--- title: "Continuous Claude Security for Your Firm | By The People Tech" description: "Claude Security now scans repositories continuously and tracks fixes, in public beta for Claude Enterprise customers. Free credits apply through 31 Dec 2026." url: https://bythepeople.tech/claude/whats-new/claude-security-continuous-scanning --- [Claude for Business](/claude) [What’s New](/claude/whats-new) Claude Security scans continuously and tracks fixes New feature Released 21 October 2026 · 5 min read # Security scans now _keep up_ with every code change. A new version of Claude Security is in public beta for Claude Enterprise customers. It watches your repositories as code changes, marks findings fixed when the fix ships and reopens them if the issue comes back. Organizations receive $25,000 in free usage credits each month, for two months, for usage through December 31, 2026. At a glance Status Public beta Plan Claude Enterprise Free credits $25,000 a month for 2 months Offer covers Usage through 31 Dec 2026 Turned on in Admin console On this page * [What changed](#changed) * [What it means](#means) * [What to do this week](#steps) * [Questions](#questions) Published by [Fatjon (Tony) Kalemaj](/about-us/tony-kalemaj) COO & Head of Applied AI 01 · What changed ## What Anthropic shipped. Claude Security entered public beta in April, and Anthropic says thousands of organizations have used it to find over a million vulnerabilities. Until this release, someone had to start each scan. Now a project runs a deep baseline scan, then scans changes regularly based on their risk and complexity, so the findings list stays close to the current state of the code. In practice the list works as a live register of open and fixed issues, kept current without anyone scheduling a scan. ### 1. Continuous monitoring 1\. Connect repositories through the Claude GitHub app (including GitHub Enterprise Server) or an access token from GitLab and other Git providers, and choose the branch and scope. After a baseline scan, Claude scans changes regularly based on their risk and complexity. ### 2. Multi-repository projects 2\. A project can hold several repositories. Claude can then catch issues between services, such as a backend that trusts input a client was supposed to validate. ### 3. Fix tracking 3\. Open findings are checked against changed code and marked fixed when the fix lands, whether it was made in Claude Code or elsewhere. If the issue is found again, the finding reopens automatically. ### 4. Knowledge base, threat model 4\. Each project has a knowledge base for how code is deployed, which security policies apply and what a new security engineer would need to know. Claude also generates a threat model your team can review and edit, and later scans use it. ### 5. Severity and exploit paths 5\. Each finding has a severity rating judged against the project's threat model and an explanation of how an attacker could reach the code. Findings can include a diagram of the attack path. ### 6. API and webhooks 6\. The API lists, reads, resolves and reopens findings and creates and manages projects. Personal access tokens see and change only what their user can, and webhooks can notify your systems of new findings. ### 7. MCP connector 7\. Claude Security is available as an MCP connector in Claude.ai and Claude Code. An engineer can pull up a finding, ask Claude about it, start the fix and mark it resolved in one session. ### 8. Role-based access 8\. Admins decide who can view projects, triage findings and create projects. Teams that own code can be given access without the right to create projects. 02 · What it means ## What it means for _your_ seat. For a firm whose engineers build internal tools, such as an investor portal, a portfolio reporting dashboard or an app that reads data room files, this turns vulnerability review from an occasional exercise into a standing record of what was found and whether it was fixed. It is a public beta and only on Claude Enterprise, so the practical question is whether to run it on one set of repositories while the free credits apply. ### Leadership Claude Security is in public beta and available only to Claude Enterprise customers. Anthropic is offering $25,000 in free usage credits each month for two months, for usage through December 31, 2026, with full terms in the Help Center. Decide which of the firm's own code is in scope and who owns the results before anyone connects a repository. ### Risk and compliance Findings are tracked until the fix ships and reopen automatically if the issue returns, which gives a running status record you can ask engineering to report from. Each project's knowledge base can hold the security policies that apply, and the generated threat model can be reviewed and edited. The performance claims and customer quotes are Anthropic's, so treat this beta as an addition to existing controls until your own review says otherwise. ### IT and engineering Connect repositories through the Claude GitHub app, which covers GitHub Enterprise Server, or with an access token from GitLab and other Git providers, and set the branch and scope for each. Group services that depend on each other in one project so issues between them can be caught. The API, webhooks and the MCP connector in Claude Code let findings reach your ticketing and let engineers fix and resolve them in one session. ### Enterprise admins Admins enable Claude Security in the admin console and set who can access it. The new role-based access controls separate viewing projects, triaging findings and creating projects. That lets you open it to the teams that own the code without giving everyone the right to create projects. 03 · This week ## What to do this week. 0 of 3 done 1. 01 · Choose a pilot project and an owner : Pick one set of internal repositories that depend on each other, such as an investor portal and its backend, and put them in one project. Name the person who owns the findings before any repository is connected. 2. 02 · Write the knowledge base and review the model : Describe how the code is deployed and which security policies apply in the project's knowledge base. Then have a security lead review and edit the threat model Claude generates, since later scans use it. 3. 03 · Set roles and route findings : Have an admin enable Claude Security in the admin console and decide who can view projects, triage findings and create projects. Use webhooks or the API to send new findings into the ticketing system your engineers already use. Sources Facts and dates are Anthropic’s own. What it means and what to do are our view, from the firms we work with. Drafted with Claude from these sources, checked against them figure by figure, and published 22 October 2026. ## The short answers. ### What is new in Claude Security? Claude Security now scans connected repositories continuously as code changes, marks findings fixed when the fix ships and reopens them if the issue returns. It also adds a project knowledge base, an editable threat model, severity ratings with exploit paths, an API, webhooks, an MCP connector and role-based access controls. ### Who can use Claude Security? The latest version of Claude Security is in public beta for Claude Enterprise customers. Admins enable it in the admin console and set who on their team can access it. ### How much does Claude Security cost? Anthropic says organizations receive $25,000 in free usage credits each month, for two months, and the offer applies to usage through December 31, 2026. Anthropic's announcement does not state other pricing, and full terms are in the Help Center. ### Which code hosts does Claude Security work with? Repositories connect through the Claude GitHub app, including GitHub Enterprise Server, or with an access token from GitLab and other Git providers. Anthropic says no Cyber Verification Program access is required to use it. Read next [21 October 2026 : Claude API version 2026-10-21 and new SDKs](/claude/whats-new/claude-api-version-2026-10-21) [21 October 2026 : Claude Duet research preview](/claude/whats-new/claude-duet) [15 October 2026 : Claude Code Review is generally available](/claude/whats-new/claude-code-review-generally-available) Newsletter ## Keep up with _every_ release. One email when something ships or retires that matters to a company: what changed, what it means, the date and what to do. Unsubscribe any time. Work email How did you hear about us? How did you hear about us? ChatGPT Claude Perplexity Another AI assistant Google or Bing search LinkedIn YouTube Someone referred me An event or webinar Our newsletter Somewhere else ## Want this working inside your firm? We run Claude workshops on your own documents and stay on as your teams adopt each release. [Book 30 minutes with Tim](https://calendly.com/timminer-1/chat-with-tim) [hello@bythepeople.tech](mailto:hello@bythepeople.tech?subject=Claude%3A%20Claude%20Security%20scans%20continuously%20and%20tracks%20fixes)