Skip to lesson
Exit
Discovery, value mapping & the 90-day pilot1 / 2

2 min lesson

Shadow AI is a sale, not a scandal

Consider this situation: "You discover during discovery that engineers are heavily using a consumer chatbot with company source. How do you play it?" Start with the decision, then the evidence.

Step 1 of 2

In nearly every enterprise you walk into, engineers are already pasting code into consumer chatbots and leaning on unsanctioned assistants. Procurement doesn't know. Security definitely doesn't. A bad rep's instinct is to weaponize this: 'your developers are leaking IP!' Don't. Fear sells one meeting and poisons the relationship.

The reframe

Shadow AI is demand that already exists. Your job is to convert ungoverned usage into governed usage, not to expose it as a scandal. The engineers have already proven the appetite and the productivity case for you. You're replacing a risk with a control.

This is where Cursor's enterprise control plane becomes the pitch, not the features. Ungoverned chatbot usage means no audit trail, no data-handling guarantees, no model allowlist and source code leaving the building. Governed Cursor usage gives the org Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. + ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition., model/MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition./repo allowlists, SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition./SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition./OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition. with SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition., RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition., audit logs and AI-code tracking. Same productivity, now with a paper trail security can defend.

Ungoverned (today)

Source pasted into consumer tools

No audit log, no data residency control

No model or repo allowlist

Security finds out via incident, not dashboard

Governed (with Cursor)

Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. + ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition.; AES-256 at rest, TLS 1.2+

Audit logs + AI-code tracking

Model / MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. / repo allowlists, terminal sandboxing

SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition./SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition./OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition., SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition., RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. under one admin plane

Verified

Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. and ZDRZero Data Retention. A contractual guarantee that the model provider won't store your code or train on it. Press Enter for the full definition. are real Cursor controls. Note one boundary: ZDR does NOT apply when teams bring their own API keys. Know it cold, because a security reviewer will test it.