Training course · Cursor · Security & DevSecOps

Cursor for Security and DevSecOps Teams

Work productively with the AI code editor Cursor: agent mode, rules, codebase context, Tab completion, background agents and review.

Duration
2 days (14 hrs)
Format
Online or on-site
Language
German or English
Participants
open dates or exclusive for your team
Certificate
Certificate of attendance

Overview

“Cursor for Security and DevSecOps Teams” is designed for roles such as Application security engineers and security champions in development teams, DevSecOps and platform engineers responsible for CI/CD pipelines and Penetration testers and red team members and shows step by step how to use Cursor productively, safely and transparently in Security & DevSecOps – from the fundamentals to advanced workflows.

Cursor is an AI code editor built on VS Code that weaves language models deeply into everyday development. Alongside context-aware Tab completion, it offers an agent mode that searches files on its own, plans changes across the whole project, runs terminal commands and fixes errors iteratively. In this two-day course you will learn to use Cursor with purpose: choosing the right interaction mode, steering context deliberately and combining AI assistance with your existing workflow of version control, automated testing and peer code review.

A key focus is making Cursor work for teams. Project rules let you capture architectural decisions, naming conventions and testing strategies so that the agent produces consistent results. You will learn to make good use of codebase indexing, targeted references to files, documentation and symbols, and MCP integrations. You will also delegate tasks to background agents, review their output as pull requests and set up a review process that takes quality, security and data protection seriously across the organisation.

AI coding assistants and agents affect application security from two directions. They speed up threat modelling, code review and detection engineering, yet they also produce new code faster than traditional security gates can absorb. Security and DevSecOps teams therefore use AI to triage SAST findings, propose fixes for vulnerabilities, harden CI/CD pipelines and scan infrastructure as code for misconfigurations. What matters is a controlled setup: agents running with least privilege, no secrets in the prompt context, every change traceable through a pull request and human sign-off on security-critical decisions. In this course you learn to use AI as a force multiplier for your security programme while keeping the new risks of generated code, prompt injection and insecure tool integrations firmly under control.

The course is delivered live – either online in a virtual classroom or on-site in our training rooms in Munich, Salzburg, Berlin, Augsburg, Hanover, Bremen, Stuttgart and Kaiserslautern. We can also run it exclusively for your team.

Who is this course for?

  • Application security engineers and security champions in development teams
  • DevSecOps and platform engineers responsible for CI/CD pipelines
  • Penetration testers and red team members
  • SOC analysts and detection engineers
  • Developers accountable for secure software supply chains

Typical challenges we address

  • A flood of SAST, DAST and SCA findings with a high share of false positives
  • Security review becomes a bottleneck as AI-assisted teams ship far more code
  • Misconfigurations in Terraform, Kubernetes manifests and cloud policies go unnoticed
  • New attack surfaces from LLM integrations, prompt injection and over-privileged agents

What you will be able to do

  • You choose the right Cursor mode for each task and use it efficiently.
  • You steer codebase context precisely and get more accurate suggestions as a result.
  • You write project rules that reliably enforce your team’s conventions.
  • You use agent mode and background agents for features and refactorings with verifiable results.
  • Use AI agents for triage, review and fix generation without giving up control over security-critical changes.
  • Integrate AI-assisted checks into CI/CD pipelines alongside your existing SAST, SCA and IaC scanners.
  • Assess and mitigate the specific risks of AI-generated code, prompt injection and agent tool access.

Course outline

Day 1

Module 1 Setting up Cursor and understanding its modes
  • Installation and migration of VS Code settings and extensions
  • Differences between Tab completion, inline edits, Ask mode and Agent mode
  • Choosing a model per task: balancing speed, depth and cost
  • Privacy mode and organisation-level settings
Module 2 Steering codebase context
  • How codebase indexing works and where its limits lie
  • Referencing files, folders, symbols, documentation and web sources precisely
  • Using ignore files to exclude sensitive or irrelevant content
  • Avoiding overlong chats and restarting tasks with fresh context
Module 3 Rules for consistent team results
  • Creating and versioning project rules and scoping them by file pattern
  • Expressing architecture, style and testing conventions as effective rules
  • Separating user rules from team rules
  • Refining rules iteratively based on the agent’s typical mistakes
Module 4 Agent mode in practice
  • Building features step by step with plan, implementation and tests
  • Running multi-file refactorings safely with checkpoints
  • Approving terminal commands deliberately and feeding error output back
  • Connecting MCP servers for issue trackers, databases or browser testing

Day 2

Module 5 Background agents, review and governance
  • Delegating tasks to background agents and running them in parallel
  • Reviewing results as branches or pull requests and steering follow-ups
  • Using AI-assisted code review alongside human review
  • Addressing security risks, secrets and licensing in enterprise use
Module 6 Practice lab: Security & DevSecOps
  • Faster threat modelling
  • SAST finding triage
  • Secure code review
  • Hardening IaC and containers
  • Detection engineering
  • Securing the supply chain
Module 7 Data protection, quality & transfer to daily work
  • Source code, vulnerability data and logs are highly sensitive: you learn which data may be shared with AI services, how to keep secrets out of the context and how AI use aligns with NIS2, the Cyber Resilience Act, the GDPR and the EU AI Act.
  • Ground rules for safe AI use in your team
  • Checking results: facts, sources, tests and the four-eyes principle
  • Personal action plan for the next 30 days
  • Open questions, outlook and resources for further learning

Practical scenarios from your field

Faster threat modelling

Derive STRIDE-based threat analyses from architecture descriptions and data flow diagrams, identify trust boundaries and turn countermeasures into testable requirements ready for the backlog. The model is updated rather than rebuilt when the architecture changes.

