Since 2025 the Government of Alberta has been using Claude Code — including the Claude Opus and Sonnet models — to audit, identify and remediate cybersecurity vulnerabilities in its IT systems. An internal team within the Alberta Ministry of Technology and Innovation carried out the work: they scanned 466 million lines of code, closed security gaps across multiple applications, and developed new tools and automated processes to improve system security.
Why this matters
The ministry maintains systems for all 27 provincial ministries, covering everything from social services to public safety and wildfire response. That portfolio includes roughly 1,280 applications and 3,400 code repositories. Most of this software had never undergone a comprehensive security review; accumulated technical debt — insecure code, unresolved bugs and outdated software — amounts to billions of dollars. The systems contain highly sensitive data such as tax records, procurement information and social services case files, which makes protecting them a priority.
What the team did and how
-
Rapid code assessment: using Claude Code with the Opus and Sonnet models, the team analyzed 466 million lines of government code in about 20 hours. Approximately 50 autonomous, parallel agents scanned for security vulnerabilities, infrastructure and deployment weaknesses, and incomplete technical documentation.
-
Two-stage scanning process: the implementation ran a rules engine first to flag known patterns and then had Claude Code review those flags, citing the exact file and line for each finding so developers could verify the issues.
-
Much faster than traditional methods: the team estimates the same review would have taken roughly 6.5 years with conventional approaches; the Claude-based workflow completed the work in around 20 hours.
Remediation and modernization
When the scan found vulnerabilities, Claude Code was often able to generate a fix, test it and build the patch. If automated tests were missing to validate a change, Claude wrote the tests before producing the patch. Where legacy code was too old or complex to patch efficiently, Claude rebuilt components in more modern, maintainable languages. In some cases, systems that originally took months to build could be reconstructed in four to five days; one example cited is a subsidy program portal that had been hand-coded in Java about 25 years ago and originally took five months to develop.
All fixes were implemented in partnership with the ministry’s engineers: no patch was deployed without review and approval by the technical team.
Continuous security review with AI agents
Alberta developed a set of specialized Claude review agents that run throughout the development lifecycle:
- A “red team” agent probes an application from an attacker’s perspective to map potential exploit paths.
- A “blue team” agent evaluates defenses against an international security standard and produces a remediation plan that points to the exact files to change.
- Additional agents assess code quality and the clarity of public-facing documentation.
Each application is checked against roughly 95 security controls on every pass. The agents are built on the Claude Agent SDK and run a robust sequence of checks and analyses for each application.
Training and knowledge sharing
Through the Alberta AI Academy the ministry is training both public servants and members of the public in practical AI use. Thousands of government employees and more than 10,000 members of the public have used the platform so far, learning skills from prompting to enterprise application delivery. The ministry intends to expand the AI-based security and modernization approach beyond a single team so that every ministry that needs it can adopt the methods.
Next steps
Claude now assists the ministry with writing, reviewing and deploying code as part of ongoing modernization. The next phase is to extend AI agents so they can collaborate with engineers to build entirely new software and tools.
For example, one ministry currently runs 185 legacy applications in production that are costly to maintain and hard to update. The government plans to use Claude Code to analyze those systems, document their functionality, and consolidate them into 16 reusable applications built on modern languages and conventions. The stated goals are to reduce complexity, cut maintenance costs and accelerate modernization efforts that would otherwise take years.
A case study for other governments
The technical debt and security gaps Alberta is addressing are common across many provincial, state and federal systems worldwide. Alberta has published technical white papers that provide a practical blueprint for other governments facing similar challenges. The province is also hosting an industry day in Edmonton in July to share lessons learned, and will begin a program in the fall to scale its approach across the provincial government.
Alberta says it will continue working with technology partners and vendors to refine and expand the approach, and hopes the documented experience can help other governments make their systems more secure.
