Summary: Since 2025, a team inside Alberta's Ministry of Technology and Innovation has used Claude Code (Opus + Sonnet) to review the systems of all 27 provincial ministries. Around 50 agents working autonomously and in parallel scanned 466 million lines of code in 20 hours — a review the team estimates would otherwise have taken ~6.5 years — then fixed vulnerabilities, rebuilt outdated code, and stood up continuous red/blue-team review agents on the Claude Agent SDK. It is a concrete public-sector case study for the "legacy debt is a security liability" problem every government shares.

The scale of the problem

Alberta's Ministry of Technology and Innovation maintains the systems of all 27 provincial ministries — roughly 1,280 applications and 3,400 code repositories spanning social services, public safety, and wildfire response. Most had never undergone a systematic security review, and the accumulated technical debt (insecure code, unaddressed bugs, outdated software) runs into the billions of dollars. These systems hold tax records, procurement data, and social-services case files — some of the most sensitive information citizens entrust to government.

What the team did

Assessed 466M lines of code in 20 hours. Using Claude Code with Opus and Sonnet, ~50 agents ran autonomously and in parallel to scan for security vulnerabilities, infrastructure and deployment weaknesses, and documentation gaps. The routine was two-stage: first a rules engine flagged known patterns in each repository; then Claude reviewed those flags and cited the exact file and line for each finding so developers could verify them. The scan covered every repository Alberta owns and surfaced issues traditional automated scanners had missed.

Fixed what it found. Where the scan identified a vulnerability, Claude Code could often generate a fix, test it, and build it — writing the tests first where none existed to confirm a patch was safe. Where code was too outdated to patch efficiently, Claude rebuilt it in a more modern, maintainable language. A subsidy-program portal originally hand-coded in Java ~25 years ago — a five-month build the first time — was rebuilt in as little as four to five days. Every patch was reviewed and approved by the Ministry's engineers before shipping.

Runs continuous review. The cybersecurity team built specialized Claude review agents on the Claude Agent SDK that run throughout development:

  • A red-team agent probes an application from the outside, mapping how a vulnerability might be exploited.
  • A blue-team agent assesses defenses against an international security standard and writes a remediation plan pointing to the exact files to fix.
  • Additional agents check code quality and the clarity of public-facing writing.

Every application is checked against roughly 95 security controls on each pass.

Beyond the scan: modernization and training

Alberta is also consolidating legacy sprawl: one ministry's 185 legacy applications running in production are being analyzed and consolidated into 16 reusable applications on modern languages and conventions — the same context-economics consolidation logic argued in Modular Monolith Instead of Microservices, applied at the scale of a provincial government. Through the Alberta AI Academy, thousands of government employees and more than 10,000 members of the public have learned effective AI use, from prompting through enterprise application delivery.

A blueprint for governments

The technical debt and security exposure Alberta is addressing exist in provinces, states, and federal agencies worldwide. Alberta published a collection of technical white papers (thevelocitywhitepapers.com) documenting its approach, hosted an industry day in Edmonton, and plans to scale the program across the provincial government. This is the "responsible government in the AI era" framing — and a Canadian counterpoint to the delivery-cost critiques the vault tracks in They Said It Would Cost $54 Million. We Said "No Thanks.".