Claude Enterprise Security Center: Grade Your AI Settings

Anthropic just gave Claude Enterprise owners a report card. The new Claude Enterprise security center, in beta since November 5, compares your chat, Cowork and Claude Code settings against Anthropic's recommended configuration and marks each control passed or failed. You can download it as a report for your auditor. For a small team that bought Claude seats and never opened Organization settings again, this is the fastest audit you will get.

What actually happened

Per Anthropic's announcement, the security center is a new page in Organization settings. For each control it shows the current value, the recommended value where one exists, and a link to the place where you change it. It checks again each time the page loads and flags settings that are new or recently changed.

The Help Center article adds the details that matter:

• Owners only. Owners and the Primary Owner can open it. Admins and members cannot.
• View-only. It changes nothing. You fix each setting on its own page.
• Four statuses: passed, failed, not attested, or shown for information.
• Manual attestation. Settings that live outside Claude, such as device management or Claude Code managed settings, show "Check manually." An owner confirms them, and the page records who did it and when.
• Export. "Download report" gives a PDF. With the Compliance API on, the same data is readable by code, and status changes go to the activity feed.

Anthropic is direct that this is guidance, "not a certification or a guarantee of compliance."

The same release moved inference hooks to general availability, and added a beta parent-organization console at admin.claude.com, an Admin API call that signs a member out on every device, and a self-serve IP allowlist.

Why the Claude Enterprise security center matters for your business

Most small companies treat AI seats like a SaaS login: buy, invite, forget. Then an agent in Cowork gets a connector set to "always allow," and nobody remembers who turned it on. A page that lists the failures in one place removes the excuse.

Three things we would do this week:

1. Fix the failed controls before you read the passed ones. The value is in the red rows.
2. Do not attest what you have not checked. "Check manually" means a person signs their name. If your MDM or Claude Code managed settings are not actually deployed, the honest answer is "not attested."
3. Put the PDF on a schedule. Download it monthly and keep it with your other access reviews. Settings drift. A dated report shows when.

And remember the limit: the recommendations are Anthropic's defaults, not your threat model. A control can pass and still be wrong for a shop that handles card data or health records.

Sources: Anthropic / Claude, Claude Help Center.