Alberta scanned 466M lines of government code in 20 hours using Claude
The Government of Alberta used ~50 parallel Claude agents to complete a security review that would have taken 6.5 years manually. This lesson breaks down the two-stage scan, the fix workflow, and the continuous review agents they built — and shows you how to apply the same pattern.
The Government of Alberta just completed the largest AI-assisted security scan on record: 466 million lines of government code reviewed in 20 hours. The same work, done traditionally, would have taken about 6.5 years.
This lesson breaks down what Alberta did, why it worked, and what the pattern means for anyone using Claude to handle large-scale technical work.
Alberta's Ministry of Technology and Innovation maintains 1,280 applications across 3,400 code repositories for all 27 provincial ministries — systems holding tax records, social services case files, and public safety data. Most had never undergone a systematic security review.
To scan this codebase, the team ran around 50 Claude agents in parallel using a two-stage process. First, a rules engine flagged known vulnerability patterns across each repository. Second, Claude reviewed those flags and cited the exact file and line number for each finding — so developers could verify before touching anything.
Finding vulnerabilities was step one. Alberta's team then used Claude Code to generate patches, write tests where none existed, and in some cases rebuild entire legacy systems in modern languages.
One example: a subsidy portal originally hand-coded in Java about 25 years ago — which took five months to build the first time — was rebuilt in four to five days. Every fix was reviewed and approved by Ministry engineers before it shipped. AI accelerated the work; humans stayed in the decision loop.
Alberta also built three specialized review agents using the Claude Agent SDK. A red team agent probes applications from the outside, the way an attacker would. A blue team agent checks defenses against an international security standard and writes a remediation plan pointing to exact files to fix. Additional agents check code quality and public-facing writing. Every application goes through roughly 95 security controls on each pass.
Alberta's problem is not unique. Security gaps and underdocumented legacy systems exist in government agencies worldwide. Alberta has published technical white papers giving other agencies a blueprint for running the same approach, and is hosting an industry day in Edmonton in July 2026 to share what it learned.
The pattern that made it work: scan at scale with parallel agents, cite specific findings with file and line references, fix with mandatory human review, then build continuous security checks into the development process itself.
What to take away: Alberta scanned 466 million lines of code in 20 hours using ~50 parallel Claude agents — work that would have taken ~6.5 years manually. The two-stage process (rules-engine scan, then Claude review with exact file/line citations) caught issues traditional automated tools missed. Claude then generated fixes, wrote missing tests, and rebuilt legacy systems — with human review required before anything shipped. Three specialized agents now run continuous checks covering ~95 security controls per application per pass.