AI Security Assessment & Consulting for Business
Before expanding AI use, establish which tools staff use, what information they can reach and who owns the decisions those tools support. NetSys reviews the agreed AI environment and its available evidence: Claude Team and Enterprise workspaces with their Cowork settings and MCP connectors, ChatGPT Business and Enterprise workspaces with their apps and plugins, and Microsoft 365 Copilot permissions and custom-agent access, then defines practical priorities for the next step.
The short answer
An AI security assessment reviews how the AI tools your business uses interact with its data, identities and workflows: which tools are approved, who can sign in and how, what each connector, app and agent can reach, how data is retained and whether it can be used for training, and which actions need a person. NetSys examines those within an agreed scope for Claude, ChatGPT and Microsoft 365 Copilot deployments, including the sharing and permission boundaries in the connected systems, and delivers a findings and action plan with evidence, limitations and owners. An assessment cannot guarantee discovery of every unapproved use or prevention of every data exposure, so the report says where the evidence ends. Using Claude to assess your wider security posture is a different service, described under security configuration reviews.
A tool that drafts from a document and an agent that changes a customer record need different controls. List what the system may read, what it may change and which decisions require a person. Identify the business owner, account type, connected systems and the information staff may submit. That creates a useful scope before choosing a policy or technical control.
Historical visibility is a separate question. Logs, consent records, managed-browser information and staff interviews can help identify use, but their availability and detail vary. A visited domain does not prove which content was submitted. Record the evidence and gaps rather than presenting a complete history that the systems cannot establish.
Two questions get confused. This page answers the first: is our AI deployment secure, meaning identity, connectors, data and permissions for Claude, ChatGPT and Copilot. The second, can AI help assess our security, is the security configuration review on the security assessments page, where engineers use Claude to read authorized configurations and logs and validate every finding.
Review access, test agreed scenarios and prioritize changes
We define the tools, accounts, workflows and evidence to review, with authorized access and any testing boundaries agreed first. The assessment records findings, affected systems and the evidence supporting each conclusion. Representative scenarios can test permissions, agent actions or approval paths where included. Remediation, implementation and repeat reviews are scoped separately so a recommendation is not mistaken for a control already deployed.
What an AI security assessment can cover
Tools and usage evidence
Distinguish what is known from what still needs investigation.
- Approved AI services, embedded features, account types and business owners
- Available sign-in, consent, browser, subscription and usage records
- Staff workflows and restrictions on the information submitted
- Evidence gaps and any additional access or review required
Copilot permissions and sharing
AI makes existing access decisions more important to understand.
- Microsoft 365 data sources and the users or groups with access
- Broad sharing, guest access and content ownership in the agreed review scope
- Available governance controls checked against licensing and configuration
- Prioritized access corrections with content-owner approval and validation
Agent actions and test boundaries
Review what the tool can do as well as what it can answer.
- Connected applications, credentials, tool permissions and authorized actions
- Human approvals, failure behavior and conditions that should stop a run
- Bounded misuse or prompt-injection scenarios where explicitly authorized
- Test findings and residual limitations without claiming a universal protection result
Data handling and an action plan
Make findings usable by the people responsible for the workflow.
- Vendor terms and available retention, sharing and training settings for the actual product and account
- Policy and staff-guidance recommendations tied to real tasks
- A prioritized findings record with owners, dependencies and proposed validation
- Separate scope for remediation, rollout support or continuing review
Claude Deployment Security Review
What does a Claude deployment security review check? Identity, connectors, data settings and the agentic surfaces, plan by plan.
- Workspace identity: Claude Team or Enterprise with SSO and domain capture, who holds owner roles, and on Enterprise, SCIM, role-based access and audit logs
- Connectors and MCP servers: who may add a custom connector, which OAuth scopes or fixed credentials each one holds and who shares them, which tools can write or act, and whether 'Allow always' is appropriate
- Microsoft 365 connector: the Entra admin consent, the read-only default, any write scopes enabled, and how Conditional Access treats requests from Anthropic's address range
- Data handling per product: training off by default on commercial plans, deletion within 30 days, Enterprise custom retention and the Compliance API, and what the Office add-ins and Claude in Chrome do differently
- Cowork and Claude Code: cloud session network access, the approval mode, connected folders, and the device policies that disable local MCP servers and extensions
- Rollout acceptance: the logging available on your plan, the usage policy staff sign, and the tests run before access widens
ChatGPT Security Risks and Settings
Is ChatGPT a security risk? The risk sits in the account type and the settings, so the review checks both.
