Cursor Rollouts and Security Review (23 Sep 2026): Buyer Checklist for Deploy Health and PR Security

Verdict: On 23 September 2026, Cursor announced Rollouts and Security Review — two bots aimed at the last mile of shipping code. Rollouts watches each change as it deploys and reports health per environment (verified healthy, regression detected, or inconclusive). Security Review posts one PR comment focused on exploitable bugs (injection, authz bypasses, secrets, SSRF, unsafe deserialization, vulnerable dependency changes), leaving style/quality to Bugbot. Both are available on Teams and Enterprise plans. For buyers rolling out coding agents, treat this as a governance checklist — not a new foundation model.

Best for: Engineering leaders already on Cursor Teams/Enterprise who need deploy verification and security review automation.
Not for: Solo hobbyists on free tiers who do not ship through CI/CD.

Based on Cursor’s public changelog dated 23 Sep 2026 — plan packaging, credit promos, and integration availability can change. Confirm live eligibility on your Cursor dashboard.

What shipped

Rollouts attaches a monitor to pull requests, drafts a monitoring plan (risks, intended effects, signals, instrumentation gaps), wakes on deploy events, and judges each environment separately. On regression it can notify authors, open a revert PR for review, or hand work to a cloud agent — it does not merge or roll back alone. Integrations called out include Origin or GitHub for source control, CD systems for deploy events, and Datadog/other telemetry; feature-flag integration is marked coming soon. Security Review skips draft PRs, supports dismiss-with-reason, and can enforce team-specific rules (for example which tables request handlers may touch). Start from the 23 Sep 2026 changelog.

Buyer checklist

1. Confirm plan fit — Teams/Enterprise only per the announcement; do not promise these bots on lower SKUs.
2. Wire deploy + telemetry first — Rollouts needs CD events and logs/metrics/traces or verdicts stay inconclusive.
3. Edit the monitoring plan — treat the auto-written PR plan as a draft your on-call owners must own.
4. Decide regression actions — notify-only versus revert-PR versus cloud-agent fix; write the policy before enabling auto paths.
5. Scope Security Review repos — enable per repository; align severity handling with your existing AppSec SLA.
6. Separate Bugbot vs Security Review — style stays with Bugbot; do not double-count license expectations.
7. Use intro credits deliberately — changelog notes roughly 50 (Teams) / 500 (Enterprise) Rollouts trial credits for about 10 days; calendar the end date.
8. Cost check — no separate public dollar SKU in the changelog; confirm whether usage burns existing Cursor usage pools or add-ons in your contract.

Strengths

• Closes the gap between “agent wrote a PR” and “production is healthy.”
• Security Review focuses on exploitable findings, not nitpicky style.
• Per-environment verdicts match real staging-then-prod workflows.
• Team rules let you encode org-specific unsafe patterns.

Limits

• Teams/Enterprise gate excludes many individual seats.
• Without solid telemetry, Rollouts cannot prove health.
• Auto revert/fix paths still need human merge discipline.
• Not a replacement for a full AppSec program or pen test.

Who should act

Platform and security engineering teams already standardizing on Cursor should pilot Rollouts on one service and Security Review on one critical repo this sprint. Startups without CD hooks can wait. Multi-tool enterprises should compare with existing change-management and SAST vendors rather than assuming Cursor bots replace them.

Bottom line

Best next step is a governed pilot: one repo, Rollouts + Security Review enabled, telemetry connected, written regression policy. Not a reason to buy Enterprise solely for these bots if you lack deploy instrumentation. Read the 23 Sep 2026 changelog, confirm plan entitlements, then expand. Versus DIY deploy watchers, Rollouts wins PR-native workflow — if you already pay for Cursor Teams/Enterprise.