Anthropic has expanded enterprise security monitoring for its Claude ecosystem through the Claude Compliance API, giving organizations a way to collect and analyze activity from Claude Code, Cowork, Claude Enterprise conversations, and connected AI-agent workflows.
The move addresses a growing governance challenge: enterprises are rapidly deploying generative AI and autonomous tools, but security teams often lack centralized visibility into what data is shared, what tools agents invoke, and which users or identities are behind those actions.
The Compliance API is available to Claude Enterprise customers and Claude Platform users, allowing approved security and compliance platforms to ingest Claude telemetry into existing security operations workflows.
Anthropic Gives Security Teams Visibility
Rather than requiring defenders to work from a separate Claude-specific console, the integration model pushes activity into familiar SIEM, DLP, security operations, identity, eDiscovery, and AI security posture management platforms.
For Claude Enterprise deployments, the API can provide conversation content including chats, uploaded files, and projects. It also captures sessions from Cowork across Claude web, desktop, and mobile environments, as well as Claude Code activity from the command-line interface and desktop application.
These records can include prompts, responses, tool-call content, skills, and generated artifacts represented as transcript text.
Visibility is particularly important for organizations using AI agents in software development and business processes. Claude Code and Cowork can interact with files, code repositories, Model Context Protocol servers, enterprise connectors, and other tools.
Such capabilities can improve productivity, but they also create new attack and governance concerns, including accidental exposure of credentials or source code, malicious or unapproved MCP connections, prompt-injection attempts, overprivileged agent access, and unauthorized automation.
Anthropic’s approach enables third-party security providers to correlate Claude signals with endpoint, identity, cloud, and SaaS telemetry. For example, integrations can identify risky prompts, sensitive-data exposure, anomalous agent behavior, suspicious credential activity, policy violations, and changes to administrative settings.
Activity-feed data can also cover user logins, administrative actions, configuration changes, workspace and membership changes, API-key creation, file activity, downloads, and skill modifications.
Claude Enterprise can expose conversational content and session records, while Claude Platform access focuses on activity-feed events; conversation prompts and model responses are not available through the Compliance API for Claude Platform.
That distinction matters for security teams planning investigations, retention strategies, and privacy controls across different Claude deployments.
Anthropic has listed integrations spanning established security categories, including CrowdStrike, Microsoft Purview, Splunk, Elastic, Datadog, Cloudflare, Palo Alto Networks, Okta, SentinelOne, Wiz, Zscaler, Varonis, Proofpoint, and Netskope.
These integrations are intended to support detection, incident response, data-loss prevention, access governance, and audit workflows without forcing enterprises to rebuild their monitoring stacks around a new AI product.
The announcement reflects a broader shift in enterprise defense: AI usage is becoming security telemetry in its own right.
As AI agents receive access to source code, cloud systems, SaaS services, and sensitive business data, monitoring only the human user is no longer sufficient.
Security teams increasingly need to understand the full chain of action: who initiated the task, which agent executed it, what tools it accessed, what data it processed, and whether the outcome remained within approved policy boundaries.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
