Anthropic Claude Security: Why Reasoning-Based Code Scanning Changes the Game
Cloud Platform EngineeringStatic analysis tools find what they have been trained to recognize. Anthropic’s Claude Security finds what a security engineer would find — and it just moved from a research preview used by hundreds of organizations to a public beta available to all Claude Enterprise customers.
Context
Claude Security launched in February 2026 as a closed research preview under the name Claude Code Security. During the preview period, hundreds of enterprise organizations used it to scan production codebases — including finding and fixing vulnerabilities that existing tools had missed for years. On April 30, 2026, Anthropic opened it to all Enterprise subscribers as a public beta, accessible at claude.ai/security and via the Claude Code sidebar.
The product sits at an intersection that will define enterprise AI investment decisions through the rest of 2026: Anthropic is simultaneously a foundation model provider, a developer platform (Claude Code), and now an enterprise security vendor. The security ecosystem Anthropic announced alongside the beta — technology integrations with CrowdStrike, Palo Alto Networks, Microsoft Security, SentinelOne, TrendAI, and Wiz, alongside implementation partnerships with Accenture, BCG, Deloitte, Infosys, and PwC — is not the partnership list of a product feature. It is the partnership list of an enterprise market entry.
The Detail
The technical differentiation Claude Security claims over traditional SAST tools comes down to how it finds vulnerabilities. SAST works from signatures: it knows what a SQL injection looks like, what a hardcoded credential looks like, what a common XSS vector looks like. This approach finds known patterns quickly and at scale. It does not find novel vulnerability classes, it cannot trace multi-file logic flows, and it cannot model how two individually benign functions interact to create an exploitable condition.
Claude Security is built on Claude Opus 4.7 — the same model underlying Project Glasswing, Anthropic’s security-specific research initiative. It reads across files and modules, traces data flows end-to-end, and reasons about component interaction the way a senior security engineer does. Each finding includes a confidence rating on exploitability, a severity assessment, a likely impact analysis, reproduction instructions, and targeted patch recommendations that can be applied directly in Claude Code — collapsing the find-and-fix workflow from a three-tool, two-team process into a single interface.
The public beta adds several capabilities beyond the research preview: scheduled scans for continuous coverage, targeted directory-level scans rather than whole-codebase only, a multi-stage validation pipeline to reduce false positives, finding dismissal with documented rationale, CSV and Markdown export for audit system integration, and webhooks to Slack, Jira, and other operational tooling. Admin console configuration is included; enterprise governance features are bundled rather than added on.
Pricing has not been disclosed publicly. The beta is currently limited to Claude Enterprise subscribers, with Claude Team and Max plan availability described as coming soon. The enterprise-only positioning and the consulting partnership structure — BCG, Deloitte, PwC — signal that this is being sold into CISO-level buying motions, not developer self-serve adoption. Pricing will almost certainly be additive to existing Enterprise subscriptions rather than included in base plan cost.
The So What
For platform and security engineering teams, the meaningful question is not whether Claude Security will surface more findings than existing SAST tooling — it will. The question is how to operationalize a reasoning-based scanner alongside existing vulnerability management workflows without creating alert fatigue from a new source of findings.
Teams evaluating Claude Security should pilot it against codebases already scanned by mature SAST tools — measuring marginal findings (what Claude Security finds that SAST missed) rather than total finding count. The scheduled scan and Jira integration features are designed for a workflow where Claude Security runs as a continuous second-pass layer over existing infrastructure, not as a replacement.
The Claude Code integration deserves separate attention. A tool that surfaces a vulnerability and generates a targeted patch in the same interface — without requiring the engineer to context-switch to a separate IDE, PR, or security platform — changes the economics of remediation. Most vulnerability backlogs are not caused by lack of detection; they are caused by the friction between detection and fix. See also HashiCorp Vault’s SPIFFE integration for AI agent identity for the related identity layer that enterprise security stacks need to address before autonomous agents operate on production codebases.
Photo by Lucas Andrade on Pexels
Source: The New Stack
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →