How Cyera rolled out Claude Enterprise and Cowork to 1,500 employees: enterprise case study
Figure 1 — the sequence this article argues for: map access, re-scope, provision, instrument the stop points, ship metric definitions as code, report catch rates, name a graduation owner. Adapted from Anthropic's Cyera case study and the companion Q&A; the ordering is mine. If the diagram does not render, read it as that linear list.
Cyera's product exists to answer one question: who in this company can reach which sensitive data? Then Cyera handed roughly 1,500 employees a model that inherits every permission its user holds, wired it to 40 tools, and let it draft replies, pre-review vendor NDAs and file GRC tickets (Anthropic).
The number everyone quotes from that rollout is 88%. The number that made it approvable is 4% (Anthropic).
A disclosure first, because most coverage will bury it: every figure below is vendor-published. Two documents — Anthropic's customer story on Cyera and a companion Q&A with Joe Tustin and Steve Klementowski, both undated, both © 2026 — and nothing else. No independent audit, no control group, no pre/post workflow measurement, no error rates for any agent described. That does not make the design decisions unreportable. It makes the outcome claims unverifiable, and the design decisions are the transferable part.
A shorter second disclosure. Six citations here — Laumer and colleagues, Zeng, Ingaldi and Dziuba, Uusiautti, Mutiganda, McNamara — reached me as metadata with no retrievable full text. I have set them out in a labeled method note near the end and drawn no figure from any of them (Anthropic). Where a number appears in the body, it comes from Anthropic's two documents or the peer-reviewed productivity studies.
The 88% Headline Is A Usage Metric Doing A Value Metric's Job
Cyera reports 88% weekly active usage of Claude across roughly 1,500 employees, "including the newest hires" (Anthropic). Read the sentence closely, because it is broken: the outcome line reads "has reached between 88%" — a range was edited out and never replaced. No measurement window, no baseline, no definition of what makes a week active. You are handed a numerator with the denominator removed.
The Q&A adds a timeline: 88% arrived "just a month or so after roll out," in the interviewer's framing, which the interviewees did not correct (Anthropic Q&A). A month to 88% weekly active is remarkable if true. It is also not a number anyone outside the room can check.
What 88% weekly active actually measures is the fraction of provisioned seats that touched the product inside a seven-day window. That is a plumbing metric. It tells you provisioning worked and the bookmark survived month one — not that anyone's queue got shorter (Anthropic).
There is a serious literature on why plumbing is not adoption. Laumer and colleagues' study of enterprise social software treats not using as a deliberate, reasoned act rather than an absence to be fixed with training: the visibility of your activity to colleagues and superiors, self-presentation risk, a perceived workload cost set against an unclear benefit. I assert no effect size from it — the full text was not retrievable — but the mechanism is the argument, and it lands harder on a security company, where pasting a customer record into a chatbot is a career event, not an embarrassment. The population most alert to that risk self-selects out of visible use, and it is the population whose usage you would most want to measure.
The cost of confusing the two numbers is concrete. Approve a budget on 88% weekly active and you have bought evidence that people can log in. Approve it on four named workflows — channel triage, NDA pre-review, DM drafting, GRC ticket assignment — and you have bought evidence that a specific queue got shorter (Anthropic). Different purchases, different prices. Only the second survives a CFO asking what she gets for the seats.
Two products, two permission models, and most coverage conflates them. Claude Enterprise is Anthropic's organisation-wide tier, sold on admin controls and central provisioning rather than model access alone (Anthropic Claude Enterprise). Cowork is the shared workspace surface where the model reaches those 40 tools — Slack, Salesforce, Asana, Google Drive, Notion — through MCP connectors, plugins and skills (Anthropic Cowork); Claude Code stayed with R&D (Anthropic). Chat and a shared agentic workspace do not carry the same governance properties, and the rollout only makes sense once you hold them apart.
Agents Inherit 100% Of A Permission Set That People Use 4% Of
The load-bearing statistic arrives as a throwaway line of Cyera's own research: across 2.4 million workers, employees typically access only 4% of the data they are granted. The case study's gloss is one sentence — "agents can use whatever their permissions allow" (Anthropic).