SAST finding triage

Match static analysis results against real code context, assess reachability and exploitability, dismiss false positives with a documented rationale and prepare minimal fixes for genuine vulnerabilities as pull requests.

Secure code review

Have pull requests checked specifically for injection flaws, broken authorisation, insecure deserialisation and cryptographic mistakes, with references to OWASP categories and a clear explanation for every finding.

Hardening IaC and containers

Analyse Terraform modules, Helm charts and Dockerfiles for over-privileged roles, exposed ports, missing encryption and unsafe base images, then generate hardened versions backed by policy-as-code rules.

Detection engineering

Draft Sigma rules, YARA signatures and SIEM queries from threat descriptions, validate them against test data and enrich documentation with the relevant MITRE ATT&CK techniques.

Securing the supply chain

Evaluate SBOMs, prioritise vulnerable dependencies, analyse upgrade paths including breaking changes and add pipeline steps for signing, provenance attestation and dependency pinning. Each update pull request explains the risk.

Possible hands-on projects

Finding triage bot

A script that ingests SARIF output from the pipeline, deduplicates findings, enriches them with code context and opens prioritised tickets with a suggested fix.

Secret scanning hook

A pre-commit hook with custom patterns for internal token formats, allowlist management and clear guidance on how to rotate a leaked secret.

Threat model generator

A small web app that turns a system description into a structured threat model with data flows, risks and mitigations, exportable as a document.

Prerequisites

You program regularly in at least one language and are familiar with Git and an IDE such as VS Code. You have hands-on experience in software development or operations and a working knowledge of application security, such as the OWASP Top 10 and CI/CD pipelines.

Technical requirements

Your own laptop with Cursor, Git and your usual development environment installed; a Cursor account with access to agent features is recommended.

Data protection & compliance

Source code, vulnerability data and logs are highly sensitive: you learn which data may be shared with AI services, how to keep secrets out of the context and how AI use aligns with NIS2, the Cyber Resilience Act, the GDPR and the EU AI Act.

Suggested dates

All dates are suggestions – your preferred date is always possible.

  • Tue, 24 November 2026 – Wed, 25 November 2026 Online Request
  • Tue, 1 December 2026 – Wed, 2 December 2026 Hanover Request
  • Mon, 14 December 2026 – Tue, 15 December 2026 Online Request
  • Tue, 12 January 2027 – Wed, 13 January 2027 Munich Request
  • Tue, 19 January 2027 – Wed, 20 January 2027 Online Request
  • Mon, 1 February 2027 – Tue, 2 February 2027 Stuttgart Request

Frequently asked questions

Do I need prior VS Code experience to use Cursor?

It helps, but it is not essential. Cursor is built on VS Code, so navigation, shortcuts and extensions feel familiar and existing settings can be imported. If you currently work with JetBrains IDEs or other editors, a short introduction during the course gets you up to speed quickly so you can concentrate on the AI features.

How do I prevent confidential code from reaching third parties?

Cursor offers a privacy mode and organisation settings that restrict how code is stored by the provider. You can also use ignore files to exclude sensitive areas from indexing and context. In the course we discuss how to align these options with internal policies, data protection requirements and sound handling of secrets.

What do rules add compared with well-written prompts?

A prompt applies to one request only, whereas rules persist and apply to the whole team. They capture architectural decisions, preferred libraries, testing strategies and style guidelines, so nobody has to repeat that information and the agent produces code that fits your codebase. Rules are versioned with the project and evolve together with it.

Is AI-generated code a security risk?

AI assistants sometimes reproduce insecure patterns, outdated libraries or even non-existent package names. The risk is manageable when generated code passes the same gates as hand-written code: peer review, SAST, dependency scanning and tests. In the course you set up exactly these guardrails while using AI yourself to find and fix vulnerabilities faster.

Should an AI agent be allowed to apply security fixes on its own?

We recommend a tiered model: the agent analyses, proposes fixes and opens pull requests, while humans approve the merge. For low-risk routine work such as dependency updates with passing tests, more automation can make sense. You learn to design permissions, sandboxing and audit trails so every decision remains traceable.

How much does “Cursor for Security and DevSecOps Teams” cost?

The course costs a flat €949 plus VAT per participant – whether online or on-site. This includes 2 training day(s) with a live trainer, course materials, a lab environment and a certificate of attendance.

Can I suggest my own date?

Yes. Our suggested dates are just a guide. In the request form you can always describe your preferred date or period in free text – we check availability and confirm within one working day.

Is the course online or on-site?

Both are possible: live online in a virtual classroom or on-site in Munich, Salzburg, Berlin, Augsburg, Hanover, Bremen, Stuttgart or Kaiserslautern. We can also run the course exclusively for your team.

More courses for Security and DevSecOps Teams

More Cursor courses

All 32 Cursor courses

Cursor · MunichCursor · SalzburgCursor · BerlinCursor · AugsburgCursor · HanoverCursor · BremenCursor · StuttgartCursor · KaiserslauternCursor · Online