Anthropic's November 5 security release gives a CISO real inline DLP for every Claude Enterprise product, but the defaults let unchecked prompts through. The new EDR sensor watches only the laptop VM, and the new member sign-out leaves API keys and cloud sessions running. If you are deciding whether Claude can touch regulated data, the release is enough to start that conversation. It is not yet a set of controls you can show an auditor without doing configuration work first.
The announcement includes six pieces that matter here, among other admin changes. One is generally available: inference hooks, which send prompts and tool calls to your own security server for an allow or deny verdict. Everything else is beta: a Security Center that scores your settings against Anthropic's recommendations, an EDR sensor inside the local Cowork virtual machine, a parent admin console for multi-org companies, an Admin API call that signs a member out everywhere, and a self-serve IP allowlist. The release notes list it the same day as "several in beta."
The timing matters more than the feature list. On November 16, the unified chat and Cowork experience turns on by default for Enterprise organizations that have not changed the setting and have both Chat and Cloud code execution and file creation on, and agentic work in that mode runs in VMs that Anthropic manages. That is the one place the new EDR sensor cannot go.
What Inference Hooks Actually Catch
Inference hooks are a server-side checkpoint: Anthropic posts the conversation transcript to an HTTPS endpoint you run, waits for a verdict, and drops denied requests before the model sees them. The overview says one hook governs claude.ai, Cowork, Claude Code, Claude for Microsoft 365, Claude Tag and Claude in Chrome, across web, desktop, mobile, CLI and Slack. Nothing gets installed on devices, which is why this is the strongest control in the release.
The feature launched in beta on August 5, and the launch post names existing DLP vendors such as Netskope and Proofpoint as tools the webhook can feed. Andrew Grimmett, Bandwidth's VP of information security, is quoted saying it lets the company "safely move faster on AI." Three months of beta is short, but the GA documentation is detailed about where the edges are, and those edges are what your risk register needs:
- Images are not inspected. Attachments arrive as metadata and extracted text, and raw file and image bytes are never sent, so a screenshot of a customer record goes straight through.
- Verdicts are allow or deny. You cannot redact a card number and let the rest of the prompt proceed.
- Some model calls sit outside the hook: hosted Claude Security scans, Code Review on GitHub pull requests, and the calls Anthropic makes to build smart reports.
- Voice mode is partial. The docs say "a small share of tool calls isn't" sent, and tell you not to rely on hooks as your only voice control.
- Hooks are not available on Amazon Bedrock or Google Cloud.
The tool-call hook is the one that will matter for agents. With the Validate tool calls setting on (the default in a new configuration), your server sees each tool call before it runs and each tool result when it returns, including calls to MCP servers and claude.ai connectors, per the integration guide. Some of claude.ai's own housekeeping tools are skipped, though their results show up in the next prompt event.
Why the Defaults Fail Open
The configuration guide sets failure handling to "Allow the request" and a 5,000ms verdict timeout on first save. If your DLP server is slow or down, prompts go to the model uninspected. People keep working through an outage, and every minute of that outage is a minute without DLP.
The guide is candid about the other gaps. A circuit breaker trips on sustained failures and applies your failure setting to every request until it resets. Requests outside your rollout percentage skip inspection even when you have chosen to block on failure. The endpoint health panel is "best-effort" and can show zero failures when Anthropic cannot read its counters. In the mode that inspects only selected roles, requests with no member behind them, such as those made with API keys, are not inspected. Only Owners and Primary owners can configure any of it.
The rollout tooling is good, and you should use it. Shadow mode sends real traffic to your server and logs verdicts without blocking anyone, so you can tune policies on your own prompts before a single engineer gets stopped. Denials, configuration changes and breaker trips land in the Compliance API Activity Feed, which you can pipe to a SIEM.
What the Cowork EDR Sensor Can and Cannot See
The EDR integration puts your existing sensor inside the virtual machine Cowork runs on the user's laptop, in detection mode only. Per the help article, seven vendors are approved, including CrowdStrike, SentinelOne and Tanium. Microsoft Defender is not on the list. It requires Claude Desktop 4.4212.0 or later, an MDM push on macOS or registry policy on Windows, and the Windows Virtual Machine Platform feature. Anthropic does not charge for it during the beta; your EDR vendor may.
