Cursor Enterprise: Security Hardening

Responsibility is split. Cursor builds, secures and operates the platform, and you decide how to configure and adopt it for your environment. Cursor's hardening page covers the controls on your side.

A security review needs evidence for the second row as well as the first. A Trust Center report answers what Cursor does. It says nothing about whether your org enforced Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. or which run mode your developers use today.

Start with the admin quickstart on Cursor's hardening page, 12 steps it says to do first. They begin with the controls that keep your code out of training and bound what agents can do. Then they move to steering, identity, model access, audit and encryption, and the last step covers Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition..

1. 1Enforce Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. org-wide, so members can't turn off Privacy Mode or its zero data retention commitments for Cursor-routed models.
2. 2Set the org Run Mode policy to Auto-review (not Run Everything) and turn on sandboxing.
3. 3Distribute hooks for enforcement and logging across the team.
4. 4Apply network allowlisting and exclude Cursor domains from SSL inspection, on every Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. proxy profile too. Set Cloud Agent network egress if you use Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition..
5. 5Set a Rules baseline for steering, knowing that rules are non-deterministic.
6. 6Govern plugins and MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. servers by reviewing what they install and approving trusted sources.
7. 7Add `.cursorignoreA file listing paths Cursor must never index or read, kept separate from .gitignore. Press Enter for the full definition.` entries for secrets and regulated paths.
8. 8Lock identity with SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition., SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. and Allowed Team IDs (MDM). Restrict extensions, set an install cooldown with optional signature verification, and keep clients on a supported version.
9. 9Decide which models your organization allows and restrict the rest. Restrict personal API keys (BYOK) if you rely on Cursor's ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. agreements.
10. 10Review audit logs periodically and stream them to your SIEM.
11. 11Enable CMEK for Cloud Agent data when your compliance program requires customer-managed keys.
12. 12If you use Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition., apply its recommended configuration: an allowlist network policy with Apply to MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. servers, Enforce Auto-review with team rules, Execution on Local Computer set to Never allow, and Action Recording.

Steps one and two set org-wide policy. Once Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. is enforced, members can't turn it off, and team Run Mode settings take precedence over individual and project configuration. Cursor doesn't explain the rest of the order. Its runtime table suggests why hooks come third: Auto-review sends what it can't sandbox to a best-effort classifier, and Cursor says to combine it with hooks.

Identity comes eighth, which may look backwards if your hardening plans usually start with SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition.. Our reading is that Allowed Team IDs and SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. do more once a policy stands behind the login. Allowed Team IDs block personal accounts on corporate devices so Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. always applies, and SCIM automates deprovisioning. Roll out SSO first and you get centralized sign-in to an org where nothing is enforced yet.

Two failures are worth planning for. In one, a control works exactly as specified while people quietly route around it. In the other, a control has stopped running, and Cursor lets the action it guarded go ahead with only a log entry.

SSL inspection is the clearest case of routing around. Cursor's network docs say inspection in the path often causes timeouts, slowness or errors in Agent, and they call it one of the most common deployment blockers for enterprise customers. A developer reads that as a broken tool and looks for a way around it. Cursor's hardening page tells you to exclude its domains from inspection so users don't turn security off to make Cursor work. An exception made in a hurry can be wider than one you'd write on purpose, and nothing removes it when the ticket closes.

The quieter failure is a hook that has stopped enforcing anything. Hooks fail open by default, because failClosed is false unless you set it. A secret-scanning hook that crashes, times out or exits with an error code other than 2 lets the action it was guarding go ahead. Permission hooks such as beforeShellExecution are stricter on one point: invalid JSON blocks the action even with failClosed off.

Don't respond by setting failClosed: true on every hook. Set it on the hooks you'd describe to an auditor as controls. Leave logging hooks fail-open, because a broken logging hook that blocks every action costs your team more than a gap in the log. Dashboard-distributed hooks don't take per-hook options such as failClosed, so a hook that must fail closed belongs in a hooks.json file, distributed through MDM or committed to the repository.

These are the hard boundaries on agent behavior. Cursor's hardening page says steering belongs with them, never instead of them. Set them before agents work on real repositories.

Auto-review is a compromise, and Cursor's run modes page says it is not a security boundary, because the classifier can make mistakes. Run Everything drops review entirely, with no sandbox and no classifier, so a destructive command or a prompt injection can run before anyone sees it. Approving every action sounds safer but breaks down in practice, because agents take many steps per task. For a command that must never run, use a hook that denies it, with failClosed set so a crashed hook blocks it too.

Run Modes apply only to local agents. Cursor's run modes page says Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition. run inside their own dedicated machine and never ask for approval. Cursor's Cloud Agent security overview names the risk: a prompt injection could try to make an agent send code to an outside host. The first defense it lists is network egress controls, and it suggests hooks for deeper defense. The hardening page's runtime table also lists OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition. tokens, which federate Cursor-managed Cloud Agent VMs into AWS, GCP, Azure or custom OIDC verifiers with short-lived JWTs instead of long-lived cloud keys.

