A new version of Claude Security went into public beta for Claude Enterprise customers on October 21. Three things changed, and all three attack the same problem: a scan captures one moment, and code changes every day.
Continuous monitoring instead of a scan button
You create a project, connect repositories through the Claude GitHub app (GitHub Enterprise Server included) or with an access token from GitLab and other Git providers, then pick the branch and scope. Claude runs a deep baseline scan first, then scans changes on a cadence set by their risk and complexity.
A project can hold several repositories, which isn’t cosmetic. It’s how Claude catches issues living between services, like a backend trusting input a client was supposed to validate.
Findings close when the fix ships
Most fixes don’t happen in the tool that reported the problem. Claude Security checks open findings against the code that changed and marks them fixed once the fix lands, whether your team wrote it in Claude Code or somewhere else entirely. If the issue reappears later, the finding reopens on its own.
What your team knows feeds the scan
Every project now has a knowledge base. You describe how the code is deployed, which security policies apply, and whatever a new security engineer on the team would need to know. Claude generates a threat model from that, your team reviews and edits it, and later scans use it to decide what’s worth flagging. It cuts the other way too: you can suppress risks your environment already handles.
Each finding carries a severity judged against that model, plus an explanation of how an attacker would reach the vulnerable code. Some include a diagram of the attack path.
API, MCP and role-based access
There’s a new API: list and read projects and findings, resolve or reopen findings, create and manage projects and their repositories. A personal access token sees exactly what its user can see. Webhooks notify your own systems when a finding lands.
Claude Security also ships as an MCP connector in Claude.ai and Claude Code. An engineer pulls up a finding, asks about it, starts the fix and resolves it in one session. New role-based controls separate viewing, triaging and creating projects.
All of it runs on the full model family, Claude Mythos included, with no Cyber Verification Program access needed.
The finding that closes itself is the real news
Of the three changes, fix tracking sounds smallest and matters most. Anyone who has lived with a scanner knows the list that only grows, because nothing ever reports back — six months in nobody reads it, and that’s where the finding that counts is sitting. Claude Security establishing closure itself, and reopening on regression, turns a pile into a work queue. Bank of America put 1,000 contractors against exactly that kind of pile.