THE ESSENTIALS IN 30 SECONDS

  • Inference hooks, which route prompts and pre-execution tool calls to an organisation's data loss prevention and security tools, are generally available.
  • The security center, parent organisation admin console, Admin API sign-out, self-serve IP allowlist, Desktop settings controls and EDR in Cowork are all in beta.
  • EDR sensors run in detection mode inside the local Cowork virtual machine only, and their telemetry goes to the EDR vendor rather than to Anthropic.

Anthropic announced on November 5 a set of administration and monitoring controls for Claude Enterprise aimed at corporate security teams. Only one feature is generally available, and the rest are in beta, with some exceptions listed in Anthropic's Help Center.

Generally available: inference hooks

Inference hooks connect Claude to an organisation's existing data loss prevention and security tooling. Anthropic describes two kinds: prompt hooks, which send prompts from supported products out for inspection, and pre-tool-call hooks, which check a tool call before it runs. The company says the hooks work with security vendors but does not name any on its announcement page.

In beta: a security center and centralised administration

The security center is a new settings page that compares an organisation's configuration for chat, Cowork and Claude Code with Anthropic's recommended values, showing each control's current and suggested setting. Anthropic presents it as guidance rather than a certification.

A parent organisation console at admin.claude.com, also in beta, lets companies manage single sign-on, SCIM directory sync, domain verification, groups and Compliance API keys across several organisations, with new parent owner and admin roles. Anthropic notes that setup cannot be undone and that parent-level Compliance API keys can read data across organisations. Other beta items include an Admin API call that ends a member's sessions on every device without removing them; a self-serve IP allowlist; and Claude Desktop settings management that can block personal Claude accounts on managed machines.

In beta: EDR inside the Cowork VM

Admins on Team and Enterprise plans can now run their own endpoint detection and response sensor inside the virtual machine Cowork uses on macOS and Windows, which host-level tools otherwise cannot see into. Claude verifies the sensor package signature each time the VM starts, and sensors only detect rather than block. Cyber Security News lists seven approved vendors, including CrowdStrike, Palo Alto Networks, SentinelOne and Tanium, and reports that Anthropic charges nothing extra during the beta, though vendors may.

Coverage does not extend to Cowork sessions hosted in Anthropic's cloud, and the publication notes that a sensor can see prompts, files and responses in the VM and sends that data to its vendor.