The scanner finds it, you fix it: keep a person on security findings even when scanning is continuous

Apex guidance: give continuous scanning a human owner. Keep a short account of what needs protecting, who reviews incoming findings and what evidence is needed when an issue returns.

Learning objectives

Help your human, using Apex guidance:

• Write a short threat model for the project.
• Decide who can see and triage security findings.
• Treat a reopened finding as a signal to investigate.

Explanation

For reviewing repairs after a merge, revisit Merged isn't finished.

One current example

Anthropic's own article, Claude Security now scans continuously and tracks fixes, announces an update on 21 October 2026. It describes Claude Security as a public beta for Claude Enterprise. This is one current example, not the only way to organise scanning.

Anthropic says it runs a baseline scan, then scans connected Git repositories, including GitHub and GitLab, as code changes. It marks findings fixed when a fix lands and reopens them if they return.

Anthropic says each project has a knowledge base and a threat model the team can edit. Severity is judged against that model. Findings are available through an API, webhooks and an MCP connector in Claude.ai and Claude Code. The update adds role-based access controls. These are Anthropic's claims, not independent evaluation.

Apex guidance: give findings a decision path

This checklist is Apex guidance, not a vendor setup procedure. Apply it with the scanning tools you choose.

• ☐ Write a short threat model. Name the data or actions to protect, who might misuse access and which boundaries should stop them. State assumptions that need checking.
• ☐ Name the triage owner. Choose who reviews incoming findings, decides priority and assigns the next action. Name a person to cover absences.
• ☐ Set access deliberately. Decide who needs to view findings and who may change their status. Record those choices alongside ownership.
• ☐ Review the context. Compare each finding with the threat model. Record why the possible harm matters here and what evidence is missing.
• ☐ Check a returning finding. Compare it with the earlier issue and repair. Check whether the same boundary has failed again or the context has changed.
• ☐ Keep the decision visible. Record the owner, next action and evidence needed before closing the review.

What the announcement leaves open

Apex guidance: a scanner's status is an input to your decision. Keep your own closure evidence. A reopened finding calls for investigation; it does not by itself explain why the issue returned. Update assumptions when the evidence changes.

Worked example

Fictional scenario; Apex guidance in use: Juno is an agent. Her human, Tomasz, maintains a small booking app. Their short threat model says: “Protect private booking notes. A visitor must not read another visitor's notes. We assume every route that returns notes checks who may see them.” That assumption needs checking.

Tomasz owns triage. Juno prepares evidence for him. They agree who may view findings and who may change their status.

Juno does not simply repeat the earlier closure note. Tomasz asks her to compare the returning route with the one previously repaired. They keep the review open until they have checked the affected boundary and recorded the result.

Check yourself

Q1. Which note is a useful short threat model under Apex guidance?

• Findings appear in the team's queue with status and owner labels.
• Juno prepares the weekly review and Tomasz reads the summary.
• Repairs are linked to findings before the review is closed.
• Private booking notes need protection from access by other visitors.

Q2. What follows Apex guidance when findings keep arriving?

• Name who reviews them, decides priority and assigns the next action.
• Let arrival order determine priority and pass ownership to the fixer.
• Give each finder authority to close findings before assigning an owner.
• Wait for a reopened finding before deciding who should review it.

Q3. A finding reopens. What should Juno do under Apex guidance?

• Reapply the previous repair and carry forward its closure decision.
• Move it below new findings because its earlier review is complete.
• Compare it with the earlier repair and bring evidence to Tomasz.
• Raise its priority using its returning status as the full explanation.