Tag: ciso
Claude inference hooks cannot see a screenshot
Anthropic now lets an Enterprise organisation put its own server in front of every prompt and return allow or deny before the model runs. It is the strongest inline control Claude has shipped. It also never receives raw image bytes, so a screenshot of the document you are trying to stop walks straight through, and the failure mode when your server goes down is a setting somebody has to choose.
Claude US-only inference costs 1.1x and that is the cheapest part
The Enterprise console offers one toggle that keeps all model inference in US regions for a 10 per cent surcharge. Underneath it are two independent settings, one of which is a one-way door you set when you create a workspace and can never change. The surcharge is the part everybody reads and the least expensive of the three costs.
The Claude Enterprise admin console has 25 sections and no map
Claude Enterprise puts 25 settings sections behind one nav, grouped into four blocks that do not match how anybody actually governs AI. Here is the whole tree, what each block controls, and the six settings worth opening on your first day as an Owner rather than the twenty-five you will otherwise scroll past.
An MCP server is unreviewed code with your file system in scope
Treat every MCP server as untrusted code that runs with the access your agent has, because that is what it is. Anthropic docs say the directory lists connectors but does not security-audit them. A registry of approved servers with nothing enforcing it is a memo. The control that binds is a managed allowlist matched by URL or command, never by name.
Claude is allowed in regulated finance, but it has no EU data residency
Two objections kill most regulated-finance AI conversations before they start. The first, that Anthropic does not permit Claude for regulated work, is false: Claude for Financial Services exists, banks run it, and the usage policy names finance high-risk, not forbidden. The second is real and almost nobody states it plainly: first-party Claude Enterprise has no EU data residency at all. There is no "eu" inference region and workspace storage is US-only. If you are FCA-regulated, that is the fact to design around, and the only EU route runs through a hyperscaler.
Your Claude Code deny rules are not a security boundary
Before you hand Claude Code to hundreds of people you add deny rules for .env and credentials and feel locked down. You are not. Those rules govern Claude own tools, not a Python one-liner that opens the same file, and the control that actually holds, the OS sandbox, reads your whole machine by default and fails open when it cannot start. The baseline worth setting is real. Its dangerous gaps are the defaults you never changed.
Your locked-down Claude sandbox is a holding pattern, not a destination
Giving everyone Claude inside an isolated VM, no sensitive data allowed, feels like the safe way to start. It is a fine way to start. The trouble is what happens when you leave people there: the leak it was built to stop walks out by copy-paste anyway, the friction recruits the shadow AI you were trying to prevent, and the value never compounds because nothing in an ephemeral box survives the session. A sandbox is a scaffold. Scaffolds come down.
Blocking the personal Claude account is an identity problem, not a network one
Your CISO trusts the control posture Microsoft gives Copilot. To get Claude to the same bar, do not reach for tenant restrictions: that header only fires on your network, so it is theater the moment a laptop goes off-VPN. The control that holds lives at identity. Enforce SSO, then claim your domain, and know that the claim is a one-way door.