GitHub adds AI Scan metrics to security overview for admins

Organization and enterprise administrators on GitHub can now see how much AI Scan for pull requests is actually doing. In a changelog entry published October 13, GitHub said the security overview now reports how many AI Scan findings were generated, how many were resolved, the remediation rate, which repositories produced findings, trends across the selected reporting period, and how often developers applied autofix suggestions.

The company also renamed the “CodeQL pull requests” page to “Code scanning on pull requests” and split it into separate CodeQL and AI Scan tabs. Metrics that used to live on the old page now sit under the CodeQL tab, while the AI Scan tab shows total findings and how many of them include or do not include an autofix suggestion.

What the numbers are meant to answer

According to GitHub, the point is to let security teams judge the effectiveness of AI Scan across an organization or enterprise, understand how developers respond to it, and make rollout and investment decisions without reading through individual pull requests.

It is a public preview, available on github.com including GitHub Enterprise Cloud, for customers with GitHub Code Security or GitHub Advanced Security. GitHub Enterprise Server is not supported for this release.

GitHub has been steadily expanding AI-assisted security tooling in recent weeks, including a purpose-built model for leaked secret detection and an open source AI agent that surfaced Android vulnerabilities. If your organization already runs Code Security or Advanced Security, the new metrics should appear in security overview without a separate setup step.

GitHub points readers to its documentation on AI Scan for pull requests and an AI Scan community discussion for more detail.

Related reading

Sources

• Code scanning AI Scan metrics in security overview — GitHub Changelog