- Personal accounts at work: on Free, Go, Plus and Pro, content trains OpenAI's models unless the user turns off 'Improve the model for everyone', and nobody in the company can govern the account; a ChatGPT Business (formerly Team) or Enterprise workspace turns training off by default
- Workspace identity: SAML or OIDC SSO and domain verification on Business, SCIM and role-based access on Enterprise; MFA cannot be enforced inside ChatGPT, so it is enforced in your identity provider with SSO set to required
- Business defaults that need a decision on day one: workspace discovery is on, members can invite members, and apps are enabled
- Apps, plugins and custom MCP servers: which apps are enabled, the approval setting for actions, who may publish custom MCP servers, and the Microsoft Graph consent an Entra administrator granted
- Retention and visibility: admins control retention and deleted chats leave OpenAI's systems within 30 days; in Business a removed member's chats are kept indefinitely and shared links cannot be disabled workspace-wide; Enterprise adds the Compliance Platform, IP allowlisting and Lockdown Mode
- Memory and projects: whether workspace memory is on, and project-only memory for sensitive work
AI Readiness Review
Are you ready to widen the rollout? A readiness review answers that with evidence rather than a demo.
- An inventory of AI tools in use, approved or not, with the account type and business owner for each
- Identity baseline met first: SSO where the plan supports it, MFA on every account, owner roles limited to named people
- Data classification applied to what staff may submit, and connectors and apps limited to the sources that classification allows
- Permissions in the connected systems fixed before the AI reaches them, which is where Copilot oversharing and connector overreach both start
- Logging, retention and an incident path agreed, with a named owner for each workspace
- A written go or no-go per team, with the conditions for the next stage
An assessment with clear evidence and follow-up ownership
Fifteen minutes with a NetSys engineer, not a salesperson, and you will know where your ai security assessment stands and what it would take to fix it. Call 845-203-3914 or request a call to discuss the scope and next steps.
Who does the work: meet the NetSys team on our About page.
- Review scope tied to the tools and actions the business actually uses
- Claude, ChatGPT and Microsoft 365 Copilot checked against each vendor's current controls, plan by plan, with the source cited
- Connector, app and MCP permissions checked in the connected systems, where oversharing actually starts
- Findings separated from assumptions and unavailable historical evidence
- Copilot permissions considered alongside content-owner responsibilities
- A practical action plan that distinguishes recommendations from implemented controls
Claude deployment controls, by plan
What the review confirms in a Claude workspace, against what Anthropic publishes for each plan:
| Control | Claude Team | Claude Enterprise |
|---|---|---|
| Sign-in | SSO, domain capture and JIT provisioning | SSO, domain capture, JIT and SCIM provisioning |
| Roles and connectors | Owner and member roles; only owners and primary owners add custom connectors | Role-based access with custom roles; org-wide connector approval and per-tool permissions |
| Audit and compliance | Audit logs and the Compliance API are not listed for Team | Audit logs, Compliance API and OpenTelemetry monitoring |
| Data retention | Deleted chats leave back-end storage within 30 days; custom retention controls are not listed for Team | Custom data retention controls, customer-managed encryption keys and US-only inference |
| Network | Not listed for Team | IP allowlisting; cloud Cowork sessions have no network access by default |
| Training on your data | Not used by default on commercial plans | Not used by default on commercial plans |
| HIPAA | Not available | HIPAA-ready configuration with a BAA accepted by the Primary Owner; connectors, MCP, Claude in Chrome and Skills fall outside it |
| Claude Security code scanning | Not available | Public beta, enabled by admins; a separate product from this review |
As published by Anthropic on October 17, 2026. Features and plan boundaries change, so the review confirms them in your workspace. Sources are listed at the end of this page.
