Securing Anthropic's Claude at Enterprise Scale: Netskope One AI Security for Claude Enterprise and Claude Platform

Anthropic’s Claude has gone from "the AI tool a few teams were experimenting with" to mission-critical infrastructure:

• Developers ship code with Claude Code.

• Analysts build entire workflows on Claude Projects.

• Platform teams run inference at scale through the Claude Platform.

But here's the uncomfortable question: Do you have the same security governance over Claude that you have over Slack, Google Workspace, or Salesforce? If the answer is "not yet" — this post is for you.

Netskope has built an integration with the Claude Compliance API, giving security and compliance teams visibility into Claude usage directly within the Netskope One Platform. This brings Claude Enterprise and Claude Platform activity under the same security umbrella as every other application in your stack.

No new tools. No separate dashboards. The same console your team already uses. Let me walk you through what this looks like — and more importantly, why it matters.

The Problem: AI Apps Are the New Shadow IT

When your workforce adopted Slack or Microsoft Teams, your security team had playbooks. You could enforce SSO, scan files with DLP, and audit who did what. But AI applications introduce a fundamentally different challenge:

• Conversations contain business logic (Claude Enterprise): Unlike email, a Claude Enterprise chat might contain your entire architecture decision, proprietary algorithms, or customer PII — interleaved with AI responses.

• Projects are knowledge bases (Claude Enterprise): Teams upload internal documents, code, and data into Claude Projects. A misconfigured project can expose sensitive context to an entire organization.

• The platform surface area is massive (Claude Platform): API keys, workspaces, workspace members, roles, rate limits — Claude Platform is infrastructure that needs governance.

• Behavioral signals matter (both products): A user bulk-deleting 20 chats in 10 minutes is not normal. An SSO connection being deactivated at 2 AM demands immediate attention.

The CASB Blindspot: Traditional CASB approaches that only monitor network traffic miss all of this. You need API-level visibility into what's happening inside Claude.

The scope differs significantly by product:

• Claude Enterprise: Activity logs (user logins, admin actions, settings/configuration changes) and conversation content (chats, uploaded files, and projects) are retrievable via dedicated read endpoints.

• Claude Platform: Admin API resource endpoints (organizations, users, workspaces, API keys, invites) and Compliance API activity logs. Note: Conversation content and model inference data are not available for Claude Platform.

What Netskope Delivers: Three Pillars of AI Security

Netskope's integration with Anthropic covers three distinct security capabilities, each addressing a different layer of risk.

Pillar 1: Asset & Identity Discovery

Before you can secure Claude, you need to know what's there. Netskope continuously inventories the resource graph across both Claude Enterprise and Claude Platform:

This is not a static snapshot. The integration continuously synchronizes via the Claude Compliance API, ensuring your inventory reflects the live state of your environment.

Pillar 2: Security Posture Management

Discovery is table stakes. The real value is continuous evaluation. Netskope ships 30+ predefined security rules that evaluate your Claude environment against security best practices and compliance frameworks.

A. Configuration-Based Posture Rules (Always-On Assessment)

Claude Enterprise Posture Rules

Claude Platform Posture Rules

B. Template Rules (Customizable to Your Org)

For policies that vary by organization, Netskope provides configurable templates:

• User email domain validation: Flag users whose email doesn't match @yourcompany.com

• API key expiration threshold: Alert when keys exceed your rotation policy (e.g., > 90 days)

• Monthly spend limit enforcement: Ensure per-user spend caps are configured

• Unapproved model usage detection: Detect cost report entries for models not on your approved list

• Admin invite lifecycle: Alert when admin invites are pending too long

C. Activity-Based Behavioral Rules (Real-Time Threat Detection)

Netskope evaluates the Activity Feed in real-time to detect anomalous behavioral patterns tuned to Claude-specific attack vectors:

These aren't generic rules — they're tuned to Claude-specific attack patterns. A sudden burst of Compliance API accesses from an unknown actor could indicate a leaked key being used for data exfiltration. An SSO configuration change is a single event that demands immediate investigation. 

