Published via [GitHub Executive Insights](https://github.com/solutions/executive-insights "Executive insights, curated just for you")

Developers have a lot on their plate, so fixing security vulnerabilities isn’t always their top priority. Security issues pile up, creating a backlog of known but unremediated vulnerabilities. This backlog is called “security debt.” It’s crucial to measure and track this debt to maintain a secure, compliant development environment and help prevent breaches. Failure to do so can lead to financial losses, reputational damage, and compliance penalties.

GitHub Security Overview makes it easier to monitor vulnerabilities so that you can take action on remediating them and securing your organization. This guide walks you through how to measure security debt, filter and slice data to focus on your priorities, and use Copilot Autofix to remediate vulnerabilities faster.

### **In this article, you will learn how to:**

* Navigate and use GitHub Security Overview to monitor, track, and address vulnerabilities.  
* Identify key metrics for measuring security debt.  
* Recognize signs that your security debt is increasing or decreasing.  
* Filter Security Overview data based on your priorities.  
* Apply best practices for scaling security monitoring.  
* Leverage Copilot Autofix to significantly reduce Mean Time to Remediation (MTTR).

---
__Accessing Security Overview__

The features you see in Security Overview depend on your [GitHub plan and subscriptions](https://github.com/security/plans). 

If your organization uses __GitHub Enterprise__ or __GitHub Team__, you can access the free __Secret Risk Assessment__, which evaluates [your exposure to leaked secrets](https://resources.github.com/enterprise/understanding-secret-leak-exposure/). To unlock Security Overview for private repositories, you’ll need to purchase either the Code Security or Secret Protection add-on. 

Public repository data, such as Dependabot and secret scanning alerts, is always accessible in Security Overview regardless of your subscription. However, if you only have one paid add-on (e.g., Secret Protection), you’ll only see private repository data for that feature and public repository data for free services. For example: 

- A subscription to __Secret Protection__ lets you see secret scanning data for private repositories but not code scanning data unless it’s for public repositories. 
- A __Code Security__ subscription works the same way but focuses on code scanning features. 

This tiered visibility helps you prioritize which services best fit your organization’s needs.

---

### **Key metrics for measuring security debt**

To access Security Overview, go to your organization page on GitHub.com and click the Security tab. If you cannot see the Security tab, select the “...”  dropdown menu, then click Security. From here you can see alerts from Dependabot, code scanning, or secret scanning for every repository in your organization.

Security Overview provides charts and metrics that make it easy to assess your team’s progress and risk posture. Many organizations use these insights in quarterly reviews, compliance reporting, and even board presentations.

Here are some common metrics you can use to track security debt:

* **Total open alerts**: The overall number of unresolved vulnerabilities.  
* **Severity levels**: Alerts categorized as critical, high, medium, or low.  
* **Reopened alerts**: Alerts that were previously closed but reopened, signaling potential policy or education gaps. This is a commonly overlooked metric.  
* **Age of alerts**: The average age of your unresolved alerts, so you can track changes in your overall response times.  
* **Impact analysis table:** This table highlights repositories with the highest number of unresolved alerts, offering a clear starting point for remediation efforts.

You should also keep tabs on the metrics found in the **Remediation** tab, which provide insights into your team's effectiveness at addressing vulnerabilities, including:

* **Closed alerts over time:** Tracks how many alerts your team resolves within a given period, helping you understand remediation velocity.  
* **Mean time to remediate (MTTR):** Measures the average time taken to resolve alerts, indicating how quickly your team addresses vulnerabilities. It’s a good proxy for how efficient your team is at resolving issues.  
* **Net resolve rate:** Compares the number of alerts closed to the number opened, showing whether your team is keeping up with incoming vulnerabilities.

**Signs your security debt might be increasing:**

* A declining net resolve rate, indicating that new vulnerabilities are outpacing your remediation efforts.  
* Rising numbers of critical or high-severity alerts.  
* An uptick in reopened alerts.  
* A growing average alert age, suggesting that vulnerability fixes are slowing down.  
* An increase in mean time to remediate, showing that vulnerabilities are taking longer to resolve.

**Your security debt might be decreasing if:** 

* You see a consistent trend of alert closures outpacing new alerts, especially for high-severity issues.  
* Improvements in your net resolve rate and reductions in mean time to remediate indicate your team is effectively managing and reducing security debt.