ChatGPT security controls, by plan
The same check for a ChatGPT workspace. ChatGPT Business is the plan formerly called ChatGPT Team:
| Control | ChatGPT Business | ChatGPT Enterprise |
|---|---|---|
| Training on your data | Off by default | Off by default |
| Sign-in | SAML and OIDC SSO plus domain verification; no SCIM | SSO, SCIM and role-based access controls |
| MFA | Cannot be enforced by admins; enforce it in the identity provider | Same: enforce it through SSO set to required |
| Apps and plugins | Enabled by default; admins set workspace availability and action approvals | New workspaces start with a selected set; per-role assignment and content restrictions |
| Custom MCP servers | Admins and owners only; the server's tools are frozen at approval until an admin refreshes them | Same, with per-member creation rights through role-based access |
| Retention and logs | Admins control retention; deleted chats removed within 30 days; no Compliance API | Admin-controlled retention; Compliance Logs Platform and API for eDiscovery, DLP and SIEM tools |
| Network and data location | Data residency shown as not included on the pricing table, with a help article saying it is rolling out at checkout | IP allowlisting, Lockdown Mode and data residency in the regions OpenAI lists |
| HIPAA | No BAA offered | Through sales for managed accounts; HIPAA-eligible variants exist |
| Seats | 2 to 200 paid seats; $20 per Standard seat per month billed annually or $25 billed monthly, as of October 2026 | Custom pricing through sales |
As published by OpenAI on October 17, 2026. Defaults and plan features change, so the review confirms them in your workspace. Sources are listed at the end of this page.
Where we deliver AI Security Assessment
AI Security Assessment in New York City · AI Security Assessment in Greenwich, CT · AI Security Assessment in Jersey City, NJ · AI Security Assessment in Palo Alto, CA. We also support clients remotely wherever their systems run. See all locations and service areas.
AI Security Assessment FAQs
What is included in an AI security assessment?
The engagement covers what the scope names: approved AI services, embedded features, account types and business owners; the sign-in, consent, browser, subscription and usage records that exist; Microsoft 365 sharing and permissions that affect what Copilot can surface; connected applications, credentials and the actions an agent may take; vendor retention, sharing and training settings for the product you actually use; and bounded test scenarios where you authorize them. The deliverable is a prioritized findings record with the evidence, owners and limits of each conclusion.
What is a Claude security review, and is Claude secure for business use?
A Claude security review checks the deployment, not the model: the plan and its controls (Team or Enterprise), SSO and roles, which connectors and MCP servers are enabled and what they can reach, data retention and training settings, Cowork and Claude Code permissions, and what is logged. Anthropic publishes SOC 2 Type I and Type II, ISO 27001:2022 and ISO/IEC 42001:2023 for its commercial products, as of October 2026. The review's job is the part only you control: who and what Claude can reach inside your business, and whether the settings match the data staff will put in front of it.
Does Claude use your data for training, and how do you opt out?
On commercial plans (Team, Enterprise and the API, including Claude Code on those accounts) Anthropic does not use inputs or outputs for training by default; use is opt-in through feedback or explicit permission, as of October 2026. On consumer plans (Free, Pro and Max) data is used when the account's model-improvement setting allows it or a conversation is flagged, so a business running on personal Pro accounts should check that setting on each account or, better, move the work into a Team or Enterprise workspace. The review records which accounts are actually in use and the setting on each.
Does Claude support SSO, and on which plan?
Team and Enterprise both include SSO, domain capture and JIT provisioning; SCIM, audit logs and role-based access with custom roles are Enterprise features, as of October 2026. The review confirms SSO is enforced for every member, that owner roles sit with named people, and that leavers are removed from the workspace as well as from your identity provider, which on Team is a manual step.
Is Claude Cowork safe for company files?
It can be, with the right settings. As of October 2026, cloud Cowork sessions run in a temporary sandbox on Anthropic's infrastructure, outbound traffic is limited to allow-listed destinations through a mandatory proxy, connector tokens never enter the sandbox, and local file access is limited to folders you connect through the desktop app. What the review checks is your side: the approval mode (Manual by default, Auto for read-only tools), the network policy an admin sets, whether 'always allow' is disabled, trusted-device enrollment, and which folders and connectors are reachable. Our Cowork setup and company-files posts go through each setting.
What do you check in an MCP connector review?
