Service update · Anthropic
Claude Security adds continuous code scanning in public beta
- Review updated
Anthropic announced continuous scanning for Claude Security on October 21, 2026, in public beta for Claude Enterprise. A project can connect up to eight repositories from GitHub, GitLab and other Git providers. After a deep baseline scan, it rescans changes according to risk and complexity, rather than on a fixed schedule. It tracks fixes, reopens recurring findings, generates an editable threat model and integrates with existing workflows through an API, MCP and webhooks. Access requires an active Enterprise plan, a premium seat for each user, usage credits enabled for billing and administrator activation. The hosted service does not support zero data retention (ZDR). Eligible Enterprise organizations, including those purchasing through AWS Marketplace, receive up to $25,000 in promotional Claude Security credits in each of two consecutive months. No separate sign-up is needed: credits apply automatically, before committed spend or other usage credits, to the new experience. Older projects qualify only after migration. Each month runs from the organization’s start date; unused credits do not roll over. Existing Enterprise organizations start on October 21, while new organizations start on their sign-up date, whether or not they use the service. The offer ends at the end of December 31, 2026, UTC, so organizations joining after November 1 cannot receive two full months. After credits run out or the offer ends, usage is billed at direct token cost with no additional platform fee. Promotional terms apply; no additional regional conditions are stated. Existing projects do not switch to the new experience automatically. Migration creates a new project, copies findings and archives the original, but does not copy members, webhooks, excluded directories, scan history or scheduled scans. GitHub Enterprise projects cannot be migrated. Scanning is limited to code you or your company owns and has the rights to scan, not third-party code outside the company’s codebases.