.cursorignore blocks Agent and Tab from the files it lists and keeps them out of @ mention references. Output from a shell command or an MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. server is outside its reach, so approvals and file permissions cover the rest. Cursor also warns that complete protection isn't guaranteed, given how unpredictable LLMs are.

Identity controls decide who signs in, from which device and network, and which extensions and client versions they run. Data controls decide which models see your code, how Cloud Agent data is encrypted and which repositories Cursor works with.

• SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. and SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. centralize authentication and automate user deprovisioning.
• Allowed Team IDs (MDM) block personal accounts on corporate devices, so Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. always applies.
• Tenancy restriction has a TLS-terminating proxy send x-cursor-allowed-tenants, so requests from your network work only for the organizations and teams you list. See tenancy restriction.
• Allowed Extensions allowlist trusted publishers, and any entry blocks the rest unless you add "*": true. An install cooldown defers installs and updates until a marketplace version has been public for a set number of hours, with optional signature verification.
• Supported versions keep clients current, with updates managed through the UpdateMode MDM policy.
• Workspace Trust (MDM) opens untrusted folders in restricted mode, which limits AI features. Use it for untrusted trees, not day-to-day repos.

The install cooldown is the item to argue for internally, because the uploads it defends against are short-lived. A malicious version goes up, gets installed somewhere and gets pulled. If installs wait until a version has been public for a set number of hours, your fleet never sees the versions removed inside that window. The cost is that legitimate updates arrive late.

Keep Workspace Trust narrow. Enforced across the board, it opens day-to-day repos in restricted mode, which limits AI features, and your team can't use the tool you paid for properly. Cursor's hardening page reserves it for untrusted trees.

Among the data controls below, settle BYOK before a security review, because it decides whose agreement governs zero data retention.

• Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. is on by default for Enterprise teams. Enforce it org-wide so members can't turn it off. Exceptions apply under BYOK and for models with provider retention.
• Personal API keys (BYOK) should be restricted, because with your own keys zero data retention is subject to your agreement with the model provider, not Cursor's.
• CMEK encrypts Cloud Agent data with your own key when your compliance program requires customer-managed keys.
• Model access approves specific models, and models outside Cursor's ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. agreements need admin approval. Protected Git Scopes lock a Git organization, group or namespace to your Cursor organization, so only your teams can use its repositories with Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition., automations and BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition..
• A repository blocklist makes Cursor refuse to work with the repositories you list. The hardening page says it keeps them out of Cursor "entirely", but Cursor's model and integration docs say the blocklist applies to the editor and CLI, not to Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition., Automations or BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition..

Most enforcement levers assume a managed fleet and an Enterprise plan. Org-wide policies, MDM-distributed hooks and SIEM streaming live there. At five hundred people, lean on them, because two dashboard settings that cover everyone do more than any number of local conventions. A small team without a managed fleet gets the per-user controls, such as Run Mode defaults and .cursorignore, plus whatever it can check into the repository.

At that size, the repository is the fleet-management system. Hooks committed in .cursor/hooks.json run for everyone who opens the project as a trusted workspace, and the Run Mode expectation is a written norm that nothing enforces. That is weaker than MDM. It holds at five people mostly because five people notice when someone works differently. Move to org-wide policy before headcount forces it.

Review what agents produce, check that the controls hold and keep a trail security can read. The runtime controls above bound what an agent may do while it runs, and reading what it produced before production is a separate job. Cursor recommends these practices for this layer.

Cursor's monitoring list also includes OpenTelemetry Export, an Enterprise feature that streams usage and activity telemetry to your own collector over OTLP. It runs separately from audit-log streaming to your SIEM.

Compliance logging needs hooks because the audit log records authentication and admin events and leaves out development activity. Compliance and monitoring covers what to capture with hooks instead.

For Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition., that allowlist needs one more switch. Cursor's release notes for the week of October 12, 2026 say Cloud Agents connect only to plugins and MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. servers on the Team list once an admin turns on Team list enforcement.

Sort it by symptom before you change a setting. Network problems show up as slowness and timeouts across everything at once. A hook problem is narrower: one class of action fails, or a control quietly stops applying while the rest of Cursor works.

On the network side, the certificate is the fastest signal. Run curl -v https://api2.cursor.sh |& grep -C1 issuer: and read what comes back. Amazon RSA means you are reaching Cursor, and your proxy vendor's name means inspection is in the path. The network configuration page has the rest of that ladder.

For hooks, the Hooks tab in Customize and the Hooks output channel show which hooks loaded and which threw errors, and that is where a fail-open failure becomes visible. Cursor reloads hooks.json on save, so restart Cursor if a change doesn't take. Project hooks resolve paths from the project root and user hooks from ~/.cursor/, a mismatch the docs list among the first things to check.

If a hook runs but never blocks, check its exit code. Exit code 2 from a command hook blocks the action, the same as a deny in its JSON output.

Model restrictions can also turn off Auto-review. Its classifier runs on small Cursor-managed models, and blocking Claude 4.5 Haiku can disable Auto-review even when the team's Run Modes include it. Members then use Allowlist instead. If Auto-review is grayed out, enable Claude 4.5 Haiku under Models in Team Settings, fully quit and reopen Cursor, then check Approvals & Execution again.