Three limits decide whether it is worth piloting:
- The sensor reports and does not block. The announcement says sensors "run in detection mode," so plan for alerting and response.
- Cloud sessions are out of reach: "Cowork sessions in the cloud run on Anthropic's servers, and you can't install a sensor there." After November 16, more Enterprise work runs in exactly those VMs, with each conversation that needs one getting its own machine managed by Anthropic.
- Your EDR console turns into a prompt archive. The sensor can see prompts, files and Claude's responses inside the VM, and that data goes to your EDR vendor, not to Anthropic. It can also send telemetry outside the Cowork network allowlist.
Prophet Security, which sells AI SOC products, read the vendor announcements and found readiness uneven: its November 3 analysis notes CrowdStrike gave no availability date and SentinelOne's announcement was written in the future tense. Before you budget a pilot, ask your vendor whether its integration exists today and which sensor build runs in the VM.
Where the Sign-Out Call and Parent Console Fall Short
The Admin API sign-out ends a member's browser and device sessions in one call, which is useful in an incident. Per the announcement, it "doesn't end API keys, cloud sessions already running, or scheduled routines," and the person keeps their membership and can sign back in. Anthropic's help article on signing out says the same about keys: they keep working.
So the call buys you time in an incident, and an offboarding runbook still has to remove the member through SCIM or the admin console, revoke their API keys, and stop their scheduled tasks, which keep running even after the conversation that created them is deleted. Cowork cloud sessions a member starts directly are not covered by custom retention either; they stay until the member deletes them.
The parent console at admin.claude.com lets a company with several Claude organizations set SSO, SCIM, domain verification and Compliance API keys once. Two warnings come with it. Setup "can't be undone," so pick the parent admins before anyone proposes them. And parent-level Compliance API keys can read data across every child organization, which makes them the most sensitive credential in your Claude estate.
The Security Center is a posture check. It compares your chat, Cowork and Claude Code settings to Anthropic's recommendations, records attestations and exports a report that separates automated checks from owner-confirmed ones. Anthropic describes it as guidance and "not a certification," so file the report as evidence for your auditor.
What to Do Before November 16
This Week:
- Open the Security Center, export the report and hand it to your GRC lead with an owner and due date on every gap.
- Decide on the unified experience. If you are not ready for agentic work in Anthropic-managed VMs, change the setting before November 16; if you leave it alone, it switches on. Organizations on zero data retention, the HIPAA-ready configuration or customer-managed keys are excluded for now.
- Rewrite the offboarding runbook so API key revocation, scheduled-task shutdown and cloud-session review are separate steps after the sign-out call.
This Month:
- Run inference hooks in shadow mode for two weeks against your DLP vendor, and count would-be denials in your server's own logs before you enforce anything.
- Pick the failure mode on purpose. For groups that touch regulated data, switch failure handling to "Block the request," set the timeout to what your server can reliably meet, and alert on
inference_hooks_circuit_breaker_trippedin the SIEM. - Decide how you will handle screenshots and image uploads, since hooks will not see them.
Before Renewal:
- Get your EDR vendor's Cowork integration date in writing, along with who can read prompt content in its console and how long it is kept.
- Name the parent admins with legal before anyone starts parent console setup, and limit who holds parent-level Compliance API keys.
The Bottom Line
This release follows the path endpoint security took with the first enterprise SaaS wave: the vendor ships hooks for the tools customers already own, and the customer finds the coverage holes by testing. Inference hooks are the piece worth adopting now because they run on Anthropic's side and reach every product. The EDR sensor and the sign-out call are partial controls with documented holes, and the biggest of those holes, cloud execution, gets larger on November 16.
Put hooks in shadow mode this week, and fix the offboarding runbook before you need it.
Continue Reading
- Set Privacy Rules Before Enabling Claude Enterprise Smart Reports
- Agent Audit Logging: Platform Logs Miss the Decision You Must Prove
- OpenAI Starts Billing for ChatGPT Enterprise Dots on November 18
- MCP Server Governance: Enforce at the Client, Not the Registry
- Claude Workspace Add-On Does Not Support Zero Data Retention
- Claude Code Stops Asking Aug 14. Prompts Aren't Policy.
- Start Your Copilot Cleanup With SharePoint Advanced Management
