Claude Security now rescans your code as it changes

If your company is on Claude Enterprise, an owner can now turn on a version of Claude Security that keeps scanning your repositories as code lands, instead of waiting for someone to start a scan. Anthropic announced it on Wednesday as a public beta for Claude Enterprise customers. The Help Center offers "Up to $25,000 in promotional credits for Claude Security usage in each of two consecutive months," ending Dec 31.

What changed#

Claude Security has been in public beta since April. Anthropic says thousands of organizations have used it "to find over a million vulnerabilities." The new version changes how it runs:

Change	Before	Now (Oct 21)
When it scans	"waiting for someone to start a scan," in Anthropic's words	A deep baseline scan, then regular scans of changes "based upon their risk and complexity"
Fixed findings	Not described	Marked fixed when the fix lands, and reopened if found again
Context	Not described	A per-project knowledge base plus a threat model you can edit
Where findings go	Not described	A new API, webhooks, and an MCP connector in Claude and Claude Code
Access	Not described	New role-based controls for viewing projects, triaging findings and creating projects

A project can hold several repositories, so Claude can catch issues between services. Anthropic's example is "a backend that trusts input a client was supposed to validate." Each finding gets a severity rating judged against the project's threat model and an explanation of how an attacker could reach the code.

Why it matters#

Our read: a one-off scan goes stale as soon as the next pull request merges. This version re-checks open findings against new commits, so your list should shrink when fixes ship in Claude Code or anywhere else. The Help Center says it is "charged at direct token cost only," with "no additional platform fee," so the credits pay for the first two months of finding out what continuous scanning costs on your code.

How to use it#

We couldn't try it: it needs a Claude Enterprise organization. The steps come from the Help Center and Anthropic's post.

1. An owner enables it in Organization settings > Claude Security. You need "An active Claude Enterprise plan, a premium seat for each user, and usage credits enabled for consumption billing."
2. Create a project and connect up to eight repositories, through the Claude GitHub app (including GitHub Enterprise Server) or an access token for GitLab and other providers.
3. Choose the branch and scope for each repository. For a monorepo, the Help Center suggests a folder scope.
4. Describe your deployment and accepted risks in the project's knowledge base, then review the threat model Claude writes.
5. Pull findings into Claude Code with the connector. A prompt to try (ours, untested):

Using the Claude Security connector, list the open findings in project <project> rated high or critical. For each, give the file, the attack path in two sentences, and whether a fix has already landed. Don't change any code.

Good to know#

• Results vary by run. The Help Center says: "Scans are stochastic by design."
• There is no fixed schedule. The Help Center says Claude scans changes "based on their risk and complexity. There is no fixed schedule." Our read: if you need a set rhythm, keep your own triage meeting.
• Old projects aren't covered by the credits. "Usage in projects from the earlier version isn't covered until they're migrated." Migration doesn't copy members, webhooks, excluded directories, scan history or scheduled scans, and "GitHub Enterprise projects can't be migrated."
• The offer has a hard stop. It "ends at the end of the day on December 31, 2026 (UTC), even if your two months haven't finished." Existing Enterprise organizations started their two months on Oct 21, whether or not they use it, and organizations that sign up after Nov 1 "won't get two full months."
• Up to, or flat? Anthropic's post says "Organizations receive $25,000 in free usage credits each month, for two months." The Help Center says "Up to $25,000." We use the Help Center's wording.
• Set a cap. You can give Claude Security its own spend limit and see per-day cost in each project's Usage settings.
• Not on Enterprise? The product page says the Claude Security plugin "is now available in beta for all Claude Code users." The Help Center calls it "a separate feature, based on the same technology as Claude Security."

What to watch: whether continuous scanning leaves beta or reaches other plans, and what it costs teams once the credits end on Dec 31.