Alberta Uses Claude to Secure 466M Lines of Code in 20 Hours
Government agencies face a massive security problem: legacy codebases that are old, insecure, and poorly documented, accumulated over decades. The Government of Alberta‘s Ministry of Technology and Innovation maintains systems for 27 provincial ministries — roughly 1,280 applications and 3,400 code repositories — much of which had never undergone a systematic security review. The technical debt runs into billions of dollars. The team needed a way to find vulnerabilities across hundreds of millions of lines of code without spending years on manual audits.
Starting in 2025, Alberta set up an internal team using Claude Code with both Opus and Sonnet models. Around 50 agents worked autonomously and in parallel, scanning 466 million lines of code in 20 hours — a task the team estimates would have taken 6.5 years with traditional methods. When vulnerabilities were found, Claude Code could often generate and test a fix; for systems too old to patch efficiently, it rebuilt them in modern languages. One subsidy portal originally hand-coded in Java 25 years ago (taking five months) was rebuilt in four to five days. Every patch was reviewed and approved by human engineers. Alberta also built specialized review agents — a red team agent that probes applications like an attacker, and a blue team agent that assesses defenses against international security standards — that run continuously on every application, checking against roughly 95 security controls.
For any builder working on security at scale, this case study shows how AI agents can turn a years-long remediation backlog into a weeks-long project. Alberta has published technical white papers documenting its approach, and is training government workers and the public through the Alberta AI Academy. The key insight is that combining autonomous scanning with human review — and using AI not just to find bugs but to rewrite insecure legacy code — creates a practical path for large organizations to close their security gaps without waiting for decades of slow modernization.
