Skip to content
NewsProduct launch

GitHub adds AI Scan adoption and remediation metrics to security overview

· by Pondero Newsdesk

The short version

GitHub's October 13 changelog gives organization and enterprise admins a security-overview dashboard that tracks AI Scan findings, remediation rates, and autofix adoption, letting them judge the AI-credit-billed feature's payoff without opening individual pull requests.

GitHub adds AI Scan adoption and remediation metrics to security overview

Security teams running GitHub's AI Scan could already see individual findings on a pull request, but had no way to tell whether the feature was paying for itself across an organization. GitHub closed that gap on October 13, 2026, shipping a security-overview dashboard that reports how many AI Scan findings got fixed and how developers are responding to them, per GitHub's changelog.

What happened

The new metrics show findings generated, findings resolved, a remediation rate, which repositories produced the findings, trend data over a selected reporting period, and how often developers accepted AI Scan's autofix suggestions, per GitHub's changelog. GitHub also split the pull request scanning page in two: what was the "CodeQL pull requests" page is now called "Code scanning on pull requests," with separate CodeQL and AI Scan tabs, and the AI Scan tab further breaks out how many findings came with an autofix suggestion versus how many did not. The dashboard is in public preview on github.com, including GitHub Enterprise Cloud, for customers with GitHub Code Security or GitHub Advanced Security. GitHub Enterprise Server is not supported in this release.

Credit-metered findings now come with a ledger

AI Scan itself runs on AI credits rather than flat per-seat pricing, and requires both a GitHub Advanced Security license and a Copilot license during its public preview, per GitHub's documentation. Its findings are advisory and never block a merge, so until this release, an admin who wanted to know whether that spend was moving the needle had to sample individual pull requests by hand. Now that work reduces to a number: a remediation rate and an autofix-acceptance rate an admin can pull up at the organization or enterprise level before the next budget conversation. For a security team already tracking GitHub Advanced Security costs, this is the first vendor-provided evidence to point to when deciding whether to expand AI Scan to more repositories or to hold the line at the current footprint.

Context

AI Scan covers languages and frameworks that CodeQL's static analysis does not reach, running on pull-request changes without needing CodeQL's default setup, per GitHub's documentation. It works as a complement to CodeQL rather than a replacement, and both engines now post results independently to the same pull request, labeled by source.

What to watch next

GitHub has not given a timeline for general availability or for extending the metrics to GitHub Enterprise Server, which currently gets no AI Scan dashboard at all. The clearest signal to watch for is whether GitHub Enterprise Server support ships before or after GA, since that gap keeps the feature out of reach for self-hosted enterprise customers who rely on Advanced Security today.

Sources