The 2026 AI Security Audit: How to Use Claude Without Compromising Enterprise Data

Last refreshed: August 2026

Claude is already inside most enterprises — through individual employee accounts, Claude Code on developer machines, and browser extensions — whether IT approved it or not. The security question in 2026 isn’t whether to allow Claude. It’s whether to govern it.

This is a practical security audit checklist for Claude Enterprise deployments in 2026. It covers the five domains that matter, the specific CVEs that affect Claude Code, and the configuration steps that close the most significant exposure.

---

The Current Threat Surface

Claude operates across multiple surfaces — claude.ai web, mobile apps, Claude Code on developer machines, Cowork, and API integrations — each with different data exposure profiles and each requiring different controls.

The most significant 2026 security events affecting Claude deployments:

CVE-2025-59536 (CVSS 8.7): Disclosed by Check Point Research in early 2026. A vulnerability in Claude Code that allows remote code execution through malicious project configuration files — before any trust dialog appears to the user. Affects any organization that has deployed Claude Code without centralized governance.

CVE-2026-21852: Demonstrates how an attacker can redirect all Claude Code traffic to an attacker-controlled server by manipulating the ANTHROPIC_BASE_URL environment variable. Silently exfiltrates API keys and conversation content. Reproducible attack chain.

GTG-1002 campaign (September 2025): Anthropic identified this as one of the first AI-orchestrated cyberattacks at scale, establishing AI developer tooling as an active attack surface.

These are not theoretical risks. They’re documented, reproducible attack chains that affect any Claude Code deployment without centralized governance.

---

Security Domain 1: Identity and Access

Configure SSO before any broad rollout. Without SSO, employees authenticate with personal Anthropic accounts — which means no centralized visibility, no revocation capability, and no audit trail.

Implementation steps:

1. Enable SAML 2.0 or OIDC SSO in the Claude Admin Console. This forces all claude.ai logins through your identity provider (IdP) and prevents personal account fallback.
2. Enable domain capture alongside SSO. This prevents employees from using personal email accounts to access Claude outside the managed environment.
3. Configure SCIM provisioning to automate user lifecycle management. When an employee is offboarded from your IdP, their Claude access is revoked automatically.
4. Implement role-based access controls (RBAC). Not all users need access to all Claude capabilities. Segment by role: standard users, power users with Claude Code, API access holders.
5. Set up periodic access reviews for Claude access, the same way you review access to other SaaS applications. SailPoint and similar identity governance tools can integrate via the Claude Compliance API.

Audit evidence to collect: SSO configuration screenshots, SCIM provisioning logs, access review completion records.

---

Security Domain 2: Data Controls

The first security question in every enterprise deployment is where the data goes. The answer depends on which Claude product and deployment model is in use — and it matters enormously for regulated industries.

Data handling by deployment model:

Deployment	Data Retention	Network Path	Zero Data Retention Available
Claude Enterprise (Anthropic console)	30 days default, ZDR available	Public internet	Yes
AWS Bedrock	Per AWS data agreements	VPC/private network available	Yes
Google Cloud Vertex AI	Per GCP data agreements	VPC/private network available	Yes
Microsoft Foundry	Per Microsoft data agreements	Private network	Yes
Claude.ai personal accounts	Anthropic standard terms	Public internet	No

For regulated industries (HIPAA, financial services, government): deploy via AWS Bedrock, Google Cloud Vertex AI, or Microsoft Foundry with private network configurations that keep traffic off the public internet. Enable ZDR (Zero Data Retention) for workloads with sensitive data.

The silent risk: employees using personal claude.ai accounts for work tasks. Data entered into personal accounts is subject to Anthropic’s standard consumer terms, not Enterprise data agreements. SSO + domain capture closes this gap.

---

Security Domain 3: Claude Code Governance

Claude Code is the highest-risk surface in most enterprise deployments. It runs with the privileges of the developer’s user account, can execute arbitrary shell commands, read the full filesystem, and make outbound network connections.

