To set up Cursor in 2026: download it from cursor.com (macOS 12 or newer, Windows 10 or newer, or Linux via apt, dnf, or AppImage), open the app and sign in, pick a project folder, then press Cmd I to open Agent. Press Shift+Tab inside the agent input to toggle Plan Mode when the change is large enough that you want a plan before any code is written. Those four steps are the entire documented quickstart. Everything after that is configuration: which model you point at, what rules the agent reads, and what your compliance posture allows it to touch. This guide covers all three, and it is current as of September 15, 2026.
Petronella Technology Group, Inc. works with developers, managed service providers, and regulated organizations in defense, healthcare, and financial services. Cursor comes up in almost every engineering conversation, and the questions are consistent: where does the code go, who can turn the privacy controls off, and can this tool sit inside an environment that has to answer to an assessor. This guide answers the setup question quickly and then spends most of its length on the part that is genuinely hard.
One note on currency before you read further. Cursor ships frequently, and a guide written against a spring 2026 build will describe a product that no longer exists. Where this guide states a fact, that fact is sourced to Cursor's own published documentation or changelog on the date shown. Where something is not published, this guide says so rather than guessing.
Cursor Setup in Under Ten Minutes
The install path is deliberately uneventful, which is correct for a tool that will sit at the center of an engineer's day.
Download and install. Cursor's quickstart documents support for macOS 12 and newer, Windows 10 and newer, and Linux through Debian and Ubuntu packages (apt), RHEL and Fedora packages (dnf), or a distribution-independent AppImage. Pick whichever matches how your fleet already manages software, because that is the build your endpoint management tooling will need to update later.
Open the app and sign in. Cursor's quickstart states the flow plainly: download Cursor, open the app, and sign in. If you are deploying to a team, do not let engineers self-register individual accounts. Cursor documents SSO and SCIM for organizations, and provisioning through your identity provider is the difference between an account you can deprovision on a Friday afternoon and an account you find out about during an audit.
Pick a folder. Point Cursor at a git repository. Cursor indexes the project so the agent can answer questions that span files rather than only the one you have open.
Open Agent with Cmd I. This is the documented shortcut and the main surface you will use. From there you describe what you want in plain language and review what the agent proposes.
Use Plan Mode for anything large. Cursor's quickstart documents Shift+Tab in the agent input as the toggle for Plan Mode. Instead of writing code immediately, Cursor researches the codebase to find relevant files, asks clarifying questions about your requirements, creates a detailed implementation plan, and waits for your approval before building. This is the single most underused control in the product. Engineers who complain that the agent went off and rewrote half a module are almost always engineers who never pressed Shift+Tab.
Two things are worth doing on day one that the quickstart does not walk you through. First, decide what the agent is allowed to read before you point it at a repository that contains anything sensitive. Second, decide whether automatic execution of shell commands is acceptable in that repository, and turn it off where it is not. Both of these are covered in the security section below, and both are far easier to set as a default than to retrofit after an incident.
What Changed in Cursor Between May and September 2026
If your last serious evaluation of Cursor was in the spring, several things have moved. These entries are dated from Cursor's published changelog.
Cursor Projects, September 10, 2026. Projects is a workspace aimed at work that is larger than a single task: a feature, a migration, or an application built over a long period. The described model is a coordinator agent that does not write code itself. It plans the work, delegates implementation to other agents, and manages those agents on your behalf, running them in parallel as the work requires. For teams evaluating Cursor as an individual productivity tool, this is the entry that should prompt a second look, because it changes the unit of work from a prompt to a project.
Self-hosted machines, September 2, 2026. Cursor added support for self-hosted machines, which keep tool execution entirely inside your own network so that codebases, build outputs, and secrets stay on internal machines. This is the most consequential release of the year for regulated organizations, and it deserves careful reading rather than an assumption. It addresses where tool execution happens. Read the section below before you conclude it addresses everything.
