Detailed explanations of metrics, calculations, and data visualizations on the overview page of your security overview.
In security overview, the overview dashboard displays security alert metrics for your organization. You can use the dashboard to monitor the health of your application security program, collaborate with engineering teams, and gather data for benchmarking purposes.
The dashboard displays trending data that tracks alert counts and activity over time, as well as snapshot data that reflects the current state. All data and metrics across the dashboard change as you apply filters. By default, the dashboard displays all alerts from GitHub tools, but you can use the tool filter to show alerts from a specific tool (secret scanning, Dependabot, code scanning using CodeQL, a specific third-party tool) or all third-party code scanning tools. See Filtering alerts in security overview.
Trend indicators show percentage change compared to the previous period. For example:
Alert severity filtering: The dashboard only includes alerts with security severity levels: Critical, High, Medium, or Low. Non-security alerts (Error, Warning, or Note) are excluded. This may cause the dashboard count to differ from code scanning alert totals. For more information, see Code scanning alerts.
The data that populates the overview page can and will change over time due to various factors, such as repository deletion or modifications to a security advisory. This means that the overview metrics for the same time period could vary if viewed at two different times. For compliance reports or other scenarios where data consistency is crucial, we recommend that you source data from the audit log. See Auditing security alerts.
The overview page tracks how security alerts changed over time. However, when you filter by another attribute, such as repository status, it uses that attribute's current value, not its historical value.
For example, archiving a repository closes any open alerts it contains. If you view the overview page for a week before you archived the repository:
The dashboard is divided into three tabs, each focused around a different security goal:
Note
Unlike the Detection and Remediation tabs which report alerts on the default branch, the Prevention tab gives you insights for CodeQL alerts found in merged pull requests and AI Scan findings from pull requests.
Track the current state of security alerts in your organization.
Shows the change in the number of open alerts over the time period you have chosen. By default, alerts are grouped by severity. You can change the way alerts are grouped.
The average age of all alerts that are still open at the end of the chosen time period.
Formula: The age of each open alert is calculated by subtracting the date the alert was created from the date that the chosen time period ends, then averaging across all open alerts.
Note
For reopened alerts, the age is calculated by subtracting the original creation date rather than the date the alert was reopened.
The total number of open alerts that were reopened during the chosen time period. Only alerts that are open at the end of the reporting period are reported. This includes:
Shows the ratio of secrets bypassed to the total secrets blocked by push protection.
Click View details to view the secret scanning report with the same filters and time period selected.
For more information on secret scanning push protection metrics, see Viewing metrics for secret scanning push protection.
The impact analysis table has separate tabs showing data for: "Repositories," "Advisories," and "SAST vulnerabilities."
Track how quickly and effectively alerts are resolved.
Shows the change in the number of closed alerts over the time period you have chosen. By default, alerts are grouped by severity. You can change the way alerts are grouped. Closed alerts include security alerts that have been successfully remediated or dismissed prior to or during the chosen time period.
The average age of all alerts that were remediated or dismissed during the chosen time period. Alerts that were closed as "false positive" are excluded.
Formula: The age of each closed alert is calculated by subtracting the date the alert was created from the date that the alert was last closed during the chosen time period, then averaging across all closed alerts.
Note
For reopened alerts, the age is calculated by subtracting the original creation date rather than the date the alert was reopened.
The rate at which alerts are being closed. This metric is similar to measuring "developer velocity," reflecting the speed and efficiency with which alerts are resolved.
Formula: Number of alerts that were closed and remained closed during the chosen time period รท Number of alerts created during the time period
Note
The net resolve rate takes into account any new and any closed alerts during the chosen time period. This means that the set of new alerts and set of closed alerts used for the calculation do not necessarily correspond, since they may represent different populations of alerts.
Excluded: Alerts that are reopened and re-closed during the chosen time period are ignored.
Shows alert inflows and outflows over your chosen time period.
Track vulnerabilities caught and fixed before reaching production.
Shows the cumulative number of vulnerabilities that were caught in the developer workflow versus the vulnerabilities introduced over the time period you have chosen.
The count of pull request alerts detected by CodeQL or secret scanning with a close reason of "Fixed" that are tied to a merged pull request.
Shows the ratio of accepted Copilot Autofix suggestions to the total number of Copilot Autofix suggestions on pull request alerts detected by code scanning.
Copilot Autofix for code scanning provides targeted recommendations to help you fix code scanning alerts. See Application card: GitHub security and quality AI features.
Shows trends for Total findings, Fix applied, and Dismissed over the time period you have chosen. A finding is resolved when a fix is applied or the finding is dismissed.
Shows the number of resolved AI Scan findings out of the total number of findings, and the percentage resolved. A finding is resolved when a fix is applied or the finding is dismissed.
Shows the number of AI Scan findings with an accepted Copilot Autofix suggestion out of all findings that had a suggested autofix, and the acceptance percentage.