Resourcely made Terraform behave. Then Cursor bought it.

A developer needs a database. The clock is ticking.

It's a Tuesday. Somewhere in a cloud-native company, an engineer opens a form, fills in a few fields, and clicks a button. Out the other end comes clean, compliant Terraform - encrypted, access-scoped, tagged, logged. No ticket. No security review. No three-day wait for someone to say "yes." That quiet, uneventful moment was the entire point of Resourcely.

For most of cloud computing's history, that moment went badly. The developer either waited days for security to approve a hand-rolled config, or - more often - skipped the wait, copy-pasted infrastructure code from somewhere questionable, and shipped a misconfigured resource that would later show up in a breach report. Misconfiguration, not some cinematic hacker, is what quietly causes the majority of cloud security incidents. Resourcely was built on that unglamorous, expensive truth.

Founded in 2022 by Travis McPeak and Aladdin Almubayed, the San Francisco company had a deceptively simple pitch: make the secure way to build infrastructure also the easy way. Not a scanner that yells after the fact. Not a gate that blocks everyone. A set of guardrails that quietly keeps engineers on the road while letting them drive fast.

Three parts, one idea: guardrails, not gates.

Security teams set the rules once. Developers get a fast, safe path. Nobody has to argue about a pull request at 5pm on a Friday.

From "I need infra" to "it's compliant" - without a meeting.

From Netflix's cloud to Cursor's security team.

Travis McPeak did not arrive at this idea by accident. He spent years securing cloud infrastructure at Netflix, with a résumé that also runs through Databricks, IBM, HP and Symantec. The lesson he kept relearning was blunt: you cannot review your way to safety at scale. Add enough developers and enough velocity, and human approval becomes the bottleneck everyone routes around. The only durable fix is to make the safe path the path of least resistance.

So Resourcely built the machinery to do exactly that. Under the products sat a cloud parameter knowledge graph - a model of resources, parameters and their relationships - that powered context-aware defaults, conditional policies, and remediation guidance. Instead of a flat list of "don'ts," it understood how a given cloud resource actually fits together, and could steer configuration accordingly.

The company moved deliberately. At HashiConf in October 2024, Resourcely positioned itself as a way to scale infrastructure DevOps for HashiCorp's Terraform and the open-source fork OpenTofu, and launched a free tier - two Blueprints, two Guardrails - to widen the door. A month later, it reached general availability as a unified configuration platform. Small team, sharp focus, no wasted motion.

Then, in July 2025, the story took its turn. Anysphere - the company behind the runaway AI code editor Cursor, and, notably, one of Resourcely's own seed investors - acquired the startup. McPeak joined to lead security at Cursor. The logic was hard to miss: if your AI can generate infrastructure code faster than any human, then something had better make sure that infrastructure won't get you breached. Speed without guardrails is just a faster way to fail.

A short, tidy timeline.

Ship fast without asking permission every time.

For a platform or DevOps team, Resourcely meant defining the golden path once and letting the whole engineering org follow it by default. For a security team, it meant setting policy as code - in a language humans could read - and trusting it to enforce itself inside the existing GitOps flow. For a developer, it meant getting a compliant database, bucket or cluster in minutes, from a form, without becoming a Terraform expert or a compliance lawyer.

The customers who leaned in were cloud-native enterprises - including financial and Fortune 1000 organizations - the kind of places where a single public S3 bucket is a very bad day and where "just review everything by hand" stopped scaling long ago.

Who else was in the room.

Resourcely lived at the crossroads of policy-as-code and cloud configuration. Its neighbors included HashiCorp Sentinel and Open Policy Agent (OPA/Styra) on the policy side; Firefly, env0, Spacelift and Terrateam on the infrastructure-workflow side; and cloud security posture tools like Wiz and Prisma Cloud on the detection side. Resourcely's angle was prevention at the point of creation - stopping the misconfiguration before it existed, rather than flagging it after.

That Tuesday, revisited.

Return to the developer with the form. Before Resourcely, that moment was a negotiation - between speed and safety, between shipping and reviewing, between the engineer who wanted to move and the security team that wanted to sleep. Resourcely's quiet trick was to dissolve the negotiation entirely. The fast path and the safe path became the same path.

Now that the technology sits inside Anysphere, the same question scales up. Cursor can already write your Terraform in seconds. The bet behind the acquisition is that it can also make sure that Terraform won't leak, won't drift, and won't end up in a breach report. The form is still there. The button still gets clicked. The difference is that the conscience now travels with the code.

Interviews and demos.