Cursor for Enterprise

0:01 We can go ahead and maybe introduce ourselves. My name is Noah. I'm on the growth AI deployment team here at Cursor. And I'll be moderating the chat throughout this. So, feel free to drop questions in there. Awesome. And I'm James. I I am an AI deployment manager here at Cursor as well. I'll sort of be running through a bit of a presentation here as well as we'll sort of jump into some of the documentation and and as well as the sort of Cursor dashboard and and functionalities as well.

0:35 Main things obviously for the purposes of today's sessions is really looking at Cursor for enterprise. So, you know, what are the different features that enable you know, large enterprise businesses to get value from Cursor and do it in a you know, safe and secure way and be able to manage you know, thousands of of of Cursor users as well within their organization. Awesome. So, I will just bring up my screen here.

1:15 Cool. Awesome. So, just kicking us off here just to quickly run through a a bit of an agenda for today. As you may have seen on the on the workshop brief as well. First thing we'll cover off is just sort of like general enterprise security and IP protect IP protection. We'll dig a little bit into agent governance as well. So, the functionality that you can apply at an enterprise level to ensure that you know, you can apply guardrails and and and other sorts of functionality around

1:43 agents and how your users are interacting with them. Safe deployment methods. So, some of the functionality that we have around being able to ensure that you know, when you're using Cursor that it's it's not sort of interacting in with your machine in in sort of unsafe ways and you have sort of controls over this as well.

2:02 Some of the features that give you you know, more visibility across your user base as well as just generally sort of how users are getting value and how you can demonstrate ROI from Cursor usage as well. And then lastly we'll just jump jump into a couple of examples of sort of some of our larger customers and how they use Cursor today and we'll sort of leave behind a a few different case studies and things that we've published as well.

2:34 Cool. So, jumping into our first topic here. So, one of the things that I want to cover off is sort of privacy and data governance. So, from a Cursor perspective, one of the things that we really ensure is making sure that you have control over all of your data that is used within within Cursor. So, obviously you're connected to very sensitive systems. You're using you know, a lot of IP within within sort of Cursor and and your ability to sort of build out and maintain code.

3:08 And so, I guess like there are a few different things in terms of data that's being leveraged within Cursor. So, obviously our indexing process, one of the sort of real big benefits of leveraging Cursor is that we are able to programmatically index your code base which ensures you know, faster responses, you know, more efficient token usage and and better like sort of optimized engagements with different LLMs. On our public docs here you can sort of see

3:37 like everything that is sort of happening through this indexing process and sort of what's being stored and what isn't. I guess like TLDR here is that we don't store any raw code as part of this process and everything is sort of obfuscated and and secure to ensure that you know, we're not storing anything that we shouldn't be.

3:57 With our privacy mode enabled, this is obviously a setting. By default, privacy mode is enabled for all of our enterprise customers and this essentially shows that ensures that code is never stored by any of the model providers or or never used for training. We also ensure a zero data retention policy as well. So, all of our model providers that we work with, we have zero data retention agreements with all of them. So, none of this data is is making its way to any of the LLM

4:31 providers as well. There is some nuance to some of this when we start to use cloud agents and you would may have noticed recently with some of our developments in the self-hosted cloud agent spaces well that we you know, allow you to actually sort of host a lot of your cloud agent infrastructure within your own VPC. And this sort of gets past a lot of this as well. But if you are running sort of cloud agents on Cursor hosted infrastructure you can Cursor cloud then

5:03 there is sort of some sort of code passed into the Cursor infrastructure as well. So, just like a good call out for that one. Quite often with a lot of our enterprise customers there is a preference to go with a self-hosted infrastructure to ensure that that everything is remaining within the VPC as well.

5:23 So, I guess like just really quickly as well jumping into sort of how you can set up privacy mode within within Cursor. If I jump into my team settings within the Cursor dashboard, I sort of have this this setting in which I can choose to configure my sharing modes. As I mentioned before, by default privacy mode will be enabled for all enterprise so any customers that are on an enterprise plan, privacy mode will be enabled by default.

5:59 But obviously this is sort of where we can we can configure this within the Cursor dashboard as well. So, you sort of have a lot of control over how you want to do this even when you're not on an enterprise plan, too. Awesome. Cool. And then the other thing that I want to cover off is just like a little bit on sort of like IP protection and sort of network configuration pieces. This is a pretty heavy topic, pretty low level. But I guess like just generally we do

6:25 have a lot of controls over I guess like how you're set up within I guess like different sort of proxy environments and things like this. So, for example, if you're using something like a Zscaler, there are obviously a lot of like different streaming policies and things like this.

