce different findings. The hosted service does not support Zero Data Retention.

Migration leaves settings behind

Existing projects keep running. Owners can migrate their projects. Migration creates a new project, copies findings and archives the original. Members, webhooks, excluded directories, scan history and scheduled scans are not copied. GitHub Enterprise projects cannot be migrated.

Credits have a calendar deadline

Eligible Enterprise organizations get up to $25,000 for each of two consecutive months, measured from their start date. Existing customers start October 21, new customers on signup, regardless of use. Unused credits do not roll over. The new experience is covered until December 31, 2026 UTC, leaving signups after November 1 short of two full months. After credits, usage is billed at direct token cost.

ByteForward has not scanned a repository or validated the service’s detection accuracy.

Illustrative software development photograph by cottonbro studio, via Pexels, used under the Pexels License.