How GitHub scaled AI fluency across its workforce by focusing on people not just technology.

copilot

Resource Page for /enterprise/ai-powered-workforce-playbook

GitHub’s internal playbook for building an AI-powered workforce

enterprise roundup

Resource Page for /enterprise-content-roundup/july

July ‘25 enterprise roundup

Published via [GitHub Executive Insights](https://github.com/solutions/executive-insights "Executive insights, curated just for you")

Developers have a lot on their plate, so fixing security vulnerabilities isn’t always their top priority. Security issues pile up, creating a backlog of known but unremediated vulnerabilities. This backlog is called “security debt.” It’s crucial to measure and track this debt to maintain a secure, compliant development environment and help prevent breaches. Failure to do so can lead to financial losses, reputational damage, and compliance penalties.

GitHub Security Overview makes it easier to monitor vulnerabilities so that you can take action on remediating them and securing your organization. This guide walks you through how to measure security debt, filter and slice data to focus on your priorities, and use Copilot Autofix to remediate vulnerabilities faster.

### **In this article, you will learn how to:**

* Navigate and use GitHub Security Overview to monitor, track, and address vulnerabilities.  
* Identify key metrics for measuring security debt.  
* Recognize signs that your security debt is increasing or decreasing.  
* Filter Security Overview data based on your priorities.  
* Apply best practices for scaling security monitoring.  
* Leverage Copilot Autofix to significantly reduce Mean Time to Remediation (MTTR).

---
__Accessing Security Overview__

The features you see in Security Overview depend on your [GitHub plan and subscriptions](https://github.com/security/plans). 

If your organization uses __GitHub Enterprise__ or __GitHub Team__, you can access the free __Secret Risk Assessment__, which evaluates [your exposure to leaked secrets](https://resources.github.com/enterprise/understanding-secret-leak-exposure/). To unlock Security Overview for private repositories, you’ll need to purchase either the Code Security or Secret Protection add-on. 

Public repository data, such as Dependabot and secret scanning alerts, is always accessible in Security Overview regardless of your subscription. However, if you only have one paid add-on (e.g., Secret Protection), you’ll only see private repository data for that feature and public repository data for free services. For example: 

- A subscription to __Secret Protection__ lets you see secret scanning data for private repositories but not code scanning data unless it’s for public repositories. 
- A __Code Security__ subscription works the same way but focuses on code scanning features. 

This tiered visibility helps you prioritize which services best fit your organization’s needs.

---

### **Key metrics for measuring security debt**

To access Security Overview, go to your organization page on GitHub.com and click the Security tab. If you cannot see the Security tab, select the “...”  dropdown menu, then click Security. From here you can see alerts from Dependabot, code scanning, or secret scanning for every repository in your organization.

Security Overview provides charts and metrics that make it easy to assess your team’s progress and risk posture. Many organizations use these insights in quarterly reviews, compliance reporting, and even board presentations.

Here are some common metrics you can use to track security debt:

* **Total open alerts**: The overall number of unresolved vulnerabilities.  
* **Severity levels**: Alerts categorized as critical, high, medium, or low.  
* **Reopened alerts**: Alerts that were previously closed but reopened, signaling potential policy or education gaps. This is a commonly overlooked metric.  
* **Age of alerts**: The average age of your unresolved alerts, so you can track changes in your overall response times.  
* **Impact analysis table:** This table highlights repositories with the highest number of unresolved alerts, offering a clear starting point for remediation efforts.

You should also keep tabs on the metrics found in the **Remediation** tab, which provide insights into your team's effectiveness at addressing vulnerabilities, including:

* **Closed alerts over time:** Tracks how many alerts your team resolves within a given period, helping you understand remediation velocity.  
* **Mean time to remediate (MTTR):** Measures the average time taken to resolve alerts, indicating how quickly your team addresses vulnerabilities. It’s a good proxy for how efficient your team is at resolving issues.  
* **Net resolve rate:** Compares the number of alerts closed to the number opened, showing whether your team is keeping up with incoming vulnerabilities.

