In a nutshell
GitHub Advanced Security (GHAS) is GitHub's paid security suite. It scans your repositories for two things developers leak by accident: credentials and vulnerable code.
It comes as two products you buy separately — Secret Protection and Code Security.
Why now
A global network that brings together cybersecurity teams from around the world.
Founded in 1990. Security teams from more than 850 companies, government bodies, universities and other institutions across 110+ countries are members.
What it does
- Shares cyber attack information: members share what they see about attacks and software flaws (vulnerabilities) worldwide, to stop the damage from spreading.
- Builds the shared "danger rulers" everyone uses
The June 2026 release, in short
- Thanks to AI, bugs are being found at a record pace. But truly dangerous attacks have not gone up with them.
- Don't try to fix every bug one by one. Use signals like EPSS to fix the truly dangerous ones first.
In one line: an organization where the world works together on information sharing and common rules to keep the internet safe to use.
Record CVE volume
FIRST ↗ forecasts a record ~66,000 new CVEs ↗ published in 2026 alone. AI-assisted discovery is a key driver.
GHSA +449% YoY
GitHub added curators and AI tooling. Its free Advisory Database ↗ feeds Dependabot (left).
AI vs AI race
AI-built exploits against AI-built patches. Time to exploitation is already down to 24 hours (right).
Dependabot alerts up 4x+
New alerts across GitHub, per quarter.
Steady at 70–80M through 2025, then a jump. CVE alerts are up 6x since February 2026.
Time to exploitation
Mean time from CVE disclosure to first exploitation.
Based on 3,500+ confirmed-exploited CVEs (CISA KEV + VulnCheck KEV) · zerodayclock.com
FIRST’s four recommendations 📖 Docs
Traditional security can’t keep up. The volume of new, AI-generated code outpaces what any traditional review process can inspect, and it arrives across many new surfaces at once. Gating at the pull request is already too late once an agent has propagated a change across repos.
🔧 Plan for double the patching work
Software maintainers should expect twice the work, while live-system patching stays roughly steady through 2026.
💰 Budget for security
With more CVEs and a growing software estate, allocating a dedicated security budget is imperative.
🎯 Triage by severity and exploitability
FIRST also recommends assessing severity with CVSS ↗, adjusted to your environment. Complement this with exploitability signals: Dependabot alerts show the EPSS score ↗, the likelihood of real-world exploitation.
🤖 Use defensive AI now
Exploitation is faster than ever. Attackers reach the same frontier models, and cost is no object. They find and weaponize risk faster than defenders can triage it, and supply chain attacks move faster than any human review cycle.
Data leaks in Japan (as of 2026-10-22) 📖 Docs
Public disclosure dates, including the cited updates.
A wave of data leaks at Japanese companies
Cyber threats surged in 2026. In H1, suspicious accesses detected by police sensors rose 51% year over year; reported ransomware cases hit a half-year record of 123 (Japan NPA ↗).
Public disclosure dates, including updates, oldest first. As of 2026-10-22.
How GHAS answers it
Scanning tools normally live outside the platform: a separate console, a separate backlog, and findings that reach the developer days after the code was written. GHAS puts all four steps where the code already is.
What’s inside 📖 Docs
Pricing 📖 Docs
| Product | Price | Billing unit |
|---|---|---|
| 🔑 GitHub Secret Protection | $19 / month | active committer |
| 🔍 GitHub Code Security | $30 / month | active committer |
| 📦 Both together | $49 / month | active committer |
- 👥 Active committer = someone who pushed to a repo with the feature on in the past 90 days. Counted once across every repo and org; GitHub App bots don’t count
- 🏷️ Sold on GitHub Team and GitHub Enterprise. On Enterprise Server and GHE.com every repository needs a licence
- 🌐 Public repos get most features free, not all — custom patterns, delegated bypass, AI-detected secrets, campaigns and Security overview still need a licence (exact split ↗)
Pre-purchase inventory — Risk Assessments 📖 Docs
Two free assessments run from Org → Security → Assessments and show what is already hiding in your repos. No licence, no trial, and you see the numbers before deciding to buy.
🔑 Secret Risk Assessment
Types and count of secrets sitting in your org's repositories, aggregated by category.
🔍 Code Security Risk Assessment
Code vulnerabilities found by CodeQL, broken down by severity, language, and how many Copilot Autofix can fix.
- 🛂 Only organization owners and security managers can run them
- 🏷️ GitHub Team and GitHub Enterprise Cloud (Server support expected in 3.22)
- 🧪 You can start a GHAS trial directly from the results ↗, which is the natural next step once you have the numbers
Rolling out across the enterprise
One configuration at Enterprise → Settings → Advanced Security → Code security rolls out to every org and repo. New configuration opens pre-filled with GitHub recommended.
You can now enforce enterprise security configurations across both new and existing repositories, preventing organization and repository admins from overriding those policies. September 15 announcement ↗
Visualizing coverage 📖 Docs
-
ENTERPRISE LEVEL
Open octodemo → Security overview ↗ and show the detection / remediation / prevention trends. Then switch to the Coverage and Risk views.
Only orgs where you are owner or security manager are aggregated.
-
ORGANIZATION LEVEL
Open theomonfort-org → Security overview ↗ to show the same dashboard scoped to one org.
This is the view teams use day to day.
-
REPOSITORY LEVEL
Drill down to one repository with ghas-test-1 → Security and quality ↗.
Enterprise → Org → Repo: the same alerts, narrowed step by step.
Once the configuration is out, the question becomes “how far are we actually covered?” The Security and quality tab answers it at both Enterprise and Organization level.
| View | What it answers | Level |
|---|---|---|
| 📊 Overview | Detection / remediation / prevention trends | Ent + Org |
| 📈 Coverage | Which repos have which feature enabled | Ent + Org |
| 🛡️ Risk | Which repos carry the most alerts | Ent + Org |
| 🌐 Public monitoring | Secrets your members leaked in public repos across GitHub | Ent only |
- 🏢 Org-level Coverage is the day-to-day view — enterprise views only aggregate orgs where you are an owner or security manager
- 🌐 Public monitoring (public preview, needs Secret Protection) attributes leaks by enterprise membership and verified domain. Turn it on at Enterprise → Settings → Advanced Security → Code security
- 📤 Export CSV on Overview / Coverage / Risk keeps the filters you already applied