### **Filtering and slicing Security Overview data**

Security Overview gives you the flexibility to filter and analyze data so you can focus on the information that’s most relevant to your team.

Some of the ways you can filter Security Overview data include:

* **Severity:** Filter alerts by critical, high, medium, or low severity.  
* **Repository visibility**: Narrow your view based on repository type (e.g., public, private, or archived).  
* **Teams:** Use the `team` qualifier to identify repositories managed by specific teams.  
* [**Custom properties**](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization)**:** Group repositories by custom metadata, such as business unit, product, or compliance framework.

To better understand your data, you need to apply the filters that are specific to each tool. For example:

* **Dependabot alerts:** To effectively prioritize remediation, combine EPSS (Exploit Prediction Scoring System) scores—which predict the likelihood of real-world exploitation—with CVSS (Common Vulnerability Scoring System) scores, which measure the severity of vulnerabilities. Using these two scores together helps you quickly identify and address vulnerabilities that are both severe and likely to be exploited. Additionally, leverage the "Most important" sort option in Security Overview to automatically surface alerts that GitHub identifies as requiring immediate attention based on factors like exploitability, severity, and dependency usage across your repositories.  
* **Secret scanning alerts:** Filter alerts for secrets associated with your organization's most critical providers—such as cloud services, payment gateways, or identity providers as these leaks can lead directly to breaches or unauthorized access. Pay particular attention to secrets leaked publicly, as these pose immediate and significant security risks, requiring urgent remediation to prevent potential exploitation.

You can add multiple filters at once to drill into or slice the data to your choosing. For example, you can apply `Severity:Critical Visibility: Public` to view only critical alerts in public repositories.

### **Best practices for scaling**

As your organization grows, so does the complexity of your security posture. Scaling your security efforts effectively requires more than just monitoring alerts, it requires organizing your repositories, maintaining consistent practices, and streamlining workflows across teams.

* **Custom properties**: Use consistent naming conventions or metadata to group repositories logically to make it easier to manage, search, and apply policies across related repositories. Organizations with many microservices or other small repositories can use custom properties to group repositories by microservice or product.  
* **Bookmark filtered views**: While Security Overview doesn’t yet support saved filters, you can bookmark filter URLs for quick access to your preferred views without having to reapply filters each time.  
* **Export and API options**: Use CSV exports or the REST API to pull filtered data into your own reporting tools, or synchronize data between tools, to add Security Overview data to your existing processes.  
* **Prioritize critical repos**: Use the [Security Campaigns](https://docs.github.com/en/enterprise-cloud@latest/code-security/securing-your-organization/fixing-security-alerts-at-scale/creating-managing-security-campaigns) feature to target vulnerabilities in high-priority repositories to make the best use of limited developer resources.

### 

---

__What about branches?__ 

GitHub handles multiple branches in the following ways: 

- __Dependabot__: Only scans the default branch. 
- __Secret scanning and code scanning__: Scans the default branch, but can deduplicate alerts across branches and show a single alert with affected locations. 

For teams maintaining long-lived branches, this simplifies triage and reduces duplication, ensuring that risks are clearly communicated.

---

### 

### **Reducing security debt with Copilot Autofix**

Copilot Autofix goes beyond notifications with automatically generated vulnerability analysis, which includes detailed alert explanations, and, most importantly, suggested fixes that help developers remediate vulnerabilities as fast as they are found. Autofix supports all [CodeQL-supported languages and frameworks](https://codeql.github.com/docs/codeql-overview/supported-languages-and-frameworks/).

Experienced security talent is in short supply, but with Code Scanning Autofix, every developer benefits from the security expertise of Copilot whenever they need it. We’ve found that teams using Autofix remediate vulnerabilities 60% faster on average, significantly reducing Mean Time to Remediation (MTTR).

With Copilot Autofix, teams can pay down years’ worth of security debt through targeted campaigns. GitHub's [**Security Campaigns**](https://docs.github.com/en/enterprise-cloud@latest/code-security/securing-your-organization/fixing-security-alerts-at-scale/creating-managing-security-campaigns) feature leverages Autofix by enabling security teams to create focused remediation efforts across multiple repositories. Security Campaigns allow you to group related vulnerabilities and track remediation progress centrally. By combining Security Campaigns with Autofix, you can systematically and efficiently address your organization's accumulated security debt.