6:41 This is particularly relevant for obviously the back and forth with an LLM. There's a lot of streaming sort of movements there. And so, Cursor is really set up quite well to be able to sort of handle all of these different instances across environment setups within you know, I guess like pretty much any enterprise as well. This is a very very deep. We can obviously share the the documentation for all of this as well. Across like IP allow listing, peering, things like this.

7:18 We obviously encrypt all traffic in transit as well. But yeah, this is quite a lot of like coverage in terms of sort of network configuration and how we can sort of work across different environments as well. Awesome. I don't know Noah if there's any like questions or anything we want to cover off just before we move into the next section.

7:41 There's a question around the team marketplace. I'm working on a response there. Not sure if we'll get to it here before we come at time 1:30 minutes. But if you want to cover it, you can. If not, I'm working on a pretty detailed response here. Yeah. Yeah, no we can cover off team marketplace really quickly. We will talk through through some of the like primitives like hooks and rules and things like that. So, I can cover off team marketplace really quickly as well. But I might just push through. Maybe if

8:08 you want to work on a response on that one and I can really quickly share it as we go through. Yeah, if we have time at the end we can circle back to it. Yeah, cool. Sounds good. Awesome. Cool. So, the second thing that we want to talk about is sort of like agent governance.

8:21 So, obviously across large enterprises, there are definitely scenarios in which you may want to I guess like control the certain outputs or or behave or like sort of intercept the agent loop in which how people users are interfacing with different agents. So, one way that we can enable this is through hooks. So, hooks are essentially just the ability to observe or maybe even control in some aspects the agent loop using a lot of different custom scripting. And essentially what

8:55 this looks like if I jump into our hooks documentation here, if I jump down to the bottom here, we have a bunch of different hook events. So, you can sort of see here these are you can sort of consider these as like the different I guess like events or actions that are happening through an agent call. So, there are certain things like for example, before a file read. So, the tool call that actually happens when we perform when the agent performs this action, you're able to actually attach

9:27 scripts to each of these components. And so, maybe you wanted to check that you know, a file matches a certain file type or maybe it has to pass a certain you know, certain threshold of you know, whatever internal rules you might have let the agent read a particular file or something like that. Additionally, you can also just use this for a lot of telemetry as well. So, maybe you want to just identify you know, and pass down metadata to some of your internal tooling in terms of

10:01 you know, how people are engaging with an agent and how people are sort of conducting and different things that they're sort of running within their agent loops as well. If I jump into the dashboard as well, you can actually see that we can define hooks at the team level as well. So let's say I had a thousand users within my team and I wanted to be able to set up a hook that's going to be invoked for every single agent loop at every single sort of at

10:30 one of those events that that we can see in the docs there. So for example, we've got a couple of couple of hooks set up in our test instance here. So we might want to on Linux environments, we want to run a command hook that's just going to basically do a simple audit on the after agent response event here. And so we sort of have our scripting, we can target different operating systems that we want and that will run every time we see this this after agent response event as well. So quite a lot of control in terms of

11:06 sort of how you can interface with the agent loop at a pretty granular level as well. One of the other things I wanted to cover off just really quickly on agent governance is just like model governance in general as well. So obviously within sort of your admin settings, there are certain scenarios in which you may want to restrict certain model access. So for example, you may have models that are sort of more on the premium end that you may not want certain users to be able to access.

11:41 Then you can control that within your admin settings as well. Quite quite often see this for you know, some of the really really more expensive premium models as well. Similarly, you can do the same thing for particular MCPs as well. So maybe you don't want particular MCPs enabled within your within your organization, then you can sort of have a lot of control over how you want to be able to apply that at a global level too. Awesome. Cool.

12:09 Noah, anything? Let me just jump into the chat here. Looks like we're pretty good. Awesome. Thirdly, like going through the list of sort of enterprise features, there's a couple things around I guess like just the deployment of how how cursor is is set up within within your organization. So one of the things that we quite often see pretty heavily used is rules. So rules you can sort of consider as a way to just sort of apply additional prompting or additional

12:44 context to each user's interaction with an agent. So for example, there's obviously a couple of different scopes that you can do this. You can do this at a project level or a user level. From an enterprise perspective, we we might see this happening at a team level. But [snorts] essentially you may want to apply particular context to each prompt to say make sure that you know, whenever I'm running you know, say like a data bricks command that I'm only looking at specific tables rather

13:16 than looking at all of the all of the tables available to me within the MCP. Or you know, this like some design guidelines or something like this. So if you want to be able to apply context as part of every every user's prompting experience with the agent, then you can obviously do this at a team level. If I jump back into the into the same view that I was in before when I can see my hooks, I can jump into the rule section as well.

