Understand how vulnerabilities in your own code and in third-party dependencies contribute to your organization's overall security exposure, and how to measure and reduce that risk.
Your organization has exposure to vulnerabilities in both the code you write and maintain, and in the open source or third-party dependencies your code uses. Assessing your exposure to vulnerabilities is crucial if you want to prevent:
Unplanned downtime and operational disruption. Exploitation of vulnerabilities can result in application outages, degraded service quality, or cascading failures in critical systems, disrupting your business operations.
Increased remediation costs. The longer vulnerable code remains unaddressed, the more difficult and expensive it becomes to fix, especially if the code is deeply integrated or if incidents occur. Early detection and remediation reduce the risk of costly incident response, emergency patching, and reputational harm.
Widespread propagation of risk. Vulnerable modules and dependencies are often reused across multiple applications and services, meaning a single flaw can propagate throughout your organization, compounding the risk and impact of exploitation.
Supply chain compromise. Attackers can exploit vulnerabilities in open source or third-party dependencies to inject malicious code, elevate privileges, or gain unauthorized access to your systems. Compromised dependencies can serve as indirect entry points for malicious actors, leading to wide-reaching security incidents.
Regulatory and licensing issues. Many regulations and industry standards require organizations to proactively address known vulnerabilities in their software supply chain. Failing to remediate vulnerable dependencies can result in non-compliance, audits, legal penalties, or breaches of open source license obligations.
Regularly assessing vulnerability exposure helps you identify risks early and prioritize remediation.
Code scanning automatically monitors your project's code for vulnerabilities. When it detects a security issue in a pull request, it creates an alert with an autofix suggestion to resolve the vulnerability. This lowers the barrier to resolution and helps ensure your project remains secure. See Configuring default setup for code scanning.
Dependabot automatically monitors your project’s dependencies for vulnerabilities and outdated packages. When it detects a security issue or a new version, it creates pull requests to update the affected dependencies, helping you quickly address security risks and keep your software up to date. This reduces manual effort and helps ensure your project remains secure. See Dependabot quickstart guide.
GitHub provides a comprehensive set of Dependabot metrics to help you monitor, prioritize, and remediate these risks across all repositories in your organization. See Metrics for Dependabot alerts.
Reducing organizational vulnerability exposure requires ongoing visibility into risk, remediation progress, and policy enforcement across repositories. Dependabot and code scanning metrics provide this visibility. Use the following best practices to monitor and reduce your organization's vulnerability exposure:
Use the metrics overview for Dependabot to gain visibility into the current state of your organization's dependency vulnerabilities. See Viewing metrics for Dependabot alerts.
Use the alert view for code scanning to gain visibility into remediation activity in your organization's pull requests. See Viewing code scanning metrics for pull requests.
Focus on vulnerabilities that present the highest risk to your organization.