Run the arithmetic. A person touches a 4% surface. An agent inherits a 100% surface. That is a 25-fold expansion of exposure the moment you put a model behind a login, and it happens silently, because the agent is not doing anything the person could not do. It is doing all of it (Anthropic).
Which is why the interesting section of this rollout is the part before the first seat was switched on. Data-mapping of which systems Claude connects to, which of those hold production data, how observability is kept. Then the line that belongs in every board deck on the topic: "Cyera on Cyera." They pointed their own product at their own Snowflake estate, mapped who could reach which tables, and re-scoped permissions before company-wide analytics opened (Anthropic Q&A).
A security vendor eating its own cooking. It is also the only sequencing that works, and a trap for anyone copying it naively. Re-scope the grant to something close to the 4% people actually use, and every agent you build dies on day one. The agent's value proposition is touching the 96% a person will never open; leave the grant at 100% and you have handed a third-party model the estate (Anthropic). Re-scoping is not a workstream running alongside an agent programme. It is the precondition.
So the strategic framing: a 1,500-seat agent rollout is not an AI project with a security review attached. It is an access-scoping project that happens to end with a chat window. Cyera could run that project in-house because access-scoping is the product they sell. Most companies reading this case study cannot, and that asymmetry is the single largest reason the playbook will not port cleanly.
The structural point underneath it — that transformation is process redesign, not a software purchase — is Zeng's, a method reference rather than an evidence source rather than a figure I am leaning on (see the method note). Which means the variable worth measuring is not how many logins shipped. It is which of the 40 connected tools had a workflow re-architected around the model, and which just got a chat box bolted on (Anthropic).
The Terminal Was The Barrier, And Seventeen Days Only Measured Switch-On
The strongest material in either document is where Cyera's first approach failed.
Their instinct was the engineer's instinct: the model is the unlock, so teach people the model. Engineers ran sessions teaching GTM leaders to use the terminal. Result, stated plainly: "most stalled at the command line" (Anthropic).
Believed: access to a frontier model is the binding constraint. Measured: the interface was. Not capability, not permission — the shell prompt.
The reversal shaped the architecture. Claude Code for R&D; Cowork for everyone else, with the 40-tool surface living on the Cowork side (Anthropic). The weeks spent teaching a CLI to people whose job is not a CLI were not free. They were a paid-for experiment that produced a negative result, and the negative result is the most reusable artifact in the story.
A second decision sits in the same paragraph. Cyera considered a home-built wrapper and chose not to build it. Tustin's framing from the other direction — "saying no AI is not a strategy" — makes the same argument: blocking produces shadow AI outside the perimeter, and a governed sandbox beats a perimeter you cannot see across (Anthropic Q&A).
Which means the instrumentation question worth stealing is not "what is our adoption rate." It is: where do people stop? Cyera found the stop point at the command line, and finding it cost weeks plus an architecture change. Plan a rollout without instrumenting the abandonment point and you have planned to discover it the expensive way.
Now the number quoted as the achievement: company-wide Cowork rollout in 17 days after a brief pilot (Anthropic). Seventeen days is a deployment number, and it is the cheapest line in the enablement budget, because switch-on is the cheap half.
Look at what ran alongside it. Livestreamed enablement the two documents describe differently — "18 hours" in one telling, a day-long session in the other — plus twice-weekly office hours, 20 department-specific sessions, someone from AI engineering or data on call through the rollout, and an executive all-hands (Anthropic Q&A). Twenty department sessions plus twice-weekly office hours plus a 24/7 rotation is not a 17-day project. It is a 17-day switch-on with an unbounded enablement tail, staffed by the same AI engineering team that was simultaneously re-scoping permissions. That is the real cost line, and it is the first one cut when a rollout gets approved.
The manager-led reading of why those sessions matter — that an employee's relationship with their immediate supervisor moves satisfaction more than the tool's features do — is Ingaldi and Dziuba's, a weak proxy from a different sector and a method reference, not a number I am leaning on (see the method note).
The demand signal is real, at least. Marketing runs 1,000+ events a year, and a 3,500-person Salesforce list for a New York event went from 105 to 400+ confirmations — "overnight" in the case study, "in one day" in the Q&A. That is at least a 3.8× lift (Anthropic; Anthropic Q&A). What it measures is appetite for a room with lunch in it, not competence with an agent.