13:44 And here I can see you know, any rules that can be applied globally across the team. Um Pretty good example one of the sort of shared just before. We have this blessed usage tables. So you know, particular tables when we think about you know, pulling particular data from our data bricks, we can say you know, these are the explicit tables that are that are used for a particular context. You can obviously define these to be optional or required as well.

14:12 So users have a little bit of flexibility there as well. Awesome. Cool. Jumping into the next piece on like a deployment scenario as well is sandboxing. So sandboxing pretty deep subject. I actually have a just linked out here a blog article that we wrote on implementing secure sandboxes for your local agents. Really good read here. I won't go too deep into it. But essentially this is the concept of being able to allow list certain commands that can be run within the terminal.

14:52 So by default, you know, this is a pretty fine balance of being able to essentially how often do you want to prompt a user with certain commands and and things that are able to be done within the within the terminal. So for example, you might not want an agent to go super broad in terms of what it can access and the commands that it can run within the terminal. But then there is also a a gentle balance of how often do you want to prompt a user and sort of overbear them with

15:24 with particular questions and and approvals throughout the process as well. From a enterprise point of view, that's the wrong one. From an enterprise point of view, we obviously have the ability to configure how the sandboxes is operating within your environment as well. So if there are particular ways in which or particular commands or or things that you want to be able to allow list or block within your terminal, then you have configure like it's pretty

15:56 configurable in how you can do that as well. Yeah, pretty pretty complex subject and I would definitely recommend reading through the the blog article. But yeah, lots of flexibility in terms of you know, making sure that the agent can only operate within the the bounds that you want to provide as well. Awesome.

16:17 Cool. I guess lastly before I jump into some like some some customer case studies and things like this as well is just like the visibility and and compliance component of how the cursor sort of dashboard is set up as well. So obviously if I jump into I can just jump over to my other desktop here.

16:41 If I jump into the cursor dashboard, you can sort of see here um down on the left hand side as an admin, I can jump in and see analytics across my across my workspace. So I can see you know, the share of AI committed code. I can see all of the edits that are being made. I can see activity across my user base. There is actually a pretty detailed sort of audit log as well. So if I jump over to our audit log on the left hand side here, I can actually see

17:11 everyone's usage down to a pretty pretty granular level of sort of different things that they're doing within the workspace and this is obviously all exportable as well. This is retrievable by API as well if you want to sort of programmatically do this.

17:26 And so admins really have quite a lot of control in terms of how they can sort of identify and manage use across the cursor workspace as well. Obviously as you sort of scale up to you know, hundreds or thousands of users, this becomes very high priority in terms of making sure that that you have true and transparent visibility across the board.

17:53 There are quite there is quite a lot to cover off in terms of analytics and sort of insights that we can pull from from cursor. Just to cover off a few, I can obviously see you know, breakdowns of the different types of work that's happening. So based on prompts that are being orchestrated by our user base, you know, what are the certain things that people are often doing in terms of categories of work and what's the intent of the work and things like this. This is particularly useful for any admins

18:26 that are sort of figuring out you know, when they're having conversations with their executive stakeholders or you know, leaders within the within the within the organization, how do we justify a return on investment and sort of understand you know, what are the main value adds that our user base is getting from cursor. And we provide as much as we possibly can to be able to sort of help you have these conversations internally as well.

18:53 As well as give you that sort of granular breakdown of all of the data so that you can you know, potentially do your own reporting as well. The API is is particularly useful here as well. We see a lot of customers pulling data from the API and then and then doing their own analysis.

