Government of Alberta uses Claude to find and fix cybersecurity vulnerabilities

Government IT systems are famously creaky, and Alberta's is no exception. The province's Ministry of Technology and Innovation runs the digital plumbing for all 27 provincial ministries — everything from social services to wildfire response — which adds up to roughly 1,280 applications spread across 3,400 code repositories. Most of that code had never been through a proper security review, and the ministry says the accumulated technical debt runs into the billions of dollars.

So in 2025 the ministry stood up an internal team and turned Claude Code loose on the problem, running both Opus and Sonnet models. About 50 agents worked in parallel, first sweeping every repository with a rules engine to flag suspicious patterns, then reviewing those flags and pointing developers to the exact file and line for each issue. The whole scan — 466 million lines — took about 20 hours. The team's own estimate is that a traditional review of that scope would have taken around six and a half years.

Finding problems is one thing; fixing them is another, and this is where the project gets more interesting. Claude Code didn't just flag vulnerabilities, it often generated the fix, wrote missing tests to confirm the patch was safe, and in cases where the underlying code was too old or tangled to patch, rebuilt it from scratch in a more modern language. One example stands out: a subsidy program portal originally hand-coded in Java about 25 years ago, which took five months to build the first time, was rebuilt in as little as four to five days. Every patch still went through the ministry's own engineers before shipping.

Beyond one-off fixes, Alberta built specialized review agents that now run continuously through development — a red team agent that probes applications the way an attacker would, and a blue team agent that checks defenses against an international security standard and drafts a remediation plan. Every application gets checked against roughly 95 security controls on each pass. Alongside this, the province has been training people through its Alberta AI Academy, which thousands of government workers and more than 10,000 members of the public have already used.

None of this wraps up the story. One ministry alone has 185 legacy applications it wants consolidated into just 16 modern, reusable ones, and Alberta plans to use Claude Code to figure out what those old systems actually do before merging them. The province has also published technical white papers on its approach and is hosting an industry day in Edmonton in July, with a broader rollout planned for this fall — the clear intent being that other governments, sitting on their own piles of undocumented legacy code, don't have to start from zero.