Then the detail that should downgrade your confidence by a notch. The case study's bullet list says Cyera runs "seven" homegrown MCP servers. Tustin's quote in the same story says "four or five," and Klementowski in the Q&A says "four or five" (Anthropic; Anthropic Q&A). Two counts of one fact inside a single vendor's own material. Small thing — and exactly what you find when numbers are recalled in interviews rather than pulled from a system of record. It is the reason to read 88% as a directional claim rather than a measurement.
One deployment decision the headline skips: model choice. Tustin frames it as hands-on testing plus knowledge-cutoff recency, settling, as reported, on Claude Opus 5 (Anthropic Q&A). Boring, defensible, and the right kind of boring — training-data recency is a procurement criterion you can verify, unlike a leaderboard.
The Semantic Layer Is Necessary And Provably Insufficient
Cyera documented 40 Snowflake tables by department — the Q&A hedges to "30 or 40" — with one schema per department controlling which tables each department sees, plus role-level security preventing anyone from reading data outside their region (Anthropic Q&A).
On top of that, the shared metric definitions — what "ARR" and "monthly active users" mean — ship as a Claude skill embedded in every team plugin and fire before any Snowflake query executes.
That last choice is the most technically interesting thing in the rollout, and it generalises. Treat it as an ablation you can reason about directly: remove the skill, and two teams querying the same table with near-identical SQL get the same rows and compute different metrics out of them (Anthropic Q&A). The failure is silent, it looks like a correct answer, and it is the most common way enterprise analytics rots. Packaging definitions as an executable artifact that runs ahead of the query is a real fix for a real problem, and it is the piece I would copy first.
It is also not enough, and Cyera says so. Klementowski: "We haven't quite cracked context management in Cowork yet." Dashboards proliferate. Then the sentence that belongs on the front of every semantic-layer pitch deck: "even with a great semantic layer the interpretation of data can be off" (Anthropic Q&A).
A semantic layer bounds the space of wrong answers. It does not eliminate them. The residual is real: definitions right, join right, and the analyst still read the trend backwards.
Every Minutes-Saved Number Sits Behind A Review Step Nobody Measured
The productivity claims are what get screenshotted, so read them as a set. They share one structural feature.
Ask Claude channel triage fell from five or six hours a day to roughly 30 minutes, driven by a scheduled task that polls the channel roughly every 30 minutes and drafts replies for the owner's review (Anthropic). A DM triage agent saves Klementowski up to 30 minutes per run. A legal Cowork plugin shipped with 20 playbooks on day one to pre-review inbound vendor NDAs, with a lawyer reviewing and sending. Asana gatekeeper agents block tickets missing Figma files or URLs before submission, saving one marketer "maybe 12 hours a week" — hedged inside the quote itself (Anthropic Q&A).
The common shape: the agent takes the repetitive first pass, a person reviews before anything ships. Every time. No exceptions anywhere in the material.
That shape makes the numbers simultaneously credible and unverifiable. Five or six hours down to 30 minutes is roughly a 90% cut in triage time, not in resolution time — the owner still reads every draft (Anthropic). So the number that governs the business case is not time saved but the review-catch rate: of the drafts a human reviews, what fraction does she send unedited and what fraction does she rewrite? A 90% triage cut at a 2% rewrite rate is a different product from the same 90% at 15%. You get the first number twice in these documents and the second number zero times.
For an outside bound, Noy and Zhang measured professional writing tasks at 40% faster and 18% higher quality — roughly the ceiling the literature supports for a well-scoped single-document task, which makes it the right comparison class for the NDA pre-review and the RFP first pass (Noy and Zhang (2023)). Twelve hours a week is 30% of a 40-hour week recovered on one workflow. Possible — and precisely the figure that halves when somebody puts a stopwatch on it instead of asking the person who benefits.
Target The Novices, Not The Org Chart
The two best-evidenced results in the generative-AI productivity literature point the same way, and neither is visible in a 1,500-seat deployment plan (Brynjolfsson, Li and Raymond (2023); Dell'Acqua et al. (2023)).
