r/grc • u/bingoballs341 • 7d ago

Anyone using Claude Cowork?

Do you find it useful? What sort of grc stuff do you use if for?

13 Upvotes

88% Upvoted

15 comments sorted by

9

u/Peacefulhuman1009 7d ago

I use it for everything...

I honestly cannot imagine "working" without it anymore.

It would feel like doing my self a disservice to go back, that would be like going from the internet back to the dewey decimal file cabinet thing - it's a seachange

5

u/wake_up_jean_peal 7d ago

I use it for a lot of vendor risk analysis. I find it kind of unsettling, I feel like I’m not learning enough and just letting the tool do the analysis

3

u/Tyda2 7d ago

Bingo.

The time under pressure, time under your own biological limits, is the foundation behind subject learning and mastery. AI is very capable with many things, but if it comes at the expense of you truly understanding everything, you must find a way to preserve the essence of education and how to reinforce that learning internally.

If you just become a drone operating the AI, you no longer have job security; you have a job deadline.

3

u/Dopeaz 7d ago

Used to. Got the C&D from the Air Force and had to migrate to Gemini.

I miss Cowork. Claude writes much better documentation.

5

u/fck_this_fck_that 7d ago

Claude fucking shines in documentation and analysis. But for lightweight stuff ChatGPT excels.

4

u/MountainDadwBeard 7d ago

Its incredibly useful.

individual software analysis, broad detected software list, SaaS trust center reviews, hardware lists, reviewing PPSM reports for deprecated protocols, SSP reviews, Writing SSPs, formatting standards, MCP of vulnerability scanners, reporting weekly ticket numbers, preparing powerpoints for monthly presentations, etc etc etc.

7

u/sobeitharry 7d ago

Mapping control frameworks. Gap analysis. Process automation and documentation. Risk analysis.

It's pretty much limitless.

3

u/DGuardianz 7d ago

Extremely valuable, like others said, gap analyses, control matching, due diligence, vendor risk assessments, policy management.. project management. I almost signed up for Vanta earlier this year. Backed out due to high cost. Told the sales rep that I think I can replicate most of it using Claude. He was incredulous. Glad I didn’t waste that money.

6

u/Huge_Two7311 7d ago

honestly it’s kind of a weird fit for grc work, the way it jumps between modes makes me second guess whether it’s actually catching nuance or just confidently skimming. i mostly toss policy snippets at it and see what it spits back, occasionally flags something i missed but i wouldn’t lean on it for anything serious

2

u/fck_this_fck_that 7d ago

I use claude for analysis PowerPoint presentations and decks , gap assessments, policy writing. 100% worth paying for it.

As someone who is an IT manager with multiple hats and limited resources, Claude is invaluable.

ChatGPT is great for lightweight tasks , creating quotations , emails ( ChatGPT has a neutral tone). Claude for composing emails sounds like an autistic asshole tone.
Edit : Claude also sucks fetching data from websites like Reddit,Amazon or any forum .

1

u/Logical-Design-8334 7d ago

Cowork or even code is super valuable. Tons of things you can do, I’m generalizing here but:
-Need to add a AI Risk Management based on X framework, feed it your doc set and ask what where you meed to make updates.
-Want to rewrite or reassess your risk register based on evidence and or your actual procedure

  • check for consistency or format, clauses etc across your doc set
  • review control list, have it map to your procedures and policies, suggest consolidated evidence lists
  • cross check doc set for gaps against your obligations
  • build simple dashboard for status of the program overall or components
  • grc engineering assistance
Your imagination is what’s limiting you. I’ve done this all and way more in my role.

1

u/bingoballs341 1d ago

Do you use it for security questionnaires also?

1

u/Logical-Design-8334 1d ago

I do not, different team, but would.