Who hosts the server and whether Anthropic has verified it (custom connectors are not verified); the OAuth scopes or fixed credential it holds and who shares that credential on a Team or Enterprise plan; which tools can read, write, delete or act on your behalf; whether interactive tool calls should be disabled; whether Research mode, which can invoke connector tools without further approval, should be limited for write-capable connectors; and how the connector's activity appears in your logs. Prompt injection through a connector's content is the main risk we test for within an authorized scope. See the MCP security review post and our MCP development service.
How does Claude's Microsoft 365 connector affect our tenant?
It uses delegated permissions only, so a user reaches what they could already reach in SharePoint, OneDrive, Outlook and Teams; a Global Administrator grants one-time consent, permissions are read-only by default, and write scopes need a separate consent plus an owner enabling them, as of October 2026. Requests arrive from Anthropic's address range, so location-based Conditional Access policies are not supported while group assignment and MFA are, and Graph calls appear in your Microsoft 365 audit log. The review confirms the consent, the scopes and the sharing in the tenant itself, which is where oversharing starts. The Claude Microsoft 365 connectors post lists the permissions.
What is Claude Security, and is it the same as this assessment?
No. Claude Security is Anthropic's product that scans a code repository for vulnerabilities, validates the findings and proposes patches for human review; it is in public beta for Claude Enterprise, with a separate Claude Code plugin for all Claude Code users, as of October 2026. This assessment reviews how Claude is deployed in your business: identity, connectors, data and permissions. If you write software, its findings can be included in the scope, but it is a different tool answering a different question.
What are the ChatGPT security risks for a business?
Four, in the order we usually find them. Personal accounts: on Free, Go, Plus and Pro, content is used for training unless the user turns off 'Improve the model for everyone', feedback can still send a conversation, and nobody in the company can see or govern the account. Open defaults: a ChatGPT Business workspace starts with workspace discovery on, members able to invite members, and apps enabled. Apps and MCP servers: an app acts with the user's own permissions in Google Drive, SharePoint, Teams or Outlook, so overshared files become answerable questions, and custom MCP servers are not verified by OpenAI. Retention and visibility: admins control retention and deleted chats leave within 30 days, but in Business a removed member's chats stay indefinitely and shared links cannot be disabled workspace-wide. None of these is a flaw in the model; each is a setting or an account decision, which is why the review checks them.
Is ChatGPT a security risk, and which settings should we change first?
ChatGPT is a security risk in the way any system that reaches company data is: through the account type, the settings and the permissions in the systems it connects to. Move work out of personal accounts into a ChatGPT Business (formerly Team) or Enterprise workspace, where OpenAI does not train on workspace data by default. Verify the domain and set up SAML or OIDC SSO, with MFA enforced by your identity provider because ChatGPT admins cannot enforce it. Decide the Business defaults: workspace discovery, member invitations, apps and memory. Set app action approvals to ask or read-only and limit who can publish custom MCP servers. Agree retention and who may export data. Our ChatGPT Business security settings post walks through each screen; this assessment checks them against your workspace and the permissions behind the apps.
Does ChatGPT train on our company data?
Not in a ChatGPT Business or Enterprise workspace by default, including Codex use, memories, data reached through apps and projects, as of October 2026; the same default applies to the API platform. On Free, Go, Plus and Pro the setting 'Improve the model for everyone' is on unless the user turns it off, and thumbs-up or thumbs-down feedback can still send a conversation for training. The assessment lists which accounts staff actually use, because a company plan does not change what happens in the personal account someone opened last year.
Do Microsoft 365 Business Premium or E5 Security licenses cover AI tool risks?
Licensing such as Microsoft 365 Business Premium or the E5 Security add-on determines which identity, email and data-protection controls exist in your tenant, and AI tools that use delegated access to Microsoft 365 inherit those controls. The licenses do not configure themselves, and they see nothing of what staff paste into a personal ChatGPT or Claude account. The assessment checks how the controls you already license apply to the AI tools in use; the Microsoft 365 security service covers the tenant hardening itself.
How does onboarding for an AI security assessment work?
It starts with scoping: the tools, accounts, workflows and evidence to review, the access you authorize and any testing boundaries, all agreed before anything is examined. The free self-check can help you organize concerns first. The review and any authorized scenario tests follow, then a walkthrough of the findings with the people who own each workflow. Remediation, rollout support and repeat reviews are scoped separately, so a recommendation is never mistaken for a control already in place.
What does a Copilot security assessment examine?