Start from scratch without a repo, August 27, 2026. Cloud Agents can begin a project without an existing repository connection, with Cursor creating an Origin repository in the background.
Cloud Agents and Cursor Harness improvements, August 19, 2026, and Origin Code Hosting, August 17, 2026.
A terminology correction matters here, because it is the kind of thing that makes an otherwise good internal policy document read as out of date. Cursor's changelog uses the term Cloud Agents. Older write-ups, including earlier versions of this guide, used "Background Agents." If your internal documentation still says Background Agents, update it, because your engineers will not find that term in the product or the docs.
Cursor's changelog does not attach version numbers such as 2.0 or 3.0 to its dated entries. Third-party sites publish version numbers for Cursor builds, and community tutorials use them in titles. This guide does not repeat those numbers, because they are not in Cursor's own published changelog and an unverifiable version number in a setup guide is worse than no version number at all. Check cursor.com/changelog for what actually shipped and when.
Rules: .cursor/rules, .mdc Files, and AGENTS.md
Rules are how you teach Cursor your codebase conventions once instead of retyping them in every conversation. This is where the largest amount of stale advice circulates on the internet, so the current documented system is worth stating precisely.
Cursor documents project rules as .mdc files stored in .cursor/rules. These are markdown files with frontmatter. The documentation is explicit about a trap that catches almost everyone the first time: a plain .md file placed in .cursor/rules is ignored by the rules system because it has no frontmatter. If you wrote a rules file, saved it as .md, and concluded that rules do not work, that is why.
Cursor also documents AGENTS.md as a plain markdown alternative that can live in the project root or in subdirectories, and user rules as global preferences set under Customize then Rules.
The documentation defines four rule types, controlled by the frontmatter you write:
- Always Apply (
alwaysApply: true): applies to every chat session. - Apply Intelligently (a description is provided): applies when the agent decides it is relevant based on that description.
- Apply to Specific Files (globs are provided): applies when a file matches the pattern.
- Apply Manually: applies when you @-mention it in chat, for example
@my-rule.
Globs scope a rule to particular files or directories, and multiple patterns are separated with commas. The documented examples are src/**/*.tsx to match every TSX file under src, and **/*.ts to match every TypeScript file anywhere in the project.
Cursor's current rules documentation does not mention .cursorrules. Many guides, including older versions of this one, describe a single .cursorrules file at the project root as the legacy approach. If you are standing up rules today, write .mdc files in .cursor/rules or an AGENTS.md, because that is what the documentation describes.
What belongs in a rules file, in practice: language and formatting conventions, testing requirements and the coverage floor your team actually enforces, security baselines such as parameterized SQL only and no dynamic code execution, logging conventions, commit message format, and architectural conventions about where new code goes. A useful rule of thumb is that if you correct the agent on the same point twice, that correction belongs in a rules file rather than in your memory.
For regulated teams there is a second reason to take rules seriously. A rules file is a written, version-controlled, reviewable artifact describing how automated tooling is constrained inside your codebase. That is a far better answer to an assessor than a verbal description of how your engineers usually behave.
Choosing a Model in Cursor
Cursor's model picker is broad and moves quickly. As documented on Cursor's models page, the picker includes Cursor's own Composer 2.5 and Composer 2.5 (Fast), the Grok 4.6 and Grok 4.5 families including Fast variants, a wide Anthropic Claude range spanning Claude 4 Sonnet through Claude Opus 5 and Claude Sonnet 5, Google Gemini models from Gemini 2.5 Flash through the Gemini 3 family, the OpenAI GPT-5 family including Mini, Codex, and Fast variants, and models from other providers including GLM, Kimi, and Muse.
Note that Composer is now the name of a Cursor model, not the name of a multi-file editing mode. Older guides describe "Composer" as a workflow you switch into alongside Agent Mode. If your internal documentation still frames it that way, it will confuse anyone reading it against the current product.
