Security OS
Claude Code
Local Execution
No-Code Setup
Claude Code for Cybersecurity:
Build a Security AI OS That Handles Threat Analysis, Incident Response & More
Security engineers, SOC analysts, and AppSec teams use Claude Code + Brainfile as their full security operating system — threat intel briefings, IR runbooks, CVE monitoring, policy docs, phishing triage. Your environment context loads automatically every session.
Free by email: a practical Claude Code tip every Tuesday and Thursday, plus a Sunday recap.
📅 Updated May 2026
⏱ 14 min read
🎯 For SOC, AppSec, SecEng & IR Teams
🔒 Runs locally; what Claude reads is sent to the API
⚡ Runs in your terminal, not a browser tab
🧠 Persistent context across every session
🚀 Active in <30 min
Why Security Teams Adopt Claude Code
Most AI tools for security work are browser-based products that require you to paste sensitive context into a web interface, re-explain your environment every session, and trust that some SaaS company's data handling is sufficient for your threat model. Claude Code is different on every dimension that matters to security professionals.
💻
Terminal-native, not browser-based
Claude Code runs directly in your terminal alongside your existing toolchain — nmap, Burp, Wireshark, grep, curl. Pipe output directly into Claude for analysis without context-switching to a browser.
🖥️
Local execution, local storage
Your brain/ directory — threat intel, runbooks, asset inventory, past incidents — lives on your machine. Nothing is synced to Brainfile servers. You control your context data entirely.
🧠
Persistent environment context
Claude loads your stack, your threat model, your organization's escalation procedures, and your compliance framework mappings automatically at every session start. No re-explaining your environment.
📋
Structured output by default
Security deliverables have standard formats — IR timelines, vuln writeups, threat briefs, policy sections. The Security OS configuration tells Claude exactly how to format each document type.
The context problem is real and expensive. A senior analyst who re-explains their environment to a generic AI chatbot every session pays that cost every working day of the year. A Security OS you set up once in CLAUDE.md and brain/ removes that cost.
5 Security Workflows with CLAUDE.md Setups
Each workflow below shows a real CLAUDE.md configuration snippet, the analyst prompt, and the time savings. These are concrete patterns you can copy — not theoretical. You replace the bracket values with your own environment details.
Pull raw IOCs, OSINT sources, and vendor advisories — paste them in, get a structured executive-ready brief with severity rating, affected assets, and recommended actions. The CLAUDE.md configuration tells Claude your critical asset categories and briefing format so you never have to specify them.
CLAUDE.md — threat intel section
## Threat Intelligence
When I provide raw threat intel (IOCs, OSINT, advisories):
1. Map IOCs to our asset categories: [CRITICAL_ASSETS list in brain/assets/critical.md]
2. Rate severity: Critical/High/Medium/Low using CVSS as baseline
3. Output format: Executive Summary → Affected Assets → IOC List → Recommended Actions
4. Always include: confidence level, source reliability, recommended hunting queries
5. Reference prior related intel from brain/threat-intel/archive/
Prompt: "Here's today's threat intel dump from MISP and OTX. [paste export]. Generate the weekly brief."
When a new incident type surfaces that you don't have a runbook for, describe the scenario to Claude and get a complete incident response runbook — containment steps, evidence preservation, stakeholder comms, and lessons-learned structure — in your organization's format.
CLAUDE.md — IR section
## Incident Response
Runbook format: brain/runbooks/RUNBOOK_FORMAT.md
Escalation contacts: brain/vendors/escalation_contacts.md
SLA requirements: [P1: 15min → CISO, P2: 1hr → SecMgr, P3: 4hr → team]
Always include: containment timeline, evidence log, stakeholder comms draft
Lessons-learned format: brain/runbooks/lessons_learned.md
Reference closed incidents in brain/incidents/ for similar patterns
Prompt: "We have an active ransomware indicator on a Windows endpoint in the finance VLAN. Generate an IR runbook for this scenario."