**Signs your security debt might be increasing:**

* A declining net resolve rate, indicating that new vulnerabilities are outpacing your remediation efforts.  
* Rising numbers of critical or high-severity alerts.  
* An uptick in reopened alerts.  
* A growing average alert age, suggesting that vulnerability fixes are slowing down.  
* An increase in mean time to remediate, showing that vulnerabilities are taking longer to resolve.

**Your security debt might be decreasing if:** 

* You see a consistent trend of alert closures outpacing new alerts, especially for high-severity issues.  
* Improvements in your net resolve rate and reductions in mean time to remediate indicate your team is effectively managing and reducing security debt.

### **Filtering and slicing Security Overview data**

Security Overview gives you the flexibility to filter and analyze data so you can focus on the information that’s most relevant to your team.

Some of the ways you can filter Security Overview data include:

* **Severity:** Filter alerts by critical, high, medium, or low severity.  
* **Repository visibility**: Narrow your view based on repository type (e.g., public, private, or archived).  
* **Teams:** Use the `team` qualifier to identify repositories managed by specific teams.  
* [**Custom properties**](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization)**:** Group repositories by custom metadata, such as business unit, product, or compliance framework.

To better understand your data, you need to apply the filters that are specific to each tool. For example:

* **Dependabot alerts:** To effectively prioritize remediation, combine EPSS (Exploit Prediction Scoring System) scores—which predict the likelihood of real-world exploitation—with CVSS (Common Vulnerability Scoring System) scores, which measure the severity of vulnerabilities. Using these two scores together helps you quickly identify and address vulnerabilities that are both severe and likely to be exploited. Additionally, leverage the "Most important" sort option in Security Overview to automatically surface alerts that GitHub identifies as requiring immediate attention based on factors like exploitability, severity, and dependency usage across your repositories.  
* **Secret scanning alerts:** Filter alerts for secrets associated with your organization's most critical providers—such as cloud services, payment gateways, or identity providers as these leaks can lead directly to breaches or unauthorized access. Pay particular attention to secrets leaked publicly, as these pose immediate and significant security risks, requiring urgent remediation to prevent potential exploitation.

You can add multiple filters at once to drill into or slice the data to your choosing. For example, you can apply `Severity:Critical Visibility: Public` to view only critical alerts in public repositories.

### **Best practices for scaling**

As your organization grows, so does the complexity of your security posture. Scaling your security efforts effectively requires more than just monitoring alerts, it requires organizing your repositories, maintaining consistent practices, and streamlining workflows across teams.

* **Custom properties**: Use consistent naming conventions or metadata to group repositories logically to make it easier to manage, search, and apply policies across related repositories. Organizations with many microservices or other small repositories can use custom properties to group repositories by microservice or product.  
* **Bookmark filtered views**: While Security Overview doesn’t yet support saved filters, you can bookmark filter URLs for quick access to your preferred views without having to reapply filters each time.  
* **Export and API options**: Use CSV exports or the REST API to pull filtered data into your own reporting tools, or synchronize data between tools, to add Security Overview data to your existing processes.  
* **Prioritize critical repos**: Use the [Security Campaigns](https://docs.github.com/en/enterprise-cloud@latest/code-security/securing-your-organization/fixing-security-alerts-at-scale/creating-managing-security-campaigns) feature to target vulnerabilities in high-priority repositories to make the best use of limited developer resources.

### 

---

__What about branches?__ 

GitHub handles multiple branches in the following ways: 

- __Dependabot__: Only scans the default branch. 
- __Secret scanning and code scanning__: Scans the default branch, but can deduplicate alerts across branches and show a single alert with affected locations. 

For teams maintaining long-lived branches, this simplifies triage and reduces duplication, ensuring that risks are clearly communicated.

---

### 

### **Reducing security debt with Copilot Autofix**

Copilot Autofix goes beyond notifications with automatically generated vulnerability analysis, which includes detailed alert explanations, and, most importantly, suggested fixes that help developers remediate vulnerabilities as fast as they are found. Autofix supports all [CodeQL-supported languages and frameworks](https://codeql.github.com/docs/codeql-overview/supported-languages-and-frameworks/).