It reviews the agreed Microsoft 365 content, sharing and permissions that affect what users can access through Copilot, alongside available governance settings and licensing. Copilot does not simply grant everyone access to all tenant data, but overly broad permissions can make sensitive information easier to surface. The review needs content owners to approve changes and validate that necessary work still functions.
Can you identify everything employees have put into AI tools?
No. Discovery depends on available logs, managed-device visibility, account access and staff information. Some records indicate that a service was used without revealing the content submitted. We document what the evidence supports and where visibility ends. Personal accounts and unmanaged devices may require a different policy or investigation approach.
Does prompt-injection testing prove an AI agent is secure?
No. A bounded test can reveal weaknesses in the scenarios examined; it cannot establish that every future input or attack will fail. Define the agent actions, permissions, approval requirements and stopping conditions first. Findings should identify the test coverage and residual risks, with remediation and retesting agreed separately.
Is the free AI security questionnaire a technical assessment?
The website questionnaire is an initial self-check based on the answers provided. It does not inspect your tenant, verify a control or test an agent. A technical engagement requires agreed systems, evidence, access and deliverables. Use the self-check to organize concerns, then scope the review needed to investigate them.
What affects AI security consulting cost?
There is no published rate card: the assessment is quoted as a defined engagement after the scoping conversation. The scope depends on tools and workflows, users and data sources, available evidence, tenant complexity and the depth of authorized testing. Include report, workshop and validation requirements in the quote. Remediation, policy rollout, product licensing and ongoing reviews should be identified separately rather than assumed included in the initial assessment.
Who handles support and escalations during the assessment?
The scope agreement names the NetSys lead and the person on your side who makes decisions, and it sets how findings that should not wait for the report are raised, such as content shared far more widely than intended. Content owners approve any access change before it is made. After the assessment, implementation is scoped separately, and managed clients' day-to-day requests continue through the help desk, staffed seven days a week from 4 a.m. to 11 p.m. Eastern.
Sources and technical references
- Microsoft: access controls and Copilot deployment considerations
- Microsoft: a governed data foundation for Copilot
- Anthropic: Claude Cowork architecture overview
- Anthropic: custom connectors using remote MCP
- Anthropic: Microsoft 365 connector security guide
- Anthropic: what is the Enterprise plan
- Anthropic Privacy Center: commercial data and model training
- Anthropic Privacy Center: how long organization data is stored
- Anthropic Privacy Center: certifications (SOC 2, ISO 27001, ISO/IEC 42001, HIPAA-ready)
- Anthropic: Claude Security
- OpenAI: enterprise privacy, training and retention commitments
- OpenAI: ChatGPT Business and Enterprise plan comparison
- OpenAI: setting up SSO for ChatGPT Business
- OpenAI: managing multi-factor authentication
- OpenAI: managing apps and plugins in a workspace
- OpenAI: connecting custom MCP servers in ChatGPT
- OpenAI: data sharing and privacy in ChatGPT Business
Guides on this topic
- Plan a Copilot rollout after readiness decisions
- Review data-protection control requirements
- Define permissions and approvals for an AI agent
- Scope a workflow and its human decisions
- Use the initial AI security self-check
- Prepare practical AI usage guidance
- AI governance consulting
- ChatGPT HIPAA compliance
- Copilot oversharing: the permissions to fix first
- Shadow AI and how data leaks through it
- AI governance framework and checklist for small business
- AI automation for Greenwich, CT firms
- Claude Cowork for business: setup and security checklist
- Is Claude Cowork safe for company files?
- Claude Microsoft 365 connectors: permissions before rollout
- Claude MCP security: how to review a connector
- ChatGPT Business security settings and data privacy checklist
- AI data privacy for small business: FAQ
- Claude consulting and business implementation
- ChatGPT Business workspace setup
- MCP server development and secure Claude integrations
- Security configuration reviews with Claude-assisted analysis
- Microsoft 365 security assessment and hardening
Related services
Bring the Claude, ChatGPT or Copilot rollout you need reviewed.
Tell us which products and plans are in use, who administers them, your main concern and the evidence available. We will define access, testing boundaries and the deliverables before proposing the engagement, whether it is a Claude deployment security review, a ChatGPT workspace review or a Copilot readiness review.