Cursor

1. 011 seat belongs to addresses outside the company in Cursor. Remove them or move the account to SSO with domain verification so only directory identities can hold a seat.
2. 02Cursor trains on data unless a business tier or opt-out is used. Verify which tier these users are on.

• ●Medium48CursorEndpoint2 people
• ●Medium31CursorCode · GitHub (demo)0 people

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. vendor_org · Sep 14, 2026
   Cursor (demo) (Contoso Engineering): 6 members, 1 admin, 16,483 requests, 246 USD in 30 days
   Detail

   {
     "byModel": [
       {
         "model": "claude-sonnet-4-5",
         "tokens": 50600,
         "requests": 13633
       },
       {
         "model": "gpt-5",
         "tokens": 11400,
         "requests": 2850
       }
     ],
     "settings": {},
     "warnings": []
   }

2. external_member
   [email protected] holds a seat (member) outside the organization's domains
   Detail

   {
     "role": "member"
   }

3. corroboration
   Also found by another lane (mde:cursor)
   Detail

   {
     "findingKey": "mde:cursor"
   }

4. corroboration
   Also found by another lane (repo:giypXj7r_Gc5tatesErdR:cursor)
   Detail

   {
     "findingKey": "repo:giypXj7r_Gc5tatesErdR:cursor"
   }