The Government of Alberta used Claude to cut cybersecurity vulnerability reviews from 6.5 years down to 20 hours!

Hey there, it's Shii! Today I found a case study of a government agency really putting Claude to work, and honestly it got me excited. The scale is off the charts too, and it genuinely surprised me as I read it, so I want to share it with all of you!

Anthropic News anthropic.com

What was announced?

What Anthropic published is a look at how Canada's Ministry of Technology and Innovation in Alberta is using Claude Code and Claude models (Opus and Sonnet) to find and fix cybersecurity vulnerabilities across their entire government system.

Alberta is dealing with a truly massive collection of systems: 1,280 applications and 3,400 code repositories. A lot of that code hadn't gone through systematic security review in years, so quite a bit of technical debt had piled up.

In this effort, Claude is built into all three stages: vulnerability scanning, remediation, and continuous monitoring. The key point is that this isn't a one-off experiment, it's usage at a real production level.

The story so far

If you tried to review a codebase this big by hand, the original piece estimates that a traditional approach would take about 6.5 years. For a public agency with limited budget and staff, that's a pretty heavy burden.

And the more technical debt piles up in a codebase, the harder it is to know where vulnerabilities are hiding, which makes prioritizing tough too. They were also carrying legacy assets, like old Java code, where even rewriting them would be a major undertaking.

What changes

By using Claude Code, this enormous review workload now fits into a far more realistic timeframe. Specifically, they ran about 50 agents in parallel and scanned 466 million lines of code in just 20 hours. Seeing 6.5 years turn into 20 hours made me do a double take at the numbers alone.

This means that even organizations with tight budgets and small teams, like public agencies, can now run large-scale security audits at a realistic cost. And the nice part is that it doesn't stop at detection, it carries all the way through to fixes and modernizing legacy code in one continuous flow.

Dive Deep

From here I'll dig properly into the technical side.

The scanning process happens in two stages: first a rules engine detects known patterns, and then things move on to a more detailed review. Thanks to this two-tier setup, simple known patterns get processed quickly, while complex cases still get the thorough review they need.

The flow after a vulnerability is found is impressive too. Claude automatically generates the fix, and handles writing and validating the tests. On top of that, when needed, it even takes on the work of rebuilding legacy code in a newer language. In the example from the original piece, rebuilding 25-year-old Java code was initially estimated to take 5 months, but it actually finished in 4 to 5 days. That kind of reduction is a bit staggering.

The system doesn't end after finding and fixing, either. For continuous security monitoring, "red team" agents and "blue team" agents are kept running. The red team simulates attack scenarios, and the blue team evaluates how well the defenses hold up and draws up improvement plans, so the roles are split between them. They're checking around 95 security controls per application, so you could say it's a pretty comprehensive setup.

That said, given how much is being handed off to AI agents at this scale, the original piece didn't spell out the details of how the generated fixes are reviewed, or how false positives and misses are followed up on. Since this is the weighty area of public infrastructure security, I personally would love to learn more about that side of things going forward.

Wrap-up

This was a big-scale case study: the Government of Alberta applied about 50 agents to a huge system of 1,280 applications and 3,400 code repositories, scanned 466 million lines of code in 20 hours, and even runs continuous monitoring with red teams and blue teams. Seeing work that would take 6.5 years by hand compressed this much really made me feel that AI agents are entering production-level use even in government settings. For organizations short on budget and staff, this kind of use looks like it could be a reassuring ally!