GitHub adds metrics to track AI security findings and developers’ fixes

GitHub is giving security teams a way to track what happens after AI Scan flags an issue—not just how many findings it produces. On October 13, it added organization- and enterprise-level metrics to security overview, letting administrators see resolved findings, remediation rates and developers’ use of suggested fixes in one place.

From findings to developer response

The metrics cover AI Scan for pull requests. Administrators can see how many findings were generated and how many were resolved, alongside the remediation rate. That puts the volume of findings and the rate of resolution in the same reporting view.

The view also identifies repositories that generated findings and shows trends over the selected reporting period. Security teams can therefore examine activity across their organization or enterprise rather than review individual pull requests to assemble that picture.

Suggested fixes get their own measures. GitHub tracks how often developers applied autofix suggestions, while the AI Scan tab separates findings that include a suggestion from those that do not. The dashboard distinguishes the availability of a proposed fix from developers’ use of those suggestions.

A renamed page keeps the tools separate

To find the metrics, administrators should look for “Code scanning on pull requests” in security overview. That is the new name for the “CodeQL pull requests” page. It now has separate CodeQL and AI Scan tabs, rather than placing both sets of metrics under the old CodeQL page name.

Existing CodeQL pull-request metrics remain available under the CodeQL tab. The AI Scan tab shows total findings, including the split between findings with and without an autofix suggestion. The change adds an AI Scan reporting view while retaining the existing CodeQL metrics in their own tab.

GitHub says the metrics are intended to help security teams evaluate AI Scan’s effectiveness, understand developer response and make rollout and investment decisions. Its October 13 changelog introduces the measurement tools; it does not present a measured improvement in security outcomes.