Claude Plugs Into 28 Security Tools With New Compliance API

Anthropic just made Claude a lot easier for CISOs to say yes to. The company rolled out a Compliance API and 28 enterprise security integrations on May 25, putting Claude under the same DLP (data loss prevention), SIEM (security information and event management), and identity controls that already govern Microsoft 365, Google Workspace, and Salesforce.

The launch lands at exactly the moment enterprises are deciding whether Claude can graduate from "approved for experimentation" to "approved for the whole company." For security teams, that decision usually comes down to one question: can we see what employees are doing in this tool, and can we stop them from leaking data through it?

The Context: Shadow AI Is the New Shadow IT

Until now, enterprise Claude deployments faced a familiar problem. Security teams could see the network traffic, but they couldn't see what was happening inside conversations — whether someone uploaded a customer file, what an agent did with it, or whether a project violated retention policy.

That visibility gap forced a choice. Either security teams whitelisted Claude blindly and hoped, or they blocked it and watched employees route around them with personal accounts. Anthropic's competitors face the same issue, and most have answered with either thin audit logs or expensive bespoke enterprise contracts.

The new Compliance API takes the opposite approach. It exposes Claude's internals — chats, uploaded files, projects, artifacts, admin actions, and login events — as structured data that existing security platforms can ingest. Why this matters: enterprises don't have to learn a new tool to govern Claude. They just point their existing stack at it.

What the Compliance API Actually Does

The API surfaces two data streams. The first is conversation content from Claude Enterprise: chat messages, attached files, project knowledge bases, and generated artifacts. The second is activity events across Claude Enterprise and the Claude Platform: user logins, admin actions, and configuration changes.

Both streams plug into 28 integration partners spanning every major enterprise security category. The launch list includes Cloudflare, CrowdStrike, Microsoft Purview, Okta, Palo Alto Networks, Zscaler, Netskope, Fortinet, Wiz, SailPoint, IBM Guardium, Datadog, Sumo Logic, Rubrik, Snyk, Tenable, Proofpoint, Trellix, Varonis, Mimecast, Cribl, Cyera, Forcepoint, Geordie AI, ReliaQuest, Relativity, Smarsh, and Theta Lake.

For organizations already paying for any of those tools, the workflow is plug-and-play. Connect a Claude instance, configure it once, and Claude's activity starts flowing into the same dashboards and alerting workflows already monitoring email, file shares, and SaaS apps.

Cloudflare and Wiz Lead the Integration Wave

Cloudflare's CASB (cloud access security broker) was first out the door with a public integration write-up. Its connector scans for security findings across projects, attachments, chat files, messages, and artifacts that violate DLP policies — and surfaces them in the same Cloudflare dashboard security teams use for Microsoft 365 and Salesforce.

"Security teams can triage, assign, and remediate Claude-specific risks using the same workflows they use for Microsoft 365, Google Workspace, or Salesforce," Cloudflare wrote in its launch blog. No endpoint agents required.

Wiz's connector takes a different angle. Instead of scanning content, it inventories Claude projects, models, and users — flagging elevated roles, sensitive data inside knowledge bases, and AI-specific risk patterns. That maps onto the broader "AI security posture management" category Wiz has been building toward.

SailPoint, Okta, and Microsoft Purview handle the identity and DLP layers. Datadog and Sumo Logic absorb the activity logs into existing SIEM pipelines.

Industry Impact: A Wedge Against Microsoft Copilot

The competitive read here is direct. Microsoft has spent two years arguing that Copilot is the only AI assistant enterprises can deploy safely because it's already inside Purview, Entra, and the rest of the Microsoft 365 governance stack. The Compliance API neutralizes that argument.

A Claude deployment monitored through Purview now has roughly the same audit and DLP footprint as a Copilot deployment. For enterprises that prefer Claude's coding and reasoning quality but were stuck on governance, the path is suddenly clear.

It also de-risks Claude for regulated industries. Financial services, healthcare, and legal teams that need eDiscovery, retention, and supervisory review can route Claude through Relativity, Smarsh, Theta Lake, and Mimecast — the same vendors handling email and Slack today.

What's Next: Mythos, Agents, and the Compliance Question

The Compliance API arrives the same week Anthropic's Mythos vulnerability-detection model returned to internal testing, and weeks after the company shipped its Agent SDK with credits for third-party tools. Both add governance pressure: agents that take actions on your behalf need audit trails, and a model that finds zero-days in your codebase needs explicit oversight.

You can request access to the Compliance API through Anthropic's enterprise sales team or directly through any of the 28 partner integrations. Existing Claude Enterprise customers should expect the connector setup to take hours, not weeks — most of the lift is on the security partner side.

Bottom Line

Anthropic just removed the biggest remaining objection enterprise security teams had to deploying Claude broadly: "we can't see what's happening inside it." With 28 integrations and a Compliance API that mirrors how Microsoft 365 is already governed, Claude is now legitimately enterprise-default-deployable. If you're a CISO who's been holding the line, this is the week to revisit the conversation.