← AI inventory

Cursor

Anysphere · Coding · Confirmed · catalog cursor. Seen by 3 lanes through 3 findings.

Policy · none set
Policy changes re-score this app on the next sync, which starts right away.
Combined score
58
High 48 from the strongest lane + 10 for 2 more
People
7
Distinct identities across every lane
Seen by
3
Endpoint, Source code, Vendor account
First seen
Aug 15, 2026
Last seen 2 h ago
endpointsource-codefixturecoding-assistantcorroboratedvendorcursorsanctioned-accountexternal-memberssanctioned
Evidence

Where it was seen

Strongest finding →
Endpoint
Medium48

2 devices, 2 accounts

Devices
2
Accounts
2
Processes
1
Extensions
0
2 people · 11 h agoOpen finding →
Source codeGitHub (demo)
Medium31

1 repo

Repos
1
Packages
0
Keys in code
0
Public repos
0
0 people · 27 h agoOpen finding →
Vendor accountCursor (demo)
Medium31

6 seats, 1 external, 246 USD via Cursor (demo)

Seats
6
External
1
API keys
0
Spend 30d
$246
6 people · 2 h agoOpen finding →
Next steps

Recommended actions

  1. 01
    Cursor trains on data unless a business tier or opt-out is used. Verify which tier these users are on.
    EndpointSource codeVendor account
  2. 02
    Cursor is installed as a desktop app on 2 devices. If it is not approved, block it with App Control for Business or an attack surface reduction rule, and deploy the sanctioned alternative through Intune.
    Endpoint
  3. 03
    Device telemetry names the exact machines and accounts reaching api2.cursor.sh. Use it to target coaching rather than blanket blocks.
    Endpoint
  4. 04
    Cursor was seen only on endpoints, not in Entra or network discovery, so it may be used offline or from unmanaged networks. Check the device list for VPN gaps.
    Endpoint
  5. 05
    Cursor is configured for this codebase. Set a policy on AI coding tools: which are approved, whether repository context may leave the company, and whether generated code needs review flags.
    Source code
  6. 06
    1 seat belongs to addresses outside the company in Cursor. Remove them or move the account to SSO with domain verification so only directory identities can hold a seat.
    Vendor account
Who

People

PersonDepartmentSourcesSeen bySign-ins · 30 d
Frank Li
[email protected]
n/a
Device telemetryVendor seat
Endpoint · Vendor account0
Alice Wu
[email protected]
n/a
Vendor seat
Vendor account0
Erin Diaz
[email protected]
n/a
Vendor seat
Vendor account0
frank (personal)
[email protected]
n/a
Vendor seat
Vendor account0
[email protected]
[email protected]
n/a
Device telemetry
Endpoint0
Mia Chen
[email protected]
n/a
Vendor seat
Vendor account0
Oscar Ruiz
[email protected]
n/a
Vendor seat
Vendor account0
Vendor

Policy notes

Trains on data
Configurable
Enterprise tier
Available
Org policy
None set

Privacy mode disables training; sends code context to third-party model providers.

Lanes

Score by source

Each lane scores its own evidence. The combined score takes the strongest lane and adds five points per additional lane, capped at 100.