Practical guidance rather than benchmark claims: pick a capable model for planning and review, and a fast model for mechanical work, then measure on your own codebase. Published benchmark numbers rarely survive contact with a real repository that has its own conventions, its own dependency graph, and its own accumulated decisions. Run the same three representative tickets through two models and compare the diffs. That takes an afternoon and produces an answer that is actually about your code.
Plans and What They Actually Cost
From Cursor's pricing page, checked September 15, 2026: Hobby is free with no credit card required and limited agent requests. Pro is $20 per month, Pro+ is $60 per month, and Ultra is $200 per month, all billed to an individual. Teams is $40 per user per month with centralized billing, and Enterprise is custom priced with pooled usage and additional administrative controls. Those five published prices come from the pricing page's own structured data on that date.
On Bugbot, Cursor's pricing page indicates Bugbot runs on usage-based billing rather than as a flat per-seat add-on. Earlier versions of this guide quoted a fixed monthly per-user price for Bugbot. That figure is not what the pricing page currently shows, and it has been removed rather than restated. If you are building a budget, price Bugbot from your own projected usage and confirm against cursor.com/pricing on the day you buy, because usage-based line items are exactly the ones that surprise finance teams.
The same caution applies to any tier price you find in a blog post, including this one. Verify against the vendor's pricing page before you take a number into a procurement conversation.
Security and Compliance: What Cursor Publishes and What You Must Still Do
This is where most of the questions Petronella Technology Group, Inc. receives actually land. The honest summary: Cursor publishes a meaningful security posture, and that posture does not by itself answer the question an assessor will ask you.
What Cursor publishes. Cursor's security documentation states that Privacy Mode can be enabled in settings or by a team or enterprise administrator, and that Privacy Mode is available to anyone, free or Pro. With Privacy Mode enabled, Cursor states that it will not train on your data, and describes technical controls and contractual requirements with its model providers to protect your data. Cursor states that it holds a SOC 2 Type II attestation, with certificates and reports available on request at trust.cursor.com, and claims AIUC-1, ISO/IEC 27001:2022, and ISO/IEC 42001:2023 certifications. SSO and SCIM are documented, Privacy Mode can be enforced by team or enterprise administrators, and mobile device management deployment patterns are supported.
What that does and does not mean. Two distinctions matter and are routinely collapsed. First, "we will not train on your data" is a statement about model training. It is not the same statement as a specific code retention window. Cursor's security page does not publish a retention period. If your control set requires you to document how long a third party holds your data, you need that answer from Cursor's trust center or your contract, not from a blog post and not by inference. Earlier versions of this guide asserted that code is not retained after a request completes. That assertion has been removed because it is not what the published documentation says.
Second, administrator enforcement is the control that matters, not the toggle. A per-developer Privacy Mode setting that any developer can switch off is not a control you can attest to. Enterprise and team administrator enforcement is.
For CMMC Level 2 environments handling Controlled Unclassified Information. Treat Cursor's standard cloud routing as unauthorized for CUI until you have documented otherwise. A SOC 2 Type II attestation and ISO certifications are evidence of a vendor security program. They are not a determination under NIST SP 800-171, and they are not FedRAMP authorization. The September 2, 2026 self-hosted machines release changes where tool execution happens, which is genuinely useful, and it is not the same thing as a documented assessment of the whole data flow including model inference. The patterns that work in practice are to scope Cursor strictly to repositories that contain no CUI and keep a separate documented workflow for CUI work, or to route inference to infrastructure you control and document that path. Both need review against your System Security Plan before anyone signs off. Our CMMC compliance team runs exactly this review, and the honest answer is that it is a paperwork exercise as much as a technical one.
For HIPAA workloads. Keep protected health information out of the tool. Do not paste PHI into chat, do not let an agent query a database that contains PHI, and document the boundary you have drawn. A Business Associate Agreement is not something to assume; if your use case would require one, confirm availability in writing before deployment rather than after. Our HIPAA compliance practice treats development environments as in scope by default, because that is how they are treated when something goes wrong.