Transform raw vulnerability scanner output or manual pentest findings into structured writeups with business impact statements, CVSS scoring rationale, and remediation guidance. Essential for both internal reporting and customer-facing pentest deliverables.
CLAUDE.md — vulnerability assessment section
## Vulnerability Assessment
Writeup format: Title → CVE/CWE → CVSS → Business Impact → Technical Detail → PoC Summary → Remediation
Severity thresholds: brain/policies/severity_matrix.md
Business impact framing: map to CIA triad, reference affected business units
Remediation guidance: specific, actionable, include vendor patches if available
Tone: technical for dev audience, executive summary for business stakeholders
Prompt: "Finding: SQLi in /api/users endpoint, parameter 'id', confirmed via manual test with sqlmap. Write the full vuln writeup."
Paste in suspicious email headers and body text and get a structured triage report — sender reputation analysis, domain age assessment, link analysis, social engineering technique identification, and a verdict with confidence level. The configuration tells Claude your internal domain list and known-safe sender patterns.
CLAUDE.md — phishing analysis section
## Phishing Analysis
Internal domains (auto-trusted): brain/assets/internal_domains.md
Output: Verdict (Phish/Suspicious/Likely-Legit) → Confidence → Evidence → Recommended Actions
Flag: urgency language, credential requests, unusual sender patterns, lookalike domains
Extract and list all URLs, analyze for lookalike patterns vs our domains
Check headers for: SPF/DKIM/DMARC alignment, relay chain anomalies
Prompt: "Triage this reported phish: [paste email headers and body]. Verdict and recommended response."
Paste in new CVE announcements and get an immediate impact assessment against your specific stack. Claude cross-references your asset inventory and technology stack (stored in brain/) to tell you specifically which systems are affected, severity in your context, and priority patching order.
CLAUDE.md — CVE monitoring section
## CVE Monitoring
Tech stack reference: brain/assets/tech_stack.md
For each CVE: map to specific versions we run, assess exploitability in our environment
Priority matrix: CVSS ≥9.0 + internet-facing → P0 immediate patch
CVSS ≥7.0 + internal critical asset → P1 patch within 7 days
Output: Affected systems list → Priority rating → Patch/mitigate steps → Timeline
Reference our patching SLA from brain/policies/patching_sla.md
Prompt: "New CVEs this week: [paste NVD export]. Which ones hit our stack and what's our priority order?"
The Full Security OS: brain/ Directory Structure
The brain/ directory is the persistent memory of your Security OS. Everything Claude needs to know about your environment, organization, and past work lives here — loaded automatically at session start via your CLAUDE.md configuration. It never leaves your machine.
brain/
├── threat-intel/
│ ├── current_campaigns.md # active threat actors targeting your industry
│ ├── ioc_library.json # enriched IOC database
│ └── archive/ # past weekly intel briefings
├── incidents/
│ ├── incident_index.md # index of all closed incidents
│ ├── 2026-Q1/ # quarterly folders with IR summaries
│ └── lessons_learned_library.md # aggregated lessons across incidents
├── runbooks/
│ ├── RUNBOOK_FORMAT.md # your org's standard runbook structure
│ ├── ransomware_response.md # completed runbooks by incident type
│ ├── phishing_response.md
│ ├── insider_threat.md
│ └── lessons_learned.md
├── assets/
│ ├── critical.md # critical asset inventory with data classification
│ ├── tech_stack.md # software, versions, and network zones
│ └── internal_domains.md # internal domains and trusted senders
├── vendors/
│ ├── escalation_contacts.md # vendor security contacts and SLA terms
│ └── tool_inventory.md # security tooling by category
├── compliance/
│ ├── framework_mappings.md # NIST CSF / CIS Controls / SOC2 mappings
│ └── audit_findings.md # open and closed audit findings
└── policies/
├── severity_matrix.md # your org's severity definitions
├── patching_sla.md # patch window SLAs by priority
└── acceptable_use.md # current policy documents
The key insight: Claude doesn't search these files randomly. Your CLAUDE.md tells it exactly which files to load for which task types. When you ask for a CVE impact analysis, Claude loads tech_stack.md and patching_sla.md automatically. When you ask for a phishing triage, it loads internal_domains.md. Precision context loading, every time.
