Companies that use Cursor

We also want to show some examples so you can see our data is accurate, and to show some interesting ways some companies are using and configuring their Cursor implementation.

EPAM Systems

Digital Engineering & IT Services - Newtown, PA

EPAM is an Enterprise Cursor customer with around 63,000 employees, over 55,000 of them engineers and consultants. Their ai-dial-admin-frontend repository has a Cursor skill that connects to OpenSpec, an internal CLI tool for managing code changes.

When a developer starts implementing a change, Cursor reads the task list from the OpenSpec CLI and works through tasks one at a time, checking each one off immediately after completing it.

There's a confirmation gate between every step. If a task is ambiguous or implementation uncovers a design problem, it stops and flags it rather than guessing.

For a company running Cursor across hundreds of client engagements, that predictability matters.

---

Cloudera

Data & AI Platform - Santa Clara, CA

Cloudera is an Enterprise Cursor customer with around 3,300 employees, roughly 616 in engineering. Their Hue repository uses Cursor specifically for PR reviews, which is the only example on this list of a team using Cursor as a code reviewer rather than a code writer.

The rule is only active during reviews, not on regular file edits. Its first instruction is blunt: only call out what's wrong, never list what's already good. It checks for architecture issues, naming clarity, edge cases, accessibility, copy consistency, and flags any file missing the Cloudera copyright statement.

---

Zscaler

Cybersecurity - San Jose, CA

Zscaler is an Enterprise Cursor customer with around 8,000 employees, roughly 1,150 in engineering. They also use Claude Code, no ChatGPT signal. Their pulumi-zia repository is their open source Pulumi provider for Zscaler Internet Access.

The Cursor rule covers adding new ZIA data sources to the provider. It tells Cursor to always start by reading the vendored zscaler-sdk-go/v3 SDK before writing anything, then walks through a five-step workflow with a full Go template.

There's a section called "Key Differences from Resources" that exists because Cursor kept getting Pulumi function conventions wrong: pointer vs. value in infer.Function(), pointer receivers on Annotate methods, no CRUD, no State struct. These have to be spelled out or Cursor invents its own approach.

---

Snyk

Developer Security - London, UK

Snyk is an Enterprise Cursor customer with around 1,200 employees. They use GitHub Enterprise. Their agentic-integration-wrappers repository has one of the most opinionated .cursorrules files on this list.

The rules open with: "Always be concise, direct and don't try to appease me." "DOUBLE CHECK THAT YOUR CHANGES ARE REALLY NEEDED." "Don't optimize, don't refactor if not needed." These are rules written by engineers who got burned by Cursor doing too much.

The security section is the standout. Cursor is told to run Snyk scans (both SCA and code scanning) after every single edit, after any go.mod update, and again before committing.

Fix issues before you commit. They're using their own product as a guardrail inside the Cursor workflow.

The commit rules are equally strict: conventional commit messages with the Jira ticket ID from the branch name, never force push, never push without asking, always offer to open a PR against the repo's GitHub template.

---

Swimlane

Security Automation - Denver, CO

Swimlane is an Enterprise Cursor customer with around 250 employees, roughly 75 in engineering. They also use ChatGPT, Claude, GitHub Enterprise, and Vercel Pro. Their ngx-ui repository has two Cursor rules tied to their ongoing migration from their Angular component library to a new Lit web component library.

One rule enforces the file and folder conventions for the new Lit library. The more interesting one is a slash command, /generate-swim-from-angular, that encodes the full migration workflow: a developer points it at an Angular component and it generates the complete Lit equivalent, including a mapping table for inputs, outputs, lifecycle hooks, and CSS.

---

Pinecone

Vector Database - New York, NY

Pinecone is an Enterprise Cursor customer with around 130 employees, about 79 in engineering. They also use Claude Code. Their examples repository has a single Cursor rule that applies to everything in the repo.

The rule enforces notebook quality standards: markdown intro at the top, all imports in the first cell, all dependencies pinned to exact versions, explain the "why" before code, cleanup cells at the end if the notebook creates resources. The non-negotiable: every notebook must run cleanly with "Restart Kernel and Run All." No hardcoded secrets. It's a simple rule, but for a small team maintaining a large public examples repo, having it apply automatically to every file means they don't have to think about it.

---

Rollbar

Error Monitoring - San Francisco, CA

Rollbar is an Enterprise Cursor customer, a team of around 35 people. They also use Claude Code. Their rollbar.js repository has a single Cursor rule that applies to all files and essentially serves as an onboarding guide to the SDK for Cursor.

It covers project structure, build commands, and code style, but two sections stand out. The first is a design principle: user integration problems should be treated as SDK design flaws, not user errors. That framing shapes how Cursor approaches every bug report. The second addresses a specific AI failure mode: when a test fails, figure out whether the code is broken or the test is wrong before touching either. Without that instruction, Cursor's default is to make the test pass by whatever means necessary, which on a production SDK is often the wrong call.

---

OutSystems

Low-Code Platform - Lisbon, Portugal

OutSystems is an Enterprise Cursor customer with around 2,000 employees, roughly 486 in engineering. Their docs-odc repository has the most elaborate Cursor setup on this list, and it's for documentation work, not code.

Their content creation workflow is a multi-step Cursor skill with a confirmation gate at every step. Cursor cannot proceed until the user explicitly says go.

Before anything starts, it checks four MCP connections are live: Atlassian, Figma, a custom OutSystems content server, and GitHub. If any are down, it stops.

The discovery step pulls from GitHub, their tech content MCP, Jira, Confluence, and Figma design nodes simultaneously. The whole setup suggests a team that has been burned by Cursor running ahead without enough context.

---

Gusto

Payroll and HR - San Francisco, CA

Gusto is an Enterprise Cursor customer with around 2,300 employees, roughly 586 in engineering. Their Cursor rule is narrow and direct: it solves one specific problem: Cursor making up library APIs that don't exist.

Before writing any code that uses a third-party library, Cursor is required to use the Context7 MCP server to look up the real, current documentation first. Two steps: resolve the library ID, then query the docs. The rule covers their whole frontend stack: React, react-hook-form, TanStack Query, Zod, Vite, Vitest, Playwright, i18next, Storybook. It's set to alwaysApply: true, so there's no way to skip it.

---

Exa

AI Search - San Francisco, CA

Exa is an Enterprise Cursor customer, a startup of about 75 people building a search engine for AI applications. They also use Claude Code. Their company-researcher repository has a short .cursorrules file for their Next.js 14 app.

The rules cover their stack (Next.js 14, TypeScript, Tailwind, shadcn/ui) and split into code quality and design. The design section is the more interesting half: "modern and beautiful UI," "clean and consistent design language," "smooth transitions and animations." For a small developer tool company using Cursor to move fast, encoding aesthetic standards in the rules is a deliberate choice. They want the output to look intentional, not generated.

---

Expedia Group

Travel Technology - Seattle, WA

Expedia Group is an Enterprise Cursor customer with around 17,000 employees. Their open source graphql-component repository has a Cursor rule that documents how to build components using their GraphQLComponent base class.

The rule covers constructor patterns, file structure, schema loading, resolver exports, federation vs. composition, and cross-component delegation, every section with a working TypeScript example. The delegation part is the most specific: when one component needs to call another, it uses delegateToSchema from @graphql-tools/delegate, passes the other component's schema via this.componentName.schema, and requires component instances to be stored as class properties so resolvers can reach them.