Secrets hygiene. An agent that can read your project can read your .env file. Exclude secrets from what the agent indexes, keep real credentials in a secret manager rather than in files, and treat any key that has ever been pasted into any chat window as compromised and rotate it. This is unglamorous and it is the control that prevents the most common real-world incident.
Shell execution. On any repository that touches production, turn off automatic execution of shell commands. The convenience is small and the blast radius is not. This single setting is the difference between an agent that proposes a destructive command and an agent that runs one.
The policy posture we recommend. Assume your developers will use AI coding tools whether you authorize them or not. Write a real policy, define which repositories are AI-allowed and which are not, provision through your identity provider, enforce privacy settings at the administrator level, and review it quarterly because the product will have changed. Banning AI coding tools outright in 2026 usually pushes the activity onto unmanaged personal accounts, which is strictly worse for security than a governed deployment. Our cybersecurity and security and compliance teams build these policies for organizations that have to defend them.
Talk to our team about an AI coding tool policy or call Penny at 919-348-4912.
Cursor vs Claude Code vs GitHub Copilot vs Cline
The comparison most engineering teams actually want, framed by constraint rather than by abstract quality.
Cursor
A full integrated development environment. You leave your previous editor and work inside Cursor. Strongest for teams that want one polished agent surface, a broad model picker, Plan Mode, Cloud Agents, and now Projects for long-running work. Weakest for engineers with a deeply customized Vim, Emacs, or JetBrains environment they will not abandon. Per-seat pricing with usage-based components.
Claude Code
Anthropic's official command line tool. It runs in your terminal and works alongside any editor with terminal integration. Strongest for engineers who already live in a terminal multiplexer, prefer text interfaces, and want a direct agent loop. Weakest for visual diff review, where a graphical interface genuinely helps. We have a deeper walkthrough in our Claude Code CLI guide, and if you work this way, our terminal multiplexer comparison covers the surrounding setup.
GitHub Copilot
The original entrant, layered into VS Code, JetBrains, and other editors rather than replacing them. Strongest for organizations already inside the GitHub ecosystem that want a single vendor relationship and predictable per-seat pricing, which makes procurement trivial. Weakest as an agent surface relative to Cursor's, and the model selection is narrower.
Cline
An open-source VS Code extension. Strongest for engineers who want an agent loop inside their existing VS Code installation without switching editors, and who want to bring their own API keys, including pointing at locally hosted models. Weakest in polish and support, because it is a community project. It is the natural choice for teams running their own inference, which pairs with our notes on self-hosted AI agents and, if you are building the hardware for it, our AI workstation build guide.
The decision is rarely about which tool is best in the abstract. A VS Code team inside the GitHub ecosystem gets fast value from Copilot. A team already running its own inference will find Cline or Claude Code cheaper. A team that wants the fewest tool decisions and the most capable agent surface picks Cursor and moves on. A regulated team should let the compliance review pick, because that constraint is the binding one.
Frequently Asked Questions
How do you set up Cursor?
Download Cursor from cursor.com for macOS 12 or newer, Windows 10 or newer, or Linux via apt, dnf, or AppImage. Open the app and sign in. Pick a project folder. Press Cmd I to open Agent, and Shift+Tab inside the agent input to toggle Plan Mode for larger changes. Those are the documented quickstart steps. After that, add a rules file in .cursor/rules and set your privacy and shell execution preferences before you point it at anything sensitive.
Is Cursor AI an IDE?
Yes. Cursor is a full integrated development environment rather than an extension you add to an existing editor. It is built on the open-source VS Code codebase, so the interface, keybindings, and extension ecosystem are familiar, but the AI features are built into the product rather than layered on top. That is the main structural difference between Cursor and GitHub Copilot.
Is Cursor AI IDE free?