Your CLAUDE.md Security OS Configuration
The top-level CLAUDE.md is the operating system kernel — it tells Claude who you are, what environment it's operating in, and the rules that govern all security work. Copy this configuration file and fill in your specifics.
CLAUDE.md — top-level security os configuration
# Security OS — [Organization Name]
## Environment Identity
Role: [Senior Security Engineer / SOC Analyst / AppSec Lead]
Organization type: [Industry, size, regulatory context]
Primary compliance frameworks: [SOC2, ISO27001, PCI-DSS, HIPAA]
Team size: [N analysts, escalation path documented in brain/vendors/escalation_contacts.md]
## Session Start — Always Load
1. brain/threat-intel/current_campaigns.md
2. brain/assets/critical.md
3. brain/vendors/escalation_contacts.md
## Output Standards
All security deliverables: professional tone, specific and actionable recommendations
Threat briefs: Executive Summary first, technical detail below
IR runbooks: numbered steps, clear ownership at each step, time estimates
Vuln writeups: CVSS score, business impact, specific remediation steps
## Hard Rules
NEVER include: internal IP ranges, hostnames, or account credentials in any output
NEVER suggest actions outside our change control process for production systems
Always flag: if unsure whether an action requires change control, ask first
.claude/rules/ Files for Security Work
Rules files live in .claude/rules/ and are automatically loaded alongside CLAUDE.md for every session. They allow you to maintain separate rule sets for different security domains without cluttering the main configuration. Think of them as policy modules — each one governs a specific workflow area.
Rules File: Incident Response
.claude/rules/incident-response.md
# Incident Response Rules
Every IR output must include:
- Incident classification (per our severity matrix)
- Timeline with specific timestamps (use [TIME] placeholder where unknown)
- Containment actions with rollback notes
- Evidence preservation checklist
- Stakeholder communication draft
- Lessons-learned section header (even if empty at time of drafting)
Never suggest: deleting logs, modifying evidence, or taking containment actions
without explicitly noting change-control requirements.
Rules File: Vulnerability Management
.claude/rules/vulnerability-management.md
# Vulnerability Management Rules
Severity rating: Always use CVSS 3.1 base score + environmental modifiers
Environmental modifiers for us: internet-facing assets add +1.0, critical data adds +0.5
Remediation timeline must reference brain/policies/patching_sla.md
All writeups: technical AND business impact (separate paragraphs)
CVE references: always include NVD link and vendor advisory if available
Pentest findings: include PoC summary (not full exploit code) and reproduction steps
Rules File: Security Policy Documentation
.claude/rules/policy-documentation.md
# Security Policy Documentation Rules
Policy structure: Purpose → Scope → Policy Statements → Responsibilities → Exceptions → Review Cycle
Language: plain English, avoid jargon where possible, define technical terms inline
Compliance mapping: each policy section should note applicable framework control
Review cycle: annual for most policies, quarterly for access control and IR
Reference existing policies from brain/policies/ before drafting new sections
Never create policy that conflicts with brain/policies/acceptable_use.md
Data Handling: What Goes in brain/, What Stays Out
This is the question every security professional asks first, and it deserves a direct answer. Claude Code sends the content of your conversation — including any files you paste in — to Anthropic's API for model inference. This is identical to how any AI API works. Here's how to handle it correctly.
Safe to include in brain/ and paste to Claude
✅
Runbooks and procedures
IR playbooks, response procedures, policy documents — these are safe. No sensitive data, all process.
✅
Generic asset categories
Technology stack by category (not specific hostnames), data classification tiers, network zone descriptions without IP ranges.
✅
Anonymized incident summaries
Lessons-learned, incident patterns, and post-mortems with specific hostnames, IPs, and account names removed.
✅
Public IOCs and CVE data
Publicly disclosed indicators of compromise, CVE descriptions, threat actor TTPs from public reports.
