Alberta Gov Taps Claude for Cyber Defense

The Government of Alberta has deployed Anthropic's Claude AI, including its Claude Code capabilities, to rapidly identify and remediate cybersecurity vulnerabilities across its vast digital infrastructure. This initiative marks a significant step in leveraging artificial intelligence for public sector security and efficiency.

Since 2025, Alberta's Ministry of Technology and Innovation has utilized Claude Code, powered by both Opus and Sonnet models, to scrutinize millions of lines of code. The team successfully scanned 466 million lines in just 20 hours, addressing security gaps and enhancing system safety.

This case study offers a blueprint for how government agencies can employ AI at scale to secure critical systems, often burdened by legacy code and incomplete documentation. Alberta has also published technical white papers detailing its approach for other governments to learn from. This initiative is a critical challenge, as governments rely on these systems to deliver benefits and keep services running, yet the code is often old, insecure, and incompletely documented. You can read them here.

Vast Scale, Accelerated Results

Alberta's Ministry of Technology and Innovation oversees systems for all 27 provincial ministries, managing approximately 1,280 applications and 3,400 code repositories. Much of this code had never undergone systematic security review, representing billions in technical debt.

The Ministry established a dedicated internal team in 2025, tasked with enhancing system security and maintainability. Working with Claude, this team achieved remarkable results.

Claude Code, with its roughly 50 autonomous agents, scanned systems for vulnerabilities, infrastructure weaknesses, and documentation gaps. The AI employed a two-stage process: an initial rules-based scan followed by a detailed review, flagging specific files and lines for developer verification. This comprehensive scan identified issues missed by traditional automated tools.

The entire process took around 20 hours, a stark contrast to the estimated 6.5 years a traditional review would require.

Automated Remediation and Modernization

Beyond identification, Claude Code demonstrated the ability to generate, test, and implement fixes for identified vulnerabilities. When automated tests were absent, Claude Code first developed them. For outdated or complex code, the AI rebuilt systems in modern, maintainable languages.

One notable achievement was the modernization of a 25-year-old subsidy program portal, originally coded in Java. Claude rebuilt the application in just four to five days, a process that would have taken five months for manual reconstruction.

All AI-generated fixes underwent rigorous review and approval by the Ministry's engineers before deployment, ensuring human oversight in the process.

Continuous Security and AI Education

Alberta's cybersecurity team also developed specialized Claude agents for continuous security review throughout the development lifecycle. These agents simulate external attacks and assess defenses against international security standards, generating remediation plans.

Additional agents monitor code quality and public-facing documentation clarity, with each application checked against approximately 95 security controls per pass. These agents leverage the Claude Agent SDK for robust analysis.

Concurrently, Alberta is fostering AI literacy through the Alberta AI Academy, training thousands of government employees and over 10,000 members of the public in effective AI usage.

Future Directions

Looking ahead, the Ministry plans to expand Claude's role to building entirely new software and tools alongside engineers. They aim to consolidate 185 legacy applications into 16 modern, reusable applications, significantly reducing complexity and maintenance costs.

The Government of Alberta Claude cybersecurity efforts serve as a valuable case study for other government agencies grappling with similar technical debt and security challenges worldwide.