Here’s how it works:

* **In the pull request:** When a new vulnerability is found, Copilot Autofix generates an explanation and code suggestion to help fix the problem.  
* **For existing alerts:** Open an alert and press the “Generate fix” button.

Copilot Autofix provides explanations and code suggestions for around 90% of alert types so development and security teams can rapidly address the majority of alerts that comprise their security debt.

## **Final thoughts**

GitHub Security Overview is a comprehensive tool for managing security debt, tracking vulnerabilities, and enabling teams to prioritize risk effectively. Whether you’re using filters, campaigns, or Autofix, the key is to focus on metrics and workflows that align with your organization’s security and compliance goals.

For more information or to get started, visit the [GitHub Security Overview documentation](https://docs.github.com/en/code-security) or contact GitHub Field Services for tailored support.


GitHub Security Overview makes it easier to monitor vulnerabilities so that you can take action on remediating them and securing your organization. 

security-overview

Resource Page for /manage/security/debt

How to use GitHub Security Overview to manage security debt

Published via [GitHub Executive Insights](https://github.com/solutions/executive-insights "Executive insights, curated just for you") 

After deciding to enable Copilot for your development team comes the next big task—activating the licenses and managing features. For larger organizations this can feel daunting, but it doesn't need to be. As usual, a focus on the fundamentals and using the tools available will lead you to success.

<div class="embed-responsive embed-responsive-16by9">
<iframe title="Managing Copilot: Governance and GitHub Copilot | Beyond the Commit" src="https://www.youtube.com/embed/CwP81uyISuc?si=e4iiLS0IxKLPq3pP" width="640" height="480" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe></div>

Luis Pujols, senior customer success architect, joins host Christopher to discuss various strategies for managing a Copilot rollout. There are various approaches to enabling and managing licenses, from activating Copilot for an entire organization to custom solutions using the available REST APIs. He discusses the pros and cons of each to help you determine which will work best for your scenarios.

The next question typically raised is around usage. How can we measure adoption of Copilot, and in turn what strategy should we adopt if certain developers aren't utilizing Copilot. There are numerous REST APIs available for measuring usage and generating reports, allowing you to see adoption, code acceptance rates, and get breakdowns by language and other dimensions. From there you can work with your developers to determine what barriers they're facing to utilizing the tool to drive adoption and productivity increases.

Introducing Copilot to the code creation process doesn't change the DevOps process, in particular when it comes to code review. Field CTO Andrew Weiss calls in to highlight the fact that developers are still in charge. They want to read, review, and ensure the code suggested by Copilot does exactly what it should do and how it should be done.

In the end, Copilot is like any other developer tool, and can be approached as such. Rolling it out can follow normal patterns, measurements can be gathered, and the developer is always in charge of the code creation process.

## Docs 

- [Glossary: Measuring the impact of GitHub Copilot](https://resources.github.com/artificial-intelligence/how-to-measure-github-copilot-impact/) 
- [Embrace AI-powered software development](https://resources.github.com/embrace-ai-powered-software-development/)
- [Essential GitHub Copilot resources for enterprise teams](https://resources.github.com/enterprise/essential-copilot-resources/) 
- [Setting up GitHub Copilot for your enterprise](https://docs.github.com/en/enterprise-cloud@latest/copilot/setting-up-github-copilot/setting-up-github-copilot-for-your-enterprise) 

## Tools 
- [REST API endpoints for Copilot metrics](https://docs.github.com/en/rest/copilot/copilot-metrics?apiVersion=2022-11-28) 
- [REST API endpoints for Copilot user management](https://docs.github.com/en/rest/copilot/copilot-user-management?apiVersion=2022-11-28) 
- [Enabling Copilot for organizations in your enterprise](https://docs.github.com/en/enterprise-cloud@latest/copilot/managing-copilot/managing-copilot-for-your-enterprise/managing-access-to-copilot-in-your-enterprise/enabling-copilot-for-organizations-in-your-enterprise) 
- [Managing policies and features for Copilot in your enterprise](https://docs.github.com/en/enterprise-cloud@latest/copilot/managing-copilot/managing-copilot-for-your-enterprise/managing-policies-and-features-for-copilot-in-your-enterprise) 

---

Want to learn more about the strategic role of AI and other innovations at GitHub? Explore [Executive Insights](https://github.com/solutions/executive-insights) for more thought leadership on the future of technology and business.