Brynjolfsson, Li and Raymond studied customer-support agents and found a 14% average productivity gain from an AI assistant. The average is the least interesting part. The gain was 34% for novices and low-skilled workers, putting the ratio between the mean and the bottom of the experience distribution at roughly 2.4× (Brynjolfsson, Li and Raymond (2023)). The mechanism is substitution for context people have not yet accumulated: the model supplies the retrieval and the phrasing a twenty-year veteran does not need. That has a direct consequence for seat allocation. Your return concentrates in employees with the most headroom — who are, close enough by definition, the ones with the least standing to request access, the least confidence in the tool, and the least political capital to survive being seen using it.
Dell'Acqua et al. supplies the counterweight. In a field experiment with Boston Consulting Group consultants, people using AI completed 12.2% more tasks, finished 25.1% faster, and produced work rated 40% higher in quality. Then the authors did the thing most adoption studies skip: they split tasks by whether they fell inside or outside the model's capability frontier. On tasks outside it, consultants using AI were 19 percentage points less likely to reach a correct answer than consultants without it (Dell'Acqua et al. (2023)). The jagged frontier cuts both directions at once, and the people most confident in the tool stand nearest the edge. A rollout reporting only the first three numbers reports the half of the distribution that flatters it.
Put those together and the blanket rollout looks like an allocation error. You are spending 1,500 seats uniformly across a population whose return is wildly non-uniform: plus 34% at one end, minus 19 points at the other (Brynjolfsson, Li and Raymond (2023); Dell'Acqua et al. (2023)). Role-targeted expansion is not a softer version of the blanket rollout. It is the version where the arithmetic closes.
Cyera's own anecdotes sit exactly where the literature predicts. A hire three weeks in gave a 60-page RFP a first pass — maximum headroom, minimum accumulated context, precisely the 34% population (Anthropic). The executive-support agent that stops when its owner closes her laptop is the other end: maximum context, minimum headroom, least for the tool to add.
The contrarian conclusion: the employees who would gain 34% are the least likely to ask for a seat, and the ones who ask first are the ones with the most context and the least gain (Brynjolfsson, Li and Raymond (2023)). A rollout that follows demand allocates seats backwards, and nobody notices, because the people who got them are delighted.
The Real Milestone Isn't Adoption. It's Graduation.
The most honest thing in either document is the thing Cyera names as its next step.
"Graduation": an agent one person uses becomes something the business can rely on without them, through "traditional software engineering gates." The trigger for naming it is an executive-support agent that stops working when its owner's laptop is closed (Anthropic Q&A).
That single failure mode tells you what most of a 40-tool footprint is. Not software. A person-shaped artifact — a script with a login, and a person's attention as its scheduler (Anthropic). Roughly 1,500 employees' worth of automation currently runs on 1,500 laptops, and the moment one of those employees boards a plane, so does the automation.
There is an architecture literature for this now. A 2025 survey of self-evolving agent systems sorts designs into centralised manager–follower structures and decentralised peer networks, and flags the centralised shape as a single-point-of-failure risk for the whole system (arXiv:2508.07407). Cyera's fleet is centralised in exactly that sense: the human is the manager, the agents are followers, and the manager's laptop is the node. When the executive-support agent dies with its owner's lid, nobody has an architecture diagram that shows it, but there are roughly 1,500 of them on the org chart.
Graduation also has a protocol shape, and the case study never names it. Cyera's agents reach 40 tools through MCP servers — the Model Context Protocol, which governs how an agent connects to internal tools and data. When the Asana meeting-runner agent polls everyone else's agents before a meeting, a second protocol does the work: agent-to-agent coordination. The Linux Foundation hosts both, and reports A2A's supporting organisations growing from more than 50 to over 150 inside a year, with the core repository past 22,000 GitHub stars and production SDKs in five languages (Linux Foundation (2026)). Two protocols, two threat models. MCP is the one your permission re-scoping already covers. A2A is the one most DLP stacks were never built for, because the traffic is agent talking to agent inside your own perimeter, with no human in the middle to prompt.
Whether any of this transfers is a methods question, and the two papers that speak to it — Mutiganda's critical-realist case work and Uusiautti's point that leader-perceived and employee-perceived success diverge — are method references here, not evidence (see the method note). Neither supplies a figure in this piece.
