Anthropic's Claude Security Enhances Vulnerability Management with Continuous Scanning

Anthropic has rolled out a significant update to its Claude Security platform, introducing continuous code scanning and automatic fix tracking designed to help security teams effectively monitor and manage vulnerabilities as software codebases evolve. This enhancement aims to provide a more dynamic and responsive approach to application security, ensuring that security posture remains current without constant manual intervention.

The core of this update lies in its ability to perform ongoing scans of code repositories. Users can set up projects by connecting their Git repositories via GitHub integration or access tokens for providers like GitLab. Once configured, Claude Security conducts an initial baseline scan and then performs recurring scans that focus on recent changes. These scans are intelligently prioritized based on the risk and complexity of the modifications, ensuring that the security findings remain aligned with the most up-to-date state of the code. The platform also supports multi-repository projects, enabling it to identify and flag security issues that may span across different services or microservices within an application architecture.

Beyond just identifying vulnerabilities, Claude Security now automatically tracks the status of identified fixes. When a patch is committed to a repository, the system checks if it resolves an open finding. If a fix is successfully applied, the finding is marked as resolved. Conversely, if the same vulnerability reappears in subsequent code changes, the finding is automatically reopened, providing a closed-loop system for vulnerability remediation. This feature is designed to work regardless of whether the patches were developed within Claude Code or through external development processes, offering flexibility to security and development teams.

To further contextualize security findings, Claude Security incorporates a project-specific knowledge base. Teams can document crucial information such as deployment configurations, applicable security policies, and essential knowledge for new security engineers joining the team. Additionally, the platform can generate a threat model directly from the code, which teams can then review and refine. This threat model serves as a critical input for subsequent scans, allowing Claude Security to better assess the relevance of identified issues and account for risks that are already mitigated by existing security controls.

Prioritization of vulnerabilities is enhanced through detailed explanations and visualizations. Each finding includes a severity rating that is assessed against the project's specific threat model, providing a more accurate reflection of its actual risk. The platform also explains how an attacker might exploit the vulnerability and can generate diagrams illustrating potential attack paths. This granular detail assists teams in focusing their remediation efforts on the most critical issues first.

Integration with existing workflows is a key aspect of this update, facilitated by a new API. This API allows teams to manage projects, repositories, view findings, and resolve or reopen issues programmatically. Webhooks are also available to notify connected systems of new findings, enabling automated workflows. Furthermore, a new MCP connector allows engineers to seamlessly access findings within Claude.ai and Claude Code, discuss issues with Claude, initiate fixes, and mark findings as resolved all within the same session, streamlining the development and security feedback loop.

Role-based access controls have also been introduced, allowing administrators to assign specific permissions for viewing projects, triaging findings, or creating new projects. This granular control ensures that access to sensitive security information is appropriately managed. The update is currently available in public beta for Claude Enterprise customers, who can enable it through the admin console and manage user access.