Make sure the right people have access to the right tools the right way.

beyond-the-commit

Resource Page for /beyond-the-commit/governance-and-github-copilot

Managing Copilot: Governance and GitHub Copilot

Published via [GitHub Executive Insights](https://github.com/solutions/executive-insights "Executive insights, curated just for you")

We often hear the phrase "shift left" in the world of DevSecOps as the standard way of improving security in our applications. But what exactly does shift left mean? And how do we do it the right way?

<div class="embed-responsive embed-responsive-16by9">
<iframe title="Shift left the right way - creating more secure apps" src="https://www.youtube.com/embed/eQegu9jZRx8?si=wXaMO52no3Xr9l-N" width="640" height="480" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe></div>

Software Engineer [Angela Wen](https://github.com/angelapwen) joined Christopher to share her own experience with shift left. She starts by describing exactly what's meant by the phrase, and how it can fit into the development lifecycle. She highlights a couple of key challenges we can face in getting the approach right, from the fact that software engineers aren't typically security experts, and how we need to ensure we're getting the right information at the right time.

Field Services Director [Dan Shanahan](https://github.com/leftrightleft) calls in to talk about where shift left can often fail, and provides some guidance on how to ensure success. He highlights the importance of the experience for teams, developers, and security professionals, and providing the right resources to be successful.

With this background, Angela then walks us through a couple of the core tools available to us to drive secure software development. She starts by introducing code scanning, which traditionally meets developers at the time of the pull request (PR). This is the perfect time to let the developer know there's a potential security flaw, as they're looking for feedback on the code they've created. GitHub Copilot Autofix can even provide suggested remedies right inside the pull request, allowing the developer to commit the code with just a couple of clicks. In addition, campaigns allow teams to group together existing security tech debt and automate the process of generating fixes.

Beyond vulnerabilities introduced in code are leaked tokens. These are particularly dangerous as once they're in the codebase they're leaked, and it requires rotating the key, updating services, and other tasks to mitigate the risk. As Angela highlights, with secret scanning push protection these tokens can be blocked on push, meaning they never find their way into the codebase in the first place.

We close the conversation talking about the importance of the human factor in it all. There can be some tension between security teams and developers, which isn't helpful for anyone. At the end of it all, the core principle of ensuring everyone's needs are met helps drive success for everyone.

## Docs

- [What is DevSecOps?](https://github.com/resources/articles/devops/devsecops)  
- [Responsible use of Copilot Autofix for code scanning](https://docs.github.com/en/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning)  
- [Best practices for participating in a security campaign](https://docs.github.com/en/code-security/code-scanning/managing-code-scanning-alerts/best-practices-for-participating-in-a-security-campaign)  
- [Finding leaked passwords with AI: How we built Copilot secret scanning](https://github.blog/engineering/platform-security/finding-leaked-passwords-with-ai-how-we-built-copilot-secret-scanning/)  
- [Why application security tools fail and how DevSecOps fixes security debt](https://resources.github.com/application-security-tools-devsecops-fixes-security-debt/)

## Tools

- [About code scanning](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning)  
- [About secret scanning](https://docs.github.com/en/code-security/secret-scanning/introduction/about-secret-scanning)

---

Want to learn more about the strategic role of AI and other innovations at GitHub? Explore [Executive Insights](https://github.com/solutions/executive-insights) for more thought leadership on the future of technology and business.

Bring security to your developers, and developers to your security, the right way.

Resource Page for /beyond-the-commit/create-secure-apps

Shift left the right way - creating more secure apps

Form_Ungated_Contact

Tell us more about your needs

Wondering how GitHub can help your business?

Japanese GitHub Update and MS Build Recap 2025 May

172e02caeeae929b880d5d965f3324fa34c84adcb62eab994fd1ab5df3bac0b6-1920x1080

Resource Page for /2025may-ghupdate-msbuildrecap

CO-GHAI-VDEO-FY25-06Jun-12-GitHub-Update-and-MS-Build-Recap-Japanese-Content-9143

Japanese only: GitHub Update and MS Build Recap 2025 May

<div class="embed-responsive embed-responsive-16by9">
  <iframe src="https://www.youtube.com/embed/hcWezL8p_84" width="640" height="375" frameborder="0" allowfullscreen></iframe>
</div>

The future of software development is evolving fast—are you ready to stay ahead? Join us for an exclusive look at GitHub’s latest innovations and a sneak peek at what’s coming next. From AI-powered code reviews and enhanced IDE support to advanced security features and new collaboration tools, this session is designed to help your team build, ship, and scale faster than ever.

