Claude Security now rescans code as it changes, with $25,000 a month in beta credits

On 21 October 2026 Anthropic announced a new version of Claude Security, its tool that reads an organisation's code for security flaws. Anthropic says thousands of organisations have used it since its public beta began in April. By its count they have found more than a million security flaws.

The new version keeps up with code as it changes. A team creates a project, connects its repositories and picks the branch and scope for each one. The first scan is a deep one across everything in scope. After that, changes are scanned regularly, based on how risky and complex they are.

A project can hold several repositories, so problems that sit between services can be caught. Anthropic's example is a backend that trusts input the client side was supposed to validate.

Claude Security checks open findings against changed code and marks a finding fixed when the fix lands. That works whether the fix came from Claude Code or from another process. If the same flaw turns up again later, the finding reopens by itself.

Each project has a knowledge base. The team describes how the code is deployed, which security policies apply and anything a new security engineer would need to know. Claude Security also writes a threat model, a summary of how the system could be attacked, and the team can review and edit it.

Later scans use the threat model to decide what to flag. The added context helps the tool skip risks the environment already handles. Each finding gets a severity rating judged against the threat model. It also explains how an attacker could reach the flawed code, and some findings include a diagram of the attack path.

With fix tracking, a security team can see which findings were fixed and which came back, without chasing engineers for status. Over a pilot, the share of findings that get fixed can be a useful number to take to a budget meeting.

The threat model decides what gets flagged. Claude writes its first version from the code, so someone who knows how the system runs in production should read it. A wrong assumption in it can hide a real risk or raise false alarms.

Teams whose services sit in many repositories need to decide how to group them. Services that call each other likely belong in the same project, because that is how the scan can see the gaps between them.

The new version is in public beta for Claude Enterprise customers from 21 October 2026. An admin switches it on in the admin console and sets who on the team can use it.

It runs on Anthropic's full family of models, including Claude Mythos. It needs no access to Anthropic's Cyber Verification Program.

Each organisation gets $25,000 in free usage credits a month, for two months. The offer covers usage through 31 December 2026, and the full terms are in Anthropic's Help Center.

New role-based access controls let admins decide who can view projects, who can triage findings and who can create projects. Anthropic says this lets more of the teams that own code use it without everyone creating projects.

Findings also reach other tools. An API lets your systems read and manage projects and findings, and webhooks tell other systems when a new finding lands. Claude Security also works as a connector in Claude.ai and Claude Code. An engineer can pull up a finding, ask Claude about it, start the fix and mark it resolved in one session.

By our arithmetic, two months at $25,000 is up to $50,000 in credits for each organisation. Anthropic's post doesn't say what usage costs once the credits end. Finance may want that price, and a record of what the pilot used, before a wider rollout.

The offer covers usage through 31 December 2026, so the pilot window closes at year end. The post leaves the exact start of each organisation's two months to the Help Center terms, so check them before setting a start date.

If anyone can create projects, scans can reach repositories nobody planned to cover. Keeping project creation with the security team, and giving code-owning teams triage rights, can keep the pilot measurable.

Anthropic's inference hooks documentation says Claude Security scans make their own model calls. A security check set up in front of Claude Enterprise with inference hooks therefore doesn't see them. Agree the list of repositories in each project with your data protection lead.