Experienced security talent is in short supply, but with Code Scanning Autofix, every developer benefits from the security expertise of Copilot whenever they need it. We’ve found that teams using Autofix remediate vulnerabilities 60% faster on average, significantly reducing Mean Time to Remediation (MTTR).

With Copilot Autofix, teams can pay down years’ worth of security debt through targeted campaigns. GitHub's [**Security Campaigns**](https://docs.github.com/en/enterprise-cloud@latest/code-security/securing-your-organization/fixing-security-alerts-at-scale/creating-managing-security-campaigns) feature leverages Autofix by enabling security teams to create focused remediation efforts across multiple repositories. Security Campaigns allow you to group related vulnerabilities and track remediation progress centrally. By combining Security Campaigns with Autofix, you can systematically and efficiently address your organization's accumulated security debt.

Here’s how it works:

* **In the pull request:** When a new vulnerability is found, Copilot Autofix generates an explanation and code suggestion to help fix the problem.  
* **For existing alerts:** Open an alert and press the “Generate fix” button.

Copilot Autofix provides explanations and code suggestions for around 90% of alert types so development and security teams can rapidly address the majority of alerts that comprise their security debt.

## **Final thoughts**

GitHub Security Overview is a comprehensive tool for managing security debt, tracking vulnerabilities, and enabling teams to prioritize risk effectively. Whether you’re using filters, campaigns, or Autofix, the key is to focus on metrics and workflows that align with your organization’s security and compliance goals.

For more information or to get started, visit the [GitHub Security Overview documentation](https://docs.github.com/en/code-security) or contact GitHub Field Services for tailored support.


GitHub Security Overview makes it easier to monitor vulnerabilities so that you can take action on remediating them and securing your organization. 

security-overview

Resource Page for /manage-security-debt

How to use GitHub Security Overview to manage security debt

In this webinar, we summarized the updates announced in the Changelog by product, such as GitHub Copilot, Actions, and Security. In addition, we welcomed JFrog as a guest and introduced the integration between GitHub and JFrog and the JFrog Copilot Extension.

This webinar is in Japanese only: Introducing the latest GitHub updates and JFrog integrations

Video and materials released: GitHub Webinar Summer Vacation Special held on August 20th

Resource Page for /video/jp-2025Aug-summerspecial

This contents are in Korean only: Archived video and presentation slides from a webinar streamed in June 2025.

ThumbnailKR Webinar June5 GitHub최신 기능 데모 및 업데이트：Microsoft Build 하이라이트

Resource Page for /video/kr-2025June-msbuildrecap

Korean Only - Jun 5 : GitHub Copilot Latest Updates - MS Build Recap

# reAgent - the event for agent builders highlights

🚀 GitHub, Neon, and Madrona cohosted reAgent to bring together a community designed for founders, developers, and engineering leaders looking to build, scale, and accelerate the Agentic web.

- [Nick Turley](https://www.linkedin.com/in/nicholasturley), Head of Product, [OpenAI](https://openai.com/) [ChatGPT](https://chatgpt.com/)
- [Nikita Shamgunov](https://www.linkedin.com/in/nikitashamgunov/), CEO of [Neon](https://neon.tech/)
- [Filip Kozera](https://www.linkedin.com/in/filipkozera/), CEO of [Wordware](https://app.wordware.ai/lp)
- [Matan Grinberg](https://www.linkedin.com/in/matan-grinberg/), CEO of [Factory](https://www.factory.ai/)
- [Idan Gazit](https://www.linkedin.com/in/idangazit/), Head of [GitHub Next](https://githubnext.com/)
- [Nancy Xu](https://www.linkedin.com/in/xnancy/), CEO of [Moonhub
](https://www.moonhub.ai/)
Moderated by [Jon Turow](https://www.linkedin.com/in/jturow/) ([Madrona](https://www.madrona.com/)), [Eric Newcomer](https://www.linkedin.com/in/ericpnewcomer/) ([Newcomer](https://www.newcomer.co/)), and [Vivek Ramaswami](https://www.linkedin.com/in/vivekramaswami/) ([Madrona](https://www.madrona.com/)). You can follow [Jon Turow’s Substack](https://jonturow.substack.com/) for more insights about the future of agentic AI and events like reAgent.