Handle with care — sanitize before pasting
Remove before pasting to Claude: Production hostnames and IP addresses, usernames and account credentials, authentication tokens and API keys, personally identifiable information, data subject to strict contractual NDA obligations, or regulated data categories (PHI, PII under GDPR, PCI cardholder data). Your brain/ directory stores these files locally — they only get sent to Claude's API when you explicitly paste them into a session prompt.
Practical workflow: Keep a sanitization habit. Before pasting any log snippet or incident data, do a quick find-replace: hostnames → [HOSTNAME], IPs → [IP_ADDR], usernames → [USER]. This takes 30 seconds and means Claude gets the analytical context it needs without any sensitive specifics in the API call.
What Brainfile never touches
The Brainfile configuration layer — your CLAUDE.md, brain/ directory files, and .claude/rules/ files — is stored entirely on your local machine. Brainfile has no server that syncs or stores these files. When you start a trial or subscribe, Brainfile's files are pulled into your project as plain markdown (re-run the pull for the newest weekly feed), and you configure them locally. That's it. Your environment data is yours.
Before vs. After: Manual vs. AI-Assisted Security Work
The productivity difference is clearest when you compare specific tasks. These are realistic estimates based on experienced security professionals — individual results vary by familiarity with AI tooling and task complexity.
| Security Task |
Manual (Before) |
With Security OS (After) |
| Weekly threat intelligence brief |
Pull IOCs, research actors, cross-reference assets, write brief |
Paste intel exports, review and edit Claude's structured brief |
| New IR runbook for novel incident type |
Research best practices, draft steps, review with team |
Describe scenario, Claude drafts with your org's format and escalation path, team review |
| Pentest finding writeup (per finding) |
Research CVSS, write business impact, remediation guidance |
Provide raw finding notes, review and refine Claude's writeup |
| Phishing email triage |
Analyze headers, research domains, write triage ticket |
Paste email, get structured verdict with evidence, review and close ticket |
| CVE impact assessment (per batch) |
Research each CVE, cross-reference stack, prioritize and document |
Paste CVE batch, Claude cross-references your stack and outputs priority list |
| Security policy section draft |
Research framework requirements, draft, legal review prep |
Describe requirement, Claude drafts with framework mappings, your review |
| Re-explaining environment to AI tool each session |
Every session, with generic AI tools |
Loaded automatically from brain/ at session start |
FAQ: AI for Security Teams
Does Claude Code send my threat intelligence data to Anthropic's servers? ↓
Claude Code runs in your terminal on your local machine. When you paste in indicators of compromise, log snippets, or internal network data, that content is sent to Anthropic's API for model inference — the same way any Claude API call works. It does not store your data in a shared product database, train on your inputs, or expose data to other users. Your brain/ directory — where all your persistent context lives — stays entirely on your machine and is never transmitted to Brainfile. For highly sensitive or regulated data, sanitize before pasting: replace hostnames, IPs, and credentials with placeholder values.
Do I need to know how to code to use Claude Code for security work? ↓
No. Claude Code is a terminal-based interface, but you interact with it entirely in plain English. Security professionals who are not developers use it daily for writing policy documents, drafting incident summaries, analyzing phishing emails, and researching CVEs. Brainfile's /start interview writes your CLAUDE.md and brain/ files from your answers, and the security examples on this page are free to copy. There is no security-specific role pack today. Setup starts with the same short /start interview, then you add your own files as you go.
How is this different from asking ChatGPT or Copilot security questions? ↓
Generic AI tools have no memory of your environment. Every session you must re-explain your stack, re-describe your threat model, re-define your org's escalation procedures and compliance requirements. Claude Code with Brainfile loads all of that automatically — your asset inventory, past incident summaries, runbook library, escalation contacts, compliance framework mappings — at every session start. Claude performs like a senior analyst who already knows your environment, every time you open it. The re-context problem alone costs analysts time every week.
