Cursor Security Review (April 30, 2026): Always-on PR Security Reviewer + Scheduled Vulnerability Scanner

Cursor added Cursor Security Review as a beta feature for Teams and Enterprise plans, with two always-on security agents: a PR-focused Security Reviewer and a scheduled Vulnerability Scanner. The feature is designed to make security feedback feel native to the same workflow where teams already review and ship code.

TL;DR

• Beta on Teams + Enterprise.
• Security Reviewer: checks every PR and leaves inline security findings.
• Vulnerability Scanner: runs scheduled scans and can send updates to Slack.
• Customizable triggers/instructions, and supports plugging in existing security tooling via MCP.

What Cursor Shipped

1) Security Reviewer (PR-by-PR)

Cursor says the Security Reviewer runs against every pull request and flags:

• Security vulnerabilities
• Auth regressions
• Privacy and data-handling risks
• Agent tool auto-approvals
• Prompt injection attacks

It leaves inline comments at the relevant diff location, including severity and suggested remediation.

2) Vulnerability Scanner (Scheduled)

Cursor’s Vulnerability Scanner runs scheduled scans across your codebase to look for:

• Known vulnerabilities
• Outdated dependencies
• Configuration issues

Cursor says you can configure it to send updates of findings in Slack.

Customization and “Bring Your Own Tools” via MCP

Cursor positions Security Review as customizable: teams can adjust triggers, add their own instructions, choose how outputs are shared, and connect custom tooling.

A notable detail: Cursor explicitly calls out plugging in MCP servers for existing security tools (for example, SAST/SCA/secrets scanners), so the Cursor-managed agents can incorporate outputs from the tools you already trust.

Availability Notes (What You Need to Do)

According to Cursor:

• Security Review is in beta on Teams and Enterprise plans.
• An admin enables the feature in the Cursor dashboard.
• Security agents draw from your existing usage pool.

Practical Takeaway

If you already live in Cursor for day-to-day engineering work, Security Review is interesting because it tries to bring two common security loops into the same place:

1. PR review feedback, without waiting for an external security review step.
2. Scheduled scanning for the “slow drift” problems (dependencies and configuration issues).

The best initial trial is likely one repo with clear PR conventions and an existing scanner baseline, so you can compare what Cursor flags versus your current security tooling.

Sources

• Cursor changelog — Cursor Security Review (April 30, 2026): https://cursor.com/changelog/04-30-26