Government of Alberta uses Claude to find and fix cybersecurity vulnerabilities

Concept 1: The Problem — Technical Debt in Government Systems

What is Technical Debt?

Think of technical debt like a house that was never properly maintained. Over decades:

• Pipes get old and leak
• Wiring becomes outdated and dangerous
• Repairs were patched quickly rather than done properly

In government software, this means:

• Old code written decades ago (some 25+ years old)
• Security gaps that were never fixed
• Poor documentation — nobody fully knows what the code does anymore
• Accumulated bugs that were ignored

Alberta's Scale of the Problem:

Key Insight: This isn't unique to Alberta — virtually every government worldwide faces this same challenge.

---

Concept 2: Traditional vs. AI-Powered Security Review

Why Traditional Methods Fall Short

Traditionally, reviewing code for security vulnerabilities requires:

1. Human security experts reading through code manually
2. Automated scanning tools (which miss complex issues)
3. Enormous time investment

The Math Problem:

• Alberta's 466 million lines of code
• Traditional approach estimate: ~6.5 years
• Alberta's AI approach: ~20 hours

Think of it this way: Traditional security review is like having one person check every book in a massive library for misprints. AI is like having 50 people checking simultaneously, with a system that already knows common misprint patterns.

---

Concept 3: How Claude Code Actually Works — The Two-Stage Scanning Process

Alberta used Claude Code (an AI coding assistant) with two specific AI models:

• Claude Opus — more powerful, deeper analysis
• Claude Sonnet — faster, efficient processing

Stage 1: Rules Engine Scan

• Automatically flags known vulnerability patterns
• Like a spell-checker, but for security weaknesses
• Covers all 3,400 repositories simultaneously

Stage 2: Intelligent Review

• AI reviews the flagged items
• Cites the exact file and line number of each problem
• Allows human developers to quickly verify findings

Why Two Stages?

Stage 1 = Speed (catch obvious problems fast)
Stage 2 = Accuracy (confirm and locate precisely)

Key Advantage: Found issues that traditional automated tools completely missed

---

Concept 4: Parallel Agent Architecture — How 50 AI Agents Work Together

What is a Multi-Agent System?

Instead of one AI doing everything sequentially, Alberta deployed ~50 AI agents working autonomously and in parallel.

Analogy:

Imagine auditing a 50-story building for fire hazards. You could send one inspector floor by floor (slow), or send 50 inspectors simultaneously, one per floor (fast). Multi-agent AI works like the second approach.

How the Agents Were Organized:

• Each agent handled different repositories simultaneously
• Agents worked autonomously — without constant human direction
• Built on the Claude Agent SDK (a framework for building AI agent systems)

Result: What would take 6.5 years compressed into 20 hours

---

Concept 5: Fixing Vulnerabilities — Beyond Just Finding Problems

Finding a vulnerability is only half the job. Alberta used Claude to fix them too.

The Fix Process Had Three Scenarios:

Scenario A — Standard Fix:

Find vulnerability → Generate fix → Test fix → Deploy fix

Scenario B — Missing Tests:

Find vulnerability → Write tests first → Generate fix → Verify fix passes tests → Deploy

(Some old systems had no automated tests to confirm patches were safe)

Scenario C — Code Too Old to Patch:

Find vulnerability → Rebuild entire system in modern language → Deploy

Real Example:

• A subsidy program portal originally hand-coded in Java, ~25 years ago
• Originally took 5 months to build
• Rebuilt by AI in 4-5 days

Critical Safety Point: Every single fix was reviewed and approved by human engineers before deployment. AI assisted; humans decided.

---

Concept 6: Continuous Security — Red Team vs. Blue Team Agents

Alberta didn't just do a one-time scan. They built ongoing security agents that run throughout development.

Red Team Agent 🔴

• Simulates an attacker probing the system from outside
• Maps how a vulnerability could be exploited
• Thinks like a hacker

Blue Team Agent 🔵

• Assesses the system's defenses
• Checks against an international security standard
• Writes a remediation plan pointing to exact files needing fixes

Additional Agents:

• Code quality checker
• Public-facing writing clarity checker

Coverage:

Every application is checked against ~95 security controls on each pass

Analogy:

Red team = someone trying to break into your house to find weaknesses Blue team = a security consultant assessing your locks, alarms, and doors

---

Concept 7: Modernization at Scale — Consolidating Legacy Systems

Beyond security, Alberta is using this approach to modernize outdated systems.

The Legacy Application Problem:

• One ministry alone has 185 legacy applications running in production
• Each is expensive to maintain
• Each is difficult to update
• They often do overlapping things

The Plan:

185 separate legacy applications → 16 reusable modern applications

How AI Helps:

1. Analyze what each legacy system actually does
2. Understand the business logic buried in old code
3. Consolidate overlapping functions
4. Rebuild in modern languages

Benefits:

• Lower maintenance costs
• Faster future updates
• Reduced complexity
• Better security

---

Concept 8: Human-AI Partnership — The Governance Model

A critical concept throughout Alberta's approach is that AI augments humans, it doesn't replace them.

The Partnership Model:

Key Principle: Speed and scale come from AI. Accountability and judgment remain with humans.

---

Concept 9: Knowledge Transfer — The Alberta AI Academy

Alberta recognized that tools alone aren't enough. People need to know how to use them.

Alberta AI Academy:

• Trained thousands of government employees
• Trained 10,000+ members of the public
• Covers: prompting, enterprise application delivery, AI essentials

Why This Matters:

A powerful tool in untrained hands is either wasted or dangerous. Training ensures the approach scales beyond one team.

---

Summary: The Complete Picture

PROBLEM: 466M lines of old, insecure, undocumented government code

SOLUTION FRAMEWORK:
├── Step 1: Scan (50 parallel AI agents, 20 hours)
├── Step 2: Fix (AI generates patches, humans approve)
├── Step 3: Continuous monitoring (Red/Blue team agents)
├── Step 4: Modernize (consolidate 185 apps → 16)
└── Step 5: Scale (train people, publish blueprints)

RESULT: 6.5 years of work → 20 hours
        Human oversight maintained throughout
        Blueprint shared with other governments

---

The Broader Lesson

Alberta's case teaches us that AI's greatest value in complex systems is:

1. Scale — doing what humans can't do in reasonable time
2. Consistency — checking every line, not sampling
3. Speed — compressing years into hours
4. Augmentation — making human experts dramatically more effective

The technical debt problem exists in governments worldwide. Alberta has essentially created a reusable playbook — and published it — for any government willing to follow the same approach.