Can Claude handle real-time threat feeds or does it only work with static data? ↓
Claude Code can read and process any file you provide, including JSON exports from threat intel platforms, SIEM alert exports, CVE database pulls, and log files. It does not have a live connection to external threat feeds — you pipe data in. Many security teams build simple shell scripts that pull MISP, OTX, or VirusTotal API results and feed them directly to Claude for analysis and summary. Your brain/ directory stores enriched intel so each Claude session picks up where the last one left off.
Is Claude Code suitable for teams with SOC 2 or ISO 27001 compliance requirements? ↓
Anthropic publishes its compliance artifacts for the Claude API in the Anthropic Trust Center (trust.anthropic.com). Claude Code as a tool inherits those API-level assurances. For your own compliance program, using Claude Code is similar to using any AI API — you must ensure your data handling practices, retention policies, and vendor assessment processes cover the Anthropic API as a sub-processor. Brainfile's configuration layer runs entirely locally and stores nothing in the cloud, which simplifies your data flow documentation significantly.
What security workflows is Claude Code best at? ↓
Claude excels at structured analysis and documentation tasks: threat intelligence briefings (paste in raw IOCs and OSINT, get a structured brief), incident response timelines (raw log entries → chronological narrative), vulnerability assessment writeups (CVE + asset context → risk-rated writeup), security policy drafting (requirement → policy section with rationale), phishing analysis (paste email headers and body → triage summary with verdict), and CVE impact analysis (CVE description + your stack → specific impact statement). Where it is weaker: real-time network monitoring, binary analysis without text output, and anything requiring GUI-based tools.
How do I structure my brain/ directory for security work? ↓
Recommended structure: brain/threat-intel/ for IOC libraries and past briefings, brain/incidents/ for closed incident summaries and lessons learned, brain/runbooks/ for response procedures by incident type, brain/assets/ for critical asset inventory and data classification, brain/vendors/ for vendor security contacts and SLA terms, brain/compliance/ for framework mappings (NIST, CIS, SOC2), and brain/policies/ for current policy documents. The CLAUDE.md configuration at the top level tells Claude which files to load at session start and how to format each deliverable type. Brainfile's /start interview creates the brain/ files; the security folders above are yours to add.
Can I use this for penetration testing report writing? ↓
Yes. Pentest report writing is one of the highest-value uses of Claude Code for security professionals. The workflow: run your engagement, export findings to structured notes, configure the Security OS report format once in CLAUDE.md, and get draft executive summaries plus technical findings sections in your firm's format for each engagement. Loading the report format once removes the re-formatting step from every engagement. The pentest report format above (executive summary, scope, methodology, findings by severity, remediation roadmap) is free to copy into your CLAUDE.md.
Brainfile Pricing: What Ships Today
The 30-day free trial (no card) and Basic ($19/mo) include the Autopilot run protocol, the 10 pattern files (backlog, ledger, interview onboarding, end-of-run brief, conversation history, memory starter) and the weekly freshness feed. Pro ($99/mo or $999/yr) adds 15 role packs; none of them is security-specific, so the security setup on this page is the part you write, with the examples above as a start. You run everything in your own Claude environment — Brainfile provides the configuration, not the compute.
Monthly
$99 / month
Brainfile Pro. Cancel anytime.
- The Autopilot protocol and 10 pattern files
- Weekly freshness feed as Claude Code changes
- 15 role packs (none is security-specific yet)
- The /start interview writes your CLAUDE.md and brain/ files
- 30-day money-back guarantee
Start Monthly Trial →
Best Value — $999/yr vs $99/mo: save $189
Annual
$83 / month
$999/yr billed annually. The same plan as Monthly, billed once a year (save $189).
- Everything in Monthly
- Billed once a year (save $189)
Start Annual Trial →
30-day free trial on both plans. No charge for your 30-day trial. Requires an active Claude Pro or Claude API subscription (separate, from Anthropic).
More Claude Code OS Guides
Build Your Security AI OS Today
Stop re-explaining your environment to generic AI tools. Load your threat model, runbooks, asset inventory, and compliance mappings once — have them available in every Claude session automatically.
30-day free trial. No charge for 30 days. Requires Claude Pro or Claude API subscription.