Pillar 3: Data Protection (DLP for Claude Enterprise Conversations)

Claude Enterprise conversations are repositories of sensitive data. Netskope extends its enterprise DLP engine to scan Claude Enterprise content natively:

• What gets scanned (Claude Enterprise only): Chat messages (prompts & AI responses), uploaded files (PDFs, code, spreadsheets), artifacts, and project knowledge base files. (Note: Conversation content is not available via API for Claude Platform).

• How it works: The same DLP policies you apply to Slack, Google Workspace, or M365 now seamlessly cover Claude Enterprise. If your policy flags SSNs, credit cards, or source code patterns, it works identically here.

• Remediation: When a violation is detected, Netskope can alert the security team with full context or automatically remove the offending chat, file, or project document.

How It Works: Under the Hood

Important Clarification: Netskope built this integration; Anthropic provides the APIs. The integration provides visibility and monitoring — it does not control, restrict, or modify Claude's behavior natively. Remediation actions (like removing a chat) use the Claude Compliance API delete endpoints, which are available exclusively for Claude Enterprise.

Two Products, Distinct Capabilities

Netskope connects to Anthropic using two APIs and two auth methods, unlocking different features:

Data Ingestion: Dual-Loop Architecture

Netskope uses a dual-loop pipeline to ensure comprehensive coverage:

1. Resource Importer: Periodically polls API listing and object endpoints to sync the resource graph. This creates authoritative, point-in-time snapshots of your users, projects, and workspaces.

2. Event Processor: Continuously polls the Compliance API Activity Feed (130+ event types across 14 domains). This catches resources that have no listing endpoint (e.g., MCP servers), setting changes, and real-time behavioral anomalies.

Setup: Five Minutes to Visibility

Onboarding takes three simple instance configurations:

1. Claude Enterprise — Security Posture

1. Navigate to Settings > Configure App Access > Next Gen > Security Posture.

2. Select Claude Enterprise, click Setup Instance.

3. Enter your Compliance Access Key, Admin Email, and desired scan interval.

4. Click Grant Access.

2. Claude Platform — Security Posture

1. Follow the same navigation path.

2. Select Claude Platform, click Setup Instance.

3. Enter your Admin Key and Claude Console Admin Email.

4. Click Grant Access.

3. Claude Enterprise — CASB API (for DLP)

1. Navigate to Settings > Configure App Access > Next Gen > CASB API.

2. Select Claude Enterprise, click Setup Instance.

3. Enter your Compliance Access Key.

4. Click Grant Access.

Within minutes, Netskope begins inventorying your Claude environment, evaluating security posture, scanning conversations for sensitive data, and monitoring the Activity Feed.

What This Means for Your Security Program

• For Security Engineers: You can finally answer questions like: "Are there API keys created by people who've left the company?" or "What MCP servers have been connected to Claude, and by whom?"

• For Compliance Teams: Posture findings map directly to compliance frameworks (GDPR, HIPAA, AICPA, NIST), providing continuous audit evidence rather than point-in-time assessments.

• For SOC Analysts: Behavioral alerts integrate natively with your existing SIEM and alerting workflows. An SSO tampering event shows up in the exact same console where you handle every other incident.

• For CISOs: Claude gets the same enterprise-grade security governance as your other critical SaaS applications. One platform. One policy set. One team. AI adoption doesn't have to mean security regression.

Closing Thought

The pace of AI adoption will not slow down. Your developers will use Claude Code. Your analysts will build Projects. Your platform teams will deploy workspaces. The question is not whether Claude is in your environment — it's whether you have visibility into it.

Netskope's integration with the Claude Compliance API ensures that as Claude usage scales, your security posture scales with it.

See a walkthrough of the integration in the demo video here
 

Discover your environment. Evaluate continuously. Protect what matters.

Availability: This integration is available in private preview for Netskope and Anthropic customers using Anthropic-hosted Claude Enterprise and Claude Platform deployments. To get started, reach out to your Netskope representative or visit the Netskope documentation for setup instructions.