Cursor Enterprise: Security Hardening

Responsibility is split. Cursor builds, secures and operates the platform; you decide how to configure and adopt it for your environment. The table below sorts what Cursor commits to from the levers you configure, so you know which controls are yours to set.

Reviews tend to stall on the second row rather than the first. A Trust Center report answers what Cursor does; it says nothing about whether your org enforced Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. or which run mode your developers are on today.

Cursor's admin quickstart is the order to work in. It starts with the controls that keep your code out of training data and bound what agents can do, then moves to identity, model access and audit. Cursor frames the steps below as the ones to do first.

1. 1Enforce Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. org-wide so members can't disable Privacy Mode or its zero data retention guarantees for Cursor-routed models.
2. 2Set the org Run Mode policy to Auto-review (not Run Everything) and enable sandboxing.
3. 3Distribute hooks for enforcement and logging across the team.
4. 4Apply network allowlisting and exclude Cursor domains from SSL inspection; set Cloud Agent network egress if you use Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition..
5. 5Lock identity with SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition., SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. and Allowed Team IDs (MDM); restrict extensions, set an install cooldown and keep clients on a supported version.
6. 6Decide which models your org allows and restrict the rest; restrict personal API keys (BYOK) if you rely on Cursor's ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. agreements.
7. 7Periodically review and stream audit logs to your SIEM; enable CMEK when your compliance program requires customer-managed keys.

The list works as a sequence, not a menu. Steps one and two are the org-wide switches. Enforced Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. is the stronger of the pair, since members cannot turn it off, and the Run Mode policy is set for the org instead of left to each developer's default. Hooks come third because Auto-review is best-effort by design. It sandboxes shell commands when it can and routes the rest through a classifier, which is why the docs tell you to combine the two rather than pick one.

Identity arriving after the privacy and runtime steps runs against the way most hardening programs are written. The logic, I think, is that Allowed Team IDs blocks personal accounts on corporate devices so Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. always applies, and SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. automates deprovisioning. Both are worth more once there is a policy behind the login. Roll SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. out first and you get centralized sign-in to an org where nothing is enforced yet.

Two patterns come up more than the rest. One is a control that works exactly as specified while people quietly route around it. The other is a control that stopped running, with nothing on screen to say so.

SSL inspection is where the routing-around case tends to start. Cursor's hardening list tells you to exclude its domains from inspection, and the reason it gives is that users otherwise turn security off to make Cursor work. Inspection in the path often produces timeouts and errors during agent runs, which a developer reads as a broken tool rather than a policy decision. Whatever exception gets made to unblock them is usually wider than the one you would have written on purpose, and it stays in place long after the ticket closes.

The quieter one is a hook that is no longer enforcing anything. Hooks fail open by default. failClosed is false unless you set it, so a secret-scanning hook that crashes, times out or returns invalid JSON lets the action it was guarding proceed. The instinct on reading that is to set failClosed: true everywhere, and that is the wrong version of the rule. Set it on the hooks you would describe to an auditor as a control. Leave the logging hooks fail-open, because one of those dying and blocking every action is worse than a gap in the log.

These are the hard boundaries on agent behavior. Steering belongs alongside them, never instead of them. The table maps each runtime control to how Cursor recommends configuring it, so you can set the boundaries before turning agents loose on real repos.

Auto-review reads like a compromise setting because it is one. Run Everything drops the review step, so a destructive command or a prompt injection can execute before anyone sees it. Approving every action instead sounds safer and collapses in practice, since agents take many steps per task. The docs point at hooks for the operations that must never run.

.cursorignore covers indexing, agent reads and context selection. A credential printed by a shell command or handed back by an MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. server sits outside what it filters, so the approvals and file permissions in that row are doing the rest of the work.

Identity and data controls decide who signs in, on which device, which models they can reach and what code is allowed in. Access levers first, then the privacy ones.

• SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. and SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. centralize authentication and automate user deprovisioning.
• Allowed Team IDs (MDM) block personal accounts on corporate devices so Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. always applies.
• Allowed Extensions allowlist trusted publishers; any entry blocks the rest unless you add "*": true. An install cooldown defers installs until a marketplace version has been public for a set number of hours, with optional signature verification.
• Workspace Trust (MDM) opens untrusted folders in restricted mode, which limits AI features. Use it for truly untrusted trees, not day-to-day repos.

The install cooldown is the entry on that list worth arguing for internally, since the uploads it defends against are short-lived by nature. A malicious version goes up, gets installed somewhere and gets pulled. Deferring installs until a version has been public for a set number of hours means your fleet never sees the ones removed inside that window, and the price is that legitimate updates land late.

Workspace Trust runs the other way. Enforcing it across the board opens day-to-day repos in restricted mode, restricted mode limits AI features, and you have then paid for a tool your team cannot use properly. Keep it for trees you actually distrust, which is roughly what the docs say too.

The four entries above decide who gets in. The ones below decide what leaves, and the BYOK line is the one to settle before a security review, because with your own keys zero data retention comes from your agreement with the model provider rather than from Cursor's.

• Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition., enforced org-wide, is on by default for Enterprise; exceptions apply under BYOK and models with provider retention.
• Personal API keys (BYOK) should be restricted: with your own keys, zero data retention is subject to your agreement with the model provider, not Cursor's.
• Model access approves specific models; non-ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. models require admin approval. A repository blocklist keeps sensitive repos out of Cursor entirely, and Protected Git Scopes lock your Git org or namespace to your teams for Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition. and BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition..
• CMEK encrypts embeddings and Cloud Agent data with your own key when your compliance program requires customer-managed keys.

Most of the enforcement levers assume a managed fleet and an Enterprise plan. Org-wide policies, MDM-distributed hooks and SIEM streaming live there, and at five hundred people that is what to lean on, because two dashboard settings that cover everybody beat any number of local conventions. A small team without a managed fleet gets the per-user controls, Run Mode defaults and .cursorignore among them, plus whatever it can check into the repo.

At that size the repo is the fleet-management system. Hooks checked into .cursor/hooks.json reach every clone that opens the project as a trusted workspace, and the Run Mode expectation lives in a written norm rather than an enforced policy. Enforcement is social at that point. That is thinner than MDM, and it holds at five people mostly because five people notice when someone works differently. Make the move to org-wide policy before headcount forces it.

Monitoring closes the loop: review the code agents produce, verify the controls hold and keep a trail security can read. The practices below are what Cursor recommends for that review-and-respond layer.

The controls above bound what an agent may do while it runs. Reading what it produced is a separate job, and that is the gap the pre-production review row fills. BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. and Security Agents are what Cursor points at for that pass, ahead of production.

The compliance-logging row is there because the audit log stops at authentication and admin events, and compliance and monitoring covers what to capture with hooks instead.

Split it by symptom before you change a setting. Network problems arrive as slowness and timeouts across everything at once, which is the easy case to recognize. A hook problem is narrower, with one class of action failing or a control quietly no longer applying while the rest of Cursor works fine.

On the network side the certificate is the fastest signal. Run curl -v https://api2.cursor.sh |& grep -C1 issuer: and read what comes back. Amazon RSA means you are reaching Cursor, and your proxy vendor's name means inspection is in the path. The network configuration page has the rest of that ladder.

For hooks, the Hooks tab in Customize and the Hooks output channel show which ones loaded and which threw, and that is where a fail-open failure becomes visible at all. Cursor reloads hooks.json on save, so restart if a change does not take. Project hooks resolve paths from the project root and user hooks from ~/.cursor/, a mismatch the docs list as one of the first things to check. If one runs and never blocks, check its exit code, because exit code 2 from a command hook is what denies the action.