19:12 Just recently actually we we deployed just a read only analytics API. So you can have a more tightly scoped view of sort of what's going on as well. Awesome. Cool. Let's jump back to the deck here. All right. And then I guess like just looking across at you know, you know, how is this put into practice? How do we see a lot of our customers actually doing this in the real world? So I just actually pulled out a couple of our case studies here. So you

19:49 know, the three that I've called out here is obviously Nvidia, Salesforce and stripe so some of our you know larger customers and how they're sort of leveraging cursor today. You can imagine businesses at these scales have a lot of internal you know compliance you know existing systems and processes that exist to you know that that cursor needs to sit within the confines of and so you know businesses like Nvidia specifically have really extensively used a lot of

20:22 our like hooks capabilities and and other sort of you know enterprise level features to be able to make sure that you know cursor can actually be responsibly and used within their their compliance and regulatory confines. One case study that we haven't yet published which I'm really quite excited to see is a case study in the in the in the fin serve space as well and so obviously when we start to get into you know really really regulated industries like banks and

20:56 health care providers and things like this. There are a lot of not just like internal policies and regulations but also external and you know government enforced compliance and regulatory things that they need to adhere to and so there's a lot of really interesting insights into how cursor can fit within these these scenarios as well. Plus yeah data retention or I guess like internal use of of of cursor as well so really excited to see that one now which should be coming out

21:30 in the next month or so as well. Awesome I just want to jump back into the Q&A I guess Noah anything jumping out at you that we want to cover off? Yeah this might be a little bit of a deviation but there's a question in here that says I heard that skills should be used over rules because that works better have you heard this feedback before I find it a bit hard to determine what the difference between those two are and both end up being a markdown file. Yeah

22:00 great great call out there is definitely you know across skills and rules yeah you can they can definitely sort of be confusing concepts in terms of which to use when. I guess like the main distinction across a skill and a rule is that a school a skill is going to be invocable so whether that is jumping into cursor and calling that skill using a slash command or whether the agent is sort of inferring whether a skill should be used based on the prompt that you've that you've called for.

22:37 It is it is invocable so it is not necessarily applied for every single prompt and it is used when relevant. A rule however is typically used for when you want this to be applied for every single prompt that a user is is is performing so if it's something that you want globally applied all the time this is really important context that needs to happen as part of every prompt then a rule can be quite beneficial. One of the things where we start we're starting to see more adoption of skills

23:13 is there is definitely a consideration around using rules because you everything that you're adding into each prompt is obviously adding more to your sort of context window and the more rules that you're applying the the denser your context window is is from the start so unless it absolutely has to be a part of every prompt then maybe a skill is going to be more relevant where it can be used more more intelligently rather than a than a rule being applied blanketly across everything.

23:49 I guess like Noah would you have anything to add there? No I think that makes sense. There's another question in here which I'm happy to answer as well. I have several cloud agent sessions over the last few weeks when I view the cursor.com/agents I see all my past sessions some as old as four weeks and for cloud agent sessions I started four weeks ago and I'm not interacted with is that data still stored? How long will the session be available to continue working in that

24:17 session? So just because you see the agent chat doesn't necessarily mean that the environment that cloud agent was working out of is still built. And so if you go back to an old session and re-prompt it it may need to rebuild that environment spinning up a VM to run that. The the retention depends on if people have saved the environment as a snapshot we provide that as an option for people within the platform where you can essentially build your virtual

24:48 environment save that as a snapshot and the next time you re-prompt the cloud agent you can spin that environment up quicker. I don't off the top of my head know exactly what the retention on the snapshots are but I can look here in the documentation and provide that.

25:05 Anything you'd add to that James? Yeah I would also say like when we said night actually no night hi night how are you uh one of the things is especially when we start to move into the self host world as well that sort of retention can sort of be a little bit more configured because it's sitting within your own VPC as well. For anything cursor cloud hosted yeah there is sort of just like a a particular window that we define I think it's 30 days to

25:43 be able to you know if you want to return to work without sort of having to re like spin that environment back up again and sort of pick up where you left off gives you the ability to do so. Awesome. Cool. I can see there's a question around European countries as well yes we do have a lot of customers sitting in within within the EU as well obviously a lot tighter regulations within EU I myself am from Australia so we have very similar regulations there as well. And yes we do

26:17 have a lot of customers who are residing within the EU um and we haven't had any issues with with sort of because of our things like zero data retention policies and and being able to self host is sit very well within the EU as well. Just to add one more piece to the the cloud agent piece so if you go into your admin settings and go to cloud agents you'll be able to see like all of the environments that are currently active under the top kind of banner that talks about environments and if you click on those

26:56 at any point in time you could always delete the environment essentially purging the data whenever you want to shut it down. So. Awesome great we're at time thank you so much for everyone for attending today I believe this will be published to the to the website at some point I think within the next week or so so yeah if you do want to revisit feel free but yeah thanks all for your time thanks Noah have a great day. Yeah thank you all for coming.