Daylight Becomes First MDR Provider to Detect AI-Native Threats in Claude Enterprise

Daylight’s MDR service now integrates with Claude Enterprise to detect risky AI usage, investigate AI-native threats, and help security teams respond.

[New York, May 27, 2026] — Daylight today announced that its MDR service now extends to Claude Enterprise, enabling security teams to detect and respond to AI-native threats as AI adoption accelerates across the business.

AI systems are quickly becoming part of everyday work. Teams use Claude Enterprise to analyze data, summarize documents, write code, automate workflows, and connect to other systems. But as adoption grows, security teams are being asked to manage risks they often cannot see: what data is being shared, which skills, tools, or MCPs are being introduced, and whether AI-driven activity creates exposure.

Claude Enterprise is changing that by making more activity data available to customers, including audit logs that show how Claude, Claude Cowork and Claude Code is used across the organization. But visibility alone is not enough. Security teams need that data translated into detections, investigations, and response.

Daylight’s MDR service can now do that for Claude Enterprise.

By integrating with Claude Enterprise, Daylight builds detection coverage on top of Claude’s audit logs and identifies AI-native risks such as unauthorized, risky, or newly introduced MCPs, risky Skills and Plugins, prompt injection attempts, suspicious file or data activity, and unusual AI-driven behavior.

When risky activity is detected, Daylight investigates it through its MDR workflow, correlating Claude activity with identity, SaaS, endpoint, cloud, and business context to determine what happened, who initiated it, what systems or data were involved, and whether it represents real risk.

“AI adoption is moving faster than traditional security monitoring was designed to support,” said Hagai Shapira, co-founder and CEO of Daylight. “Claude Enterprise gives organizations important visibility. Daylight’s MDR service turns that visibility into detection and response.”

The capability is already in use by several enterprise customers.

One example is Miro, an AI-led innovation workspace for team collaboration, whose security team is using Daylight to bring Claude Enterprise activity into managed detection and response from the start.

As Miro rolled out Claude Enterprise, its security team needed to monitor AI activity without slowing adoption. Daylight helped Miro bring Claude activity into its MDR workflow, including detecting newly introduced MCPs and providing the context needed to assess whether they introduced risk.

“As we adopted Claude Enterprise, we wanted to make sure AI usage didn’t become a new blind spot for our security team.”  Mark Strande, CISO, Miro. “Daylight helped us bring Claude activity into our MDR workflow, giving us visibility into AI-native risks and the context to investigate them.”

This capability is available today as part of Daylight MDR for Claude Enterprise, using Claude activity data exposed via the Compliance API. As AI platforms expand their logging and telemetry capabilities, including OpenTelemetry support, Daylight will extend coverage to additional AI activity such as prompts, tool calls, Skills, and agent workflows.

Daylight expects similar auditability to become standard across enterprise AI platforms, including ChatGPT and Gemini, and will continue expanding detection and response coverage across the AI systems organizations rely on.

‍