Key takeaways from the panels:

🤖 Agents are AI-tools that can perceive and reason, makes decisions, and take actions autonomously to achieve specific goals

🚀 Platform shifts are characterized by their impact on human behavior - AI is no different

🔒 Trust. Agents win only when users feel confident relinquishing control

🧩 The Agentic future is in verticalized agents, not just horizontal platforms.

If you're building a startup - [apply for GitHub for Startups today](http://resources.github.com/startups/?pid=reagent) to receive startup friendly pricing on GitHub Enterprise, Advanced Security, and the support you need to build, scale, and deliver secure software 🚀

Gated video page generic form

Tell us a bit about you

Sign up to watch

AI agents are accelerating the way work is done, how software and technology is being created and maintained, and agentic systems are not just horizontal platforms, but verticalized and open source. This video is designed for founders, developers, and leaders looking to build and use agents across their work.

🚀 GitHub, Neon, and Madrona cohosted reAgent to bring together a community designed for founders, developers, and engineering leaders looking to build, scale, and accelerate the Agentic web.

Resource Page for reagent-the-event-for-agent-builders-highlights/

CO-GHG-VDEO-FY26-07Jul-18-reAgent-Gated-Watch-On-Demand-GitHub-Open-Source-Funding-9196

reAgent - the event for agent builders highlights

Home > Bottom > Banner (Accelerate...)

Curate blazing fast developer environments and help your organization be more agile, secure, and efficient.

Home > Bottom > Card #1 (Codespaces)

Ship secure applications with a community-driven, developer-first approach.


Home > Bottom > Card #2 (Adv. Sec.)

Automate your software workflows with a powerful DevOps toolkit and built-in CI/CD.

Home > Bottom > Card #3 (Actions)

Safely publish and consume packages within your organization.

Home > Bottom > Card #4 (Packages)

Home > Feature > Banner > CTA

Home > Feature > Banner (Learning Pathways)

Bring the power of generative AI to engineering teams with GitHub Copilot. Learn how you can maximize developer velocity and innovation.


Copilot card

Stay one step ahead by shipping your software securely within GitHub: Identify and fix security issues directly in the developer flow.

Security Card

Learn why more than 90% of the Fortune 100 use GitHub—the leading developer platform compared to alternative solutions.

Why GitHub? Card

Form_Ungated_Contact

Tell us more about your needs

Wondering how GitHub can help your business?

Become a GitHub expert in CI/CD, application security, governance, and AI-developer tools through expert-guided learning pathways with tips and insights from leading enterprise organizations.

Resource Page for /learn/build-like-the-leading-tech-innovators

CO-GHG-CONTACT-FY23-10Oct-01-WW-Resources-Contact-Request/406214

GitHub Learning Pathways

Home > Final > Banner > CTA

Home > Final > Banner (Sales Team)

Home > Hero > CTA #1

Home > Hero > CTA #2

Set your business up for success with solutions to any number of common questions.

Resources to help enterprise teams do their best work

Copilot

Security

Why GitHub?

GitHub Learning Pathways

Latest articles

GitHub’s internal playbook for building an AI-powered workforce

July ‘25 enterprise roundup

How to use GitHub Security Overview to manage security debt

Browse by topic

Latest videos

Video and materials released: GitHub Webinar Summer Vacation Special held on August 20th

Korean Only - Jun 5 : GitHub Copilot Latest Updates - MS Build Recap

reAgent - the event for agent builders highlights

Accelerate innovation with the platform developers love

Codespaces

Advanced Security

Actions

Packages

Questions? Reach out to our sales team