What’s in store for you: 
- A look at GitHub’s upcoming features and enhancements—plus the strategy driving their development.
- Insights from product leaders on how AI and automation are shaping the future of software development.
- Best practices to boost security, collaboration, and developer productivity.

Don’t miss this opportunity to stay ahead of the curve and see how GitHub can help your organization drive efficiency, security, and innovation.


Unlock what’s next: GitHub Roadmap Webinar, Q1 2025


The design features a dark background with abstract, futuristic blue and gold gradient shapes and circuit-like line elements. The GitHub logo is displayed in the bottom left corner. The text says the event date is Thursday, March 27, 2025.

/webcasts/github-roadmap-webinar-q1

Resource Page for /webcasts/github-roadmap-webinar-q1-asia-pacific

CO-GHP-WBNR-FY25-03Mar-13-Quarterly-Roadmap-Webinar-Q1-2025-APAC-8487

GitHub Roadmap Webinar, Q1 2025 - Asia Pacific

<div class="embed-responsive embed-responsive-16by9">
  <iframe src="https://www.youtube.com/embed/IrG4Kn1Zr4c" width="640" height="375" frameborder="0" allowfullscreen></iframe>
</div>

The future of software development is evolving fast—are you ready to stay ahead? Join us for an exclusive look at GitHub’s latest innovations and a sneak peek at what’s coming next. From AI-powered code reviews and enhanced IDE support to advanced security features and new collaboration tools, this session is designed to help your team build, ship, and scale faster than ever.

What’s in store for you: 
- A look at GitHub’s upcoming features and enhancements—plus the strategy driving their development.
- Insights from product leaders on how AI and automation are shaping the future of software development.
- Best practices to boost security, collaboration, and developer productivity.

Don’t miss this opportunity to stay ahead of the curve and see how GitHub can help your organization drive efficiency, security, and innovation.


Resource Page for /webcasts/github-roadmap-webinar-q1-europe-middle-east-africa

CO-GHP-WBNR-FY25-03Mar-13-Quarterly-Roadmap-Webinar-Q1-2025-EMEA-8487

GitHub Roadmap Webinar, Q1 2025 - Europe, Middle East and Africa

Home > Bottom > Banner (Accelerate...)

Curate blazing fast developer environments and help your organization be more agile, secure, and efficient.

Home > Bottom > Card #1 (Codespaces)

Ship secure applications with a community-driven, developer-first approach.


Home > Bottom > Card #2 (Adv. Sec.)

Automate your software workflows with a powerful DevOps toolkit and built-in CI/CD.

Home > Bottom > Card #3 (Actions)

Safely publish and consume packages within your organization.

Home > Bottom > Card #4 (Packages)

Home > Feature > Banner > CTA

Home > Feature > Banner (Learning Pathways)

Bring the power of generative AI to engineering teams with GitHub Copilot. Learn how you can maximize developer velocity and innovation.


Copilot card

Stay one step ahead by shipping your software securely within GitHub: Identify and fix security issues directly in the developer flow.

Security Card

Learn why more than 90% of the Fortune 100 use GitHub—the leading developer platform compared to alternative solutions.

Why GitHub? Card

Become a GitHub expert in CI/CD, application security, governance, and AI-developer tools through expert-guided learning pathways with tips and insights from leading enterprise organizations.

Resource Page for /learn/build-like-the-leading-tech-innovators

CO-GHG-CONTACT-FY23-10Oct-01-WW-Resources-Contact-Request/406214

GitHub Learning Pathways

Home > Final > Banner > CTA

Home > Final > Banner (Sales Team)

Home > Hero > CTA #1

Home > Hero > CTA #2

Set your business up for success with solutions to any number of common questions.

How to use GitHub Security Overview to manage security debt

Managing Copilot: Governance and GitHub Copilot

Shift left the right way - creating more secure apps

Browse by topic

Latest videos

Japanese only: GitHub Update and MS Build Recap 2025 May

GitHub Roadmap Webinar, Q1 2025 - Asia Pacific

GitHub Roadmap Webinar, Q1 2025 - Europe, Middle East and Africa

Accelerate innovation with the platform developers love

Codespaces

Advanced Security

Actions

Packages

Questions? Reach out to our sales team