Claude Security Continuous Scanning: Security Updates as Your Code Changes

Claude Security is a feature Anthropic built into Claude that searches codebases for security vulnerabilities and offers patch suggestions for human review. With the latest update, once you connect your repositories, it runs a deep initial scan and then automatically refreshes the scans as your code changes. Findings stay close to the current state of the code. The feature is currently in public beta on Claude Enterprise.

In short:

• Claude Security continuously monitors connected repositories and rescans as changes arrive.
• Patches are not applied automatically; every suggestion is submitted for human approval.
• Scans are billed by token cost only, with no additional platform fee.
• Available on the Enterprise plan; the Team plan is not covered.

What is Claude Security and what does it solve?

Claude Security is an AI feature that reads a codebase and looks for security vulnerabilities. According to Anthropic's support page, it aims to find issues that traditional methods often miss. For the vulnerabilities it finds, it also offers targeted patch suggestions.

The product was previously known as Claude Code Security. The beta date is not consistent across sources; some say May 1, 2026, others give different dates. For the exact date, you should check Anthropic's own announcement.

Access is available at claude.ai/security or from the Claude.ai sidebar. Users do not access the model directly; they only receive the findings. Scans run on Claude Mythos 5.

How does continuous scanning work?

In the old approach, you started the scan yourself. In the new approach, you connect your repositories once and the system handles the rest.

The process has three steps:

1. Connection: You connect your repositories, such as those on GitHub, to Claude Security.
2. Deep initial scan: Claude scans the entire codebase thoroughly.
3. Automatic rescanning: Every time a change lands in the repository, the tool scans again.

The concrete benefit of this approach is that findings don't go stale. A report from a scan done weeks ago doesn't reflect today's code. Continuous scanning, on the other hand, gives you a chance to catch a newly introduced vulnerability within days of the code being merged.

How are false alarms reduced?

The biggest complaint about security scanners is noise. Out of hundreds of warnings, many may turn out not to be real vulnerabilities. Anthropic says it uses a multi-stage verification process to address this. Before showing you a finding, Claude questions its own result.

The company's claim is that this reports more real issues and produces fewer false positives. A caution is in order here: these claims about false positives have not been independently verified. The healthiest approach is to run a trial on your own codebase and measure the results.

Does Claude Security apply patches on its own?

No. Scanning does not make automatic changes to your code. Claude suggests a patch; reviewing and applying it is up to your team.

This design decision matters for businesses. A tool that intervenes in production code without control could create more risk than the problem it solves. Human approval prevents a faulty suggestion from reaching production. Our Node.js vulnerability guide offers a good example of the habit of evaluating vulnerability findings.

How much does Claude Security cost?

Pricing has two parts.

• Scan cost: Scans are billed directly by token cost. There is no separate platform fee for Claude Security.
• Plan: The Enterprise plan is listed as $20 per seat per month plus usage billed at API prices. The Team plan does not include Claude Security.
• Launch offer: Eligible organizations can receive up to $25,000 per month in usage credits for two months. The offer is valid until December 31, 2026.

Token cost depends on the size of your codebase and how often it changes. Since every change means a new scan in continuous scanning, your bill grows with the pace of active development. It makes sense to start with a small repository and watch monthly spending. For ways to reduce token-based costs, you can also check our post on the Claude Message Batches API.

What does the Claude Code plugin do?

Alongside the hosted Claude Security product, there is also a plugin for Claude Code. Found in Anthropic's official plugin repository, it is described as the in-session version of the hosted product.

The key difference between the two options is model access. The hosted product runs on Mythos 5, and the model is not opened up to the user directly. The plugin, by contrast, uses the models the user has access to. If a developer wants to run a quick check in their own terminal, the plugin can be practical. For continuous monitoring across entire repositories, the hosted product stands out.

Who is it suitable for, and what should you watch out for?

Claude Security is currently open only to Enterprise customers and is in beta. This means you shouldn't leave your critical security process entirely to it.

Practical recommendations:

• Don't shut down your existing security tools right away; try Claude Security as a complement.
• Review the findings through the eyes of an independent developer.
• If you have regulatory obligations such as KVKK (Türkiye's data protection law), assess the impact of sending your code to an external service; our post on KVKK-compliant software development can guide you here.
• Monitor monthly token spending closely during the first few weeks.

Frequently asked questions

Which plans can use Claude Security?

It is currently offered as a public beta on Claude Enterprise. According to the pricing table, the Team plan does not include Claude Security.

Does Claude Security fix my code automatically?

No. The tool suggests patches but does not apply code changes itself. Every suggestion is submitted for human review.

When does continuous scanning run?

After you connect your repositories, Claude first runs a deep initial scan. After that, it automatically rescans every time a change arrives in the repository.

Is there an extra license fee?

There is no additional platform fee for Claude Security. Scans are billed by token cost only. The Enterprise plan's seat fee applies separately.

Conclusion

The real novelty of Claude Security is that it turns security scanning from a one-off task into a process that lives alongside your code. Leaving patches to human approval and having no extra platform fee are attractive points for businesses. On the other hand, the fact that it is in beta and that its false-positive claims have not been independently verified call for a cautious, measured trial. If you want support with security, scanning and software architecture for your own codebase, the EngerekTech team is here to help.

Sources