There is a free tier. From Cursor's pricing page, checked September 15, 2026: Hobby is free with no credit card required and limited agent requests, Pro is $20 per month, Pro+ is $60 per month, Ultra is $200 per month, Teams is $40 per user per month, and Enterprise is custom priced. Bugbot is shown on usage-based billing rather than a flat per-seat fee, so budget it from projected usage rather than from a seat count. Confirm all of these against cursor.com/pricing before purchasing, because vendor pricing moves.
Is Cursor AI better than VS Code?
They are not quite competitors, because Cursor is built on the VS Code codebase. The real question is whether Cursor's built-in agent is worth changing editors for compared with adding an AI extension to the VS Code you already run. If you want the most integrated agent experience and do not mind switching applications, Cursor is the stronger choice. If your VS Code environment is heavily customized and you mainly want an agent loop inside it, an extension such as Cline gets you most of the way without the switch.
Why is Cursor not working?
The two most common causes in our experience are both configuration rather than defects. First, rules that are silently ignored: Cursor's documentation states that a plain .md file in .cursor/rules is ignored because it has no frontmatter, so the file must be .mdc with frontmatter. Second, an agent that appears to lack context because indexing has not finished or because the relevant directories were excluded. Beyond that, check that you are signed in and that your organization's network policy permits the application's outbound connections, which is a frequent cause on managed corporate laptops.
Is Cursor safe for commercial and regulated code in 2026?
For ordinary commercial code, with Privacy Mode enforced by an administrator rather than left to each developer, Cursor publishes a security posture that most organizations will accept: a stated SOC 2 Type II attestation, claimed ISO/IEC 27001:2022 and ISO/IEC 42001:2023 certifications, SSO and SCIM, and a statement that it will not train on your data. For CUI under CMMC, or for protected health information, the answer is that vendor attestations are inputs to your own determination and not a substitute for it. Scope the tool to repositories that hold nothing regulated until you have documented an assessment, and get the retention answer in writing from Cursor's trust center rather than inferring it.
Can I use Cursor with self-hosted or open-source models?
Cursor shipped self-hosted machines on September 2, 2026, which keeps tool execution inside your own network so codebases, build outputs, and secrets stay on internal machines. Review Cursor's current documentation for what that covers in your configuration before treating any part of the pipeline as fully on-premises. Teams whose primary requirement is that inference itself runs on infrastructure they own often pair a bring-your-own-key extension such as Cline with local inference, which is the pattern described in our self-hosted AI agents guide.
What is Plan Mode and when should I use it?
Plan Mode is toggled with Shift+Tab in the agent input. Rather than writing code immediately, Cursor researches your codebase to find relevant files, asks clarifying questions, produces an implementation plan, and waits for your approval before building. Use it for anything that touches more than one or two files, anything in an unfamiliar area of the codebase, and anything in a repository where an unreviewed change would be expensive. The habit of pressing Shift+Tab first is the highest-value change most teams can make.
Where to Go Next
Cursor in September 2026 is a capable and fast-moving development environment. The setup is genuinely simple. The governance is not, and that gap is where organizations get into trouble: a tool that any engineer can install in five minutes, pointed at repositories nobody formally scoped, under privacy settings nobody enforces centrally.
If you are standing up an AI coding workflow inside a CMMC, HIPAA, or otherwise regulated environment, the work is defining which repositories are in scope, enforcing privacy controls at the administrator level, documenting the data flow against the control set you actually operate under, and writing the policy that survives an assessment. Petronella Technology Group, Inc. is a CMMC Registered Provider Organization and has served regulated organizations since 2002. Craig Petronella holds CMMC-RP, CCNA, and CWNE credentials, is a North Carolina Licensed Digital Forensic Examiner (#604180), and holds an MIT artificial intelligence certificate; you can read more about Craig.
To talk through model selection, the audit trail, and the policy language, call Penny at 919-348-4912 or use our contact page. You can also explore our AI services and managed IT services to see how this fits alongside the rest of your environment.
Get an AI coding tool compliance review
Free, practical, and specific to regulated environments. We will email it to you.
No spam. Unsubscribe anytime.