Hardening steps for Claude Code deployments:

Centralize API key management:

• Use organization-managed API keys (via the Admin Console) rather than individually generated keys
• Create separate keys per team or project, not shared team keys
• Rotate keys on a defined schedule (quarterly minimum)
• Monitor for anomalous usage (volume spikes, off-hours activity) — feed audit logs to SIEM

Address the CVE-2026-21852 attack vector:

• Audit all developer machines for .claude/settings.json files in project repositories — these can be used to redirect traffic
• Block arbitrary ANTHROPIC_BASE_URL overrides via environment variable policy
• Add Claude Code traffic to network monitoring so redirected traffic is detectable

Restrict filesystem access:

• Prevent Claude Code from running in directories containing production secrets or sensitive data
• Use separate working directories for Claude Code sessions, isolated from production credential stores

Code execution controls:

• Enable disableBypassPermissionsMode to require explicit approval for shell commands
• Log all shell commands executed via Claude Code to the audit trail

---

Security Domain 4: Audit Logging and Observability

Claude Enterprise audit logs capture user authentication events, model calls with metadata, and file interactions. Without routing these logs to a SIEM, the audit trail exists but isn’t being monitored.

What the audit log captures:

{
  "event_type": "claude_api_call",
  "timestamp": "2026-08-01T09:14:32Z",
  "user_id": "u_8f3a9c",
  "session_id": "sess_x72kp",
  "workspace": "finance-reporting",
  "model": "claude-opus-4-6",
  "tokens_input": 2340,
  "tokens_output": 412,
  "latency_ms": 1840
}

Implementation steps:

1. Enable audit logging in the Claude Admin Console (Enterprise plan)
2. Export logs to SIEM — Splunk, Datadog, Elastic, or equivalent. Claude supports JSON and CSV export plus direct SIEM push.
3. Build correlation rules for: unusual access times, geographic outliers, session volume spikes, API key misuse
4. Use the Compliance API to export prompts, responses, and admin actions into DLP and insider risk monitoring workflows

The gap Anthropic hasn’t filled: There is no built-in anomaly detection in the Admin Console. Usage anomaly detection requires SIEM integration and custom correlation rules. This is a known limitation — build it at the SIEM layer.

---

Security Domain 5: Agentic Workflow Security

Claude Managed Agents and Claude Code used in agentic workflows introduce a category of risk that traditional SaaS governance doesn’t cover: an AI taking autonomous actions in the environment.

Key controls for agentic deployments:

Human oversight checkpoints: For any agentic workflow that takes consequential actions (code commits, file modifications, API calls to production systems), require a human review step before execution. Don’t allow fully autonomous action without an approval gate on high-impact operations.

Tool scope minimization: Define the smallest set of tools an agent needs and give it nothing else. An agent that only needs to read files shouldn’t have shell execution permissions. MCP server connections should be scoped to the minimum required access.

MCP connector governance: MCP servers allow agents to connect to external systems (GitHub, Notion, Slack, etc.). Each MCP connection is an attack surface for prompt injection — a malicious response from an external system can instruct the agent to take unintended actions. Audit which MCP servers are connected; don’t allow arbitrary MCP connections.

Prompt injection defense: Any content that flows from an external system into an agent’s context (web pages, API responses, file contents) should be treated as potentially adversarial. This is the mechanism behind most AI agent security incidents in 2025–2026. Validate and sanitize external inputs before they reach the agent context.

---

Quick-Reference Audit Checklist

Use this to assess the current state before deciding what to address first:

Identity

• SSO (SAML 2.0 or OIDC) enforced for all Claude access
• Domain capture enabled to prevent personal account use
• SCIM provisioning configured for automated user lifecycle
• RBAC defined by role (standard / power user / API)

Data

• Deployment model documented (Anthropic console vs. Bedrock vs. Vertex)
• ZDR enabled for sensitive data workloads
• Personal claude.ai account use blocked or governed
• Data classification applied to determine which workloads can use which deployment model

Claude Code

• Organization-managed API keys (not individual)
• Per-team/per-project key segmentation
• CVE-2025-59536 and CVE-2026-21852 remediation verified
• Shell execution logging enabled

Audit and Observability

• Audit logging enabled in Admin Console
• Logs routed to SIEM
• Anomaly detection rules configured
• Compliance API integrated with DLP tooling

Agentic

• Human oversight gates on consequential agent actions
• MCP connections audited and scoped
• Prompt injection defenses in place for external inputs

---

Frequently Asked Questions

---

What to Read Next

Claude Enterprise Pricing: What Large Organizations Pay 

Claude AI Pricing — All Plans and API Rates

 Anthropic Console: API Keys and Billing

How to Install Claude Code