Claude Security Scans Continuously. Results Vary by Design.

A million of what, exactly

The number Anthropic leads with is the one it documents least. Over a million vulnerabilities, found by thousands of organisations, over roughly six months of public beta. The announcement gives no split by severity, even though the product itself grades every finding from Low to Critical against a project threat model. It gives no false-positive rate, and no count of findings that customers dismissed, a category the product explicitly tracks, since dismissed findings can be marked as false positives, accepted risks or duplicates.

That absence matters more than usual here because of how the verification works. Each finding goes through a multi-stage process in which Claude critically reviews its own findings before they surface. That internal verification may improve the quality of what surfaces. It is not independent confirmation. And without a severity distribution, an independent validation rate, a false-positive rate or a method for deduplicating findings across scans and repositories, the published number cannot be read as a verified count of unique vulnerabilities, or as a measure of risk eliminated. It is a vendor-reported discovery volume: a measure of activity, not yet a measure of defects removed.

Image: Anthropic — Claude Security interface, from Anthropic's 21 October announcement

The scanner can disagree with itself

The most consequential sentence in this release is in the Help Center's FAQ, not the announcement. Asked why two scans of the same code can return different results, Anthropic answers that scans are stochastic by design: the product uses an agent that adapts its analysis to each run rather than applying fixed pattern matches, which Anthropic says enables the depth needed to catch logic-level flaws.

That trade is defensible. Pattern-matching scanners miss logic errors, and Anthropic chose a customer quote that supports the point: Vanta's security director says Claude Security found logic flaws none of the company's other tools had caught. That is one customer account, selected by Anthropic for its announcement. It is not a controlled comparison, and it should be weighted as one.

The cost of the trade lands on the buyer. A deterministic scanner, given identical code, rules and execution conditions, can generally produce a repeatable result; conventional scanners can still vary when rules, dependencies, environment, configuration or analysis state change. A stochastic scanner's clean result means something narrower: that particular run did not identify a finding. It does not establish that the code is vulnerability-free, and the next run on identical code might find something. Continuous scanning may provide additional opportunities to discover missed issues as the codebase evolves. Anthropic has not shown that it eliminates run-to-run variability, or that it guarantees eventual detection.

Two practical limits sit next to that one. Each project can contain at most eight repositories, counting both repositories selected for scanning and repositories supplied only as context. Organisations managing larger estates may need multiple projects, with the associated configuration and oversight work; the documentation reviewed does not establish any workaround for that cap. And the scope-of-use terms are exact: users may scan code they or their organisation own, including third-party components incorporated into their own codebase, but they may not use the hosted product to scan other third-party codebases, including unrelated open source projects. For a tool sold on finding vulnerabilities, the code it may not look at includes a large share of what modern software is built from, though components inside a customer's own codebase remain in scope.

The offer clock is already running

The commercial terms are unusually readable, and unusually time-boxed. Usage is charged at direct token cost, with no additional security-platform fee, and customers can set a separate spend limit and see month-to-date and per-day cost per project. That makes the incremental usage charge relatively easy to identify. It is not the complete cost of entry: an active Claude Enterprise plan, a premium seat for each user and usage credits enabled are all required first. The meaningful comparison with other security products is total cost — the Enterprise prerequisites plus however much scanning a codebase actually consumes — not token charges alone.

The launch credits need the dates read carefully. Existing Enterprise organisations started on 21 October 2026. The offer ends at the end of 31 December 2026 UTC regardless of when an organisation's two months began, organisations that sign up after 1 November will not receive two full months, unused monthly credits do not carry over, and the two months run whether or not the organisation uses the product at all. An Enterprise customer who enables Claude Security in December is not getting two free months. It is getting whatever is left of a window that closes on a fixed date. Anthropic states all of this plainly in its terms, which is to its credit. It is still the difference between the offer as announced and the offer as received.

One more boundary belongs in an evaluation, not a footnote. The hosted product does not support Zero Data Retention; Anthropic says it may retain data where required by law or to address usage policy violations. Customers who require ZDR are directed to the separate Claude Security plugin for Claude Code. Per the Help Center, that plugin uses the models available through the customer's Claude Code configuration, and does not necessarily use the same model as the hosted scanner. The two routes are not interchangeable: a regulated buyer has to evaluate the data-handling terms, the model access and the security workflow of each separately.

Sources

[1] Anthropic, "Claude Security now scans continuously and tracks fixes", claude.com, 21 October 2026 — the announcement: continuous scanning, fix tracking, threat models, API and MCP connector, the million-vulnerabilities claim, the $25,000 credit offer, and customer statements including Vanta and GustoRead source
[2] Anthropic, "Use Claude Security", Claude Help Center, accessed 21 October 2026 — requirements, the stochastic-scanning FAQ, the eight-repository limit, severity definitions, fix and dismissal behaviour, the no-ZDR answer, token-cost-only pricing, the scope-of-use restriction, and the full launch-offer terms including the 31 December 2026 end date and the 1 November 2026 cutoffRead source
[3] Unite.AI, "Anthropic Adds Continuous Scanning and Fix Tracking to Claude Security", 21 October 2026 — independent write-up of the same announcement, used as a cross-check onlyRead source

THE ALFW VERDICT

Continuous scanning and automatic fix tracking make Claude Security an ongoing security workflow rather than a one-off code review, and that is a real gain. But Anthropic's own documentation sets the limits of what a buyer should trust: the same code can produce different findings from one run to the next, the hosted service offers no Zero Data Retention option, and the million-vulnerabilities figure arrives with no published severity split, deduplication method or false-positive rate. Direct token-cost billing is transparent about usage, though the Enterprise plan and premium-seat requirements sit underneath it. The right test is whether repeated scans find actionable defects your existing tools miss, at an acceptable cost and review burden. Run that test on your own repositories. Do not buy the million headline as a quality metric.