Method references (not relied upon for any figure). The Cyera figures here come from two Anthropic documents. Six further works are cited only as framing or method, never as a measured result, and I could not retrieve their full text: Laumer, Shami, Muller and Geyer (2017) on deliberate non-use of enterprise social software; Ingaldi and Dziuba (2020) on supervisor effects during change; Zeng (2022) on digital transformation as process redesign; Uusiautti (2016) on perceived success; Mutiganda (2026) on critical-realist case method; McNamara (2026) on vendor/buyer duality. Read them as the analytical scaffolding, not the evidence base.
A Five-Gate Decision Framework, And Where Each Gate Fails
What follows is the sequence I would defend in a design review, drawn from what Cyera did and from where the evidence says the generalisation breaks.
Gate 1 — Scope permissions before provisioning seats. Map which systems the agent touches, which hold production data, and who can reach what. Re-scope first, then provision (Anthropic Q&A). Fails when your fleet needs near-full breadth to be useful — at which point you reduce blast radius another way, because "the agent needs it" is how the estate gets exposed.
Gate 2 — Find the stop point before you scale. Cyera's engineers taught a CLI and watched most of a room stall. Instrument abandonment wherever your interface is (Anthropic). Fails when you instrument clicks instead of outcomes — a stall at the command line and a stall at the first wrong answer look identical in a clickstream.
Gate 3 — Ship metric definitions as executable code. The skill that fires ahead of the Snowflake query is the highest-leverage control in the architecture (Anthropic Q&A). Fails when you treat it as done: correct definitions do not prevent wrong interpretation, as Cyera's own team concedes.
Gate 4 — Report a review-catch rate with every hours-saved figure. A triage reduction without a rewrite rate is a demo (Anthropic). Ask for both, and print "not disclosed" when refused. Fails when nobody logs edits — the default state of every drafting agent.
Gate 5 — Name a graduation owner on day one. If the agent dies when a laptop closes, it is not infrastructure (Anthropic Q&A). Fails when graduation is deferred: every quarter you defer it, you accumulate automation whose uptime is somebody's calendar.
FAQ: Claude Enterprise, Cowork, and the 1,500-Seat Number
What is Claude Enterprise? Anthropic's organisation-wide tier of Claude, sold on admin controls, security posture and central provisioning rather than model access alone (Anthropic Claude Enterprise). Cyera deployed it across roughly 1,500 employees (Anthropic).
What is Claude Cowork? The shared workspace surface where Claude reaches connected tools — 40 at Cyera, including Slack, Salesforce, Asana and Google Drive — through MCP connectors, plugins and skills (Anthropic Cowork). It is distinct from Claude Code, which Cyera kept for R&D (Anthropic).
How did Cyera reach 88% weekly active usage? By re-scoping data permissions before provisioning, then running a 17-day switch-on with livestreamed enablement, twice-weekly office hours and 20 department sessions (Anthropic Q&A). The 88% itself is vendor-reported and undefined.
What should another enterprise copy first? The permission re-scope, the executable metric definitions, and the human review step in front of every agent — not the seat count (Anthropic).
The inversion is about power, not features. Cyera sits on both sides at once: selling enterprise software into Fortune 500 security budgets while buying somebody else's enterprise AI (Anthropic Q&A). The dual-position observation is McNamara's; everything in the next sentence is my inference. The review Cyera's security team ran on Anthropic is structurally the review Cyera's own buyers will run on Cyera — where the data lives, how long it is retained, whether it trains a model, who can administer what — the same questions pointed in the opposite direction. Nobody publishes that questionnaire. Its existence is the story's actual artifact.
Which is why Tustin's line about shadow AI is the one to end on. "I don't think shadow AI is a bad metric" (Anthropic Q&A). A security company saying that out loud is not a lapse. It is an admission that blocking produces usage you cannot see, and that a governed sandbox is a measurement strategy as much as a control. That posture follows from the 4% number: if people touch a twenty-fifth of what they are granted, the risk was never in the tool. It was in the grant.
The vendor case study's real gift is not the 88% and not the 17 days. It is the three admissions scattered through it — that context management in Cowork is not cracked, that a great semantic layer can still be misread, that an agent stops when a laptop closes (Anthropic Q&A). Copy those three sentences into your own architecture review verbatim. The rest of the document is a press release. Those three are a scope.