An enterprise customer initially reported their entire AI footprint was just Copilot, but a scan revealed Claude was number one, OpenAI second, and Copilot third. Security teams often miss that Claude runs across six surfaces. The first is Claude Enterprise and Connected Apps, where employees use OAuth with Google Drive, GitHub, Slack, and Jira; the audit log shows a connection occurred but not what data entered the prompt. Second, Claude Projects are persistent workspaces holding files across sessions, where a file of test customer records can become reachable without data classification. Third, MCP servers carry credentials or OAuth tokens; public CVEs exist across community implementations, and prompt injection in tool output can hijack the agent. Fourth, Claude Code provides shell access, network egress, and filesystem read/write, including reading .env files and AWS credentials in plaintext. Fifth, Managed Agents run autonomously with standing access, failing hundreds of actions before an alert is read. Sixth, the Claude Platform Console, where API keys and agents are deployed, is the surface where exposure most often starts. There is no CIS Benchmark, NIST mapping, or standard audit checklist built specifically for Claude.