Introduction
CI/CD pipelines have grown dramatically more automated over the past few years — but one blind spot has persisted: what actually happens between a pull request being merged and confirmation that everything is running cleanly in production. Cursor has just shipped two features designed to close that gap exactly, available from September 23, 2026 for Teams and Enterprise plans.
Rollouts: Monitoring Every Change from Merge to Production
The first feature, Rollouts, attaches an automatic monitor to every pull request at the moment it's opened. The bot analyzes the diff, identifies the affected systems, and generates a monitoring plan that it posts as a comment before the deployment goes live. Once the change is deployed, Rollouts tracks its behavior in real time using logs, metrics, and traces surfaced by connected telemetry tools — Datadog being the primary integration.
The verdict is delivered per environment in plain terms: verified healthy, regression detected, or inconclusive. If a regression is identified, the bot notifies the change's authors and can automatically open a revert PR. The integration covers GitHub and the major continuous deployment systems, with feature flag support announced as the next step on the roadmap.
This approach marks a clear departure from standard practice, where catching a regression depends either on a pre-configured monitoring alert firing or on a user filing an incident report. Rollouts introduces systematic, contextual verification tied to each individual change — rather than to the system's overall health status.
Security Review: A Security Audit on Every PR
The second feature targets another blind spot: code security before it ever reaches production. Security Review analyzes every pull request in the full context of the codebase and consolidates its findings into a single comment.
The vulnerability coverage is broad: SQL, command, and template injection; authentication and authorization bypasses; exposed secrets and credentials; SSRF; unvalidated redirects; insecure deserialization; and dependency vulnerabilities. For each finding, the bot reports the severity level, traces the attack path from the user entry point to the vulnerable surface, and proposes a fix. Teams can also define custom rules to tailor the analysis to their specific business context or internal security standards.
The bot completes its analysis in an average of 3.8 minutes — a performance improvement of 21% over previous versions, making it compatible with fast deployment cadences without becoming a bottleneck.
The Bigger Picture
What makes these two tools compelling isn't novelty — regression detection and security review have both existed in well-equipped DevOps pipelines for years. It's their positioning as automatic, systematic steps natively embedded in the PR workflow, rather than managed through infrastructure scripts or manual processes.
For mid-sized engineering teams — often without a dedicated security specialist or a structured SRE function — the value is twofold: reducing reliance on ad hoc monitoring configurations, and establishing a first line of security defense without extending the human review cycle. Usage credits offered during the first ten days allow teams to trial both features on real changes before committing to a permanent rollout.
The broader trend is unmistakable: continuous deployment is maturing toward continuous verification, where every change carries its own observation plan and its own security audit — with no additional manual intervention required.