Average remediation time per leaked secret (hours)
Average annual developer salary (USD)
Estimating cost savings from push protection
On GitHub, navigate to the main page of the organization.
Under your organization name, click the Security and quality tab.
In the sidebar, under "Security", click Assessments.
On the top right corner of the banner, click Get started.
In the dropdown, select Estimate push protection savings.
Review the non-editable value for "Preventable leaks" (P). If 0, a baseline value (such as 70) is shown for modeling purposes.
Enter or adjust the average developer annual compensation (C), in USD.
Use blended fully loaded annual compensation (salary + benefits).
Keep estimates conservative to avoid overstatement.
Enter or adjust the time to remediate each leaked secret (T), in hours. We recommend you use an average remediation time that reflects steps for revoking, rotating, and validating secrets, as well as notifying your teams or customers:
T = 1-1.5 hours for simple rotation, minimal coordination
T = 2-3 hours to account for a distributed team or extra checks
T = 3-4 hours if you work in a regulated / audited environment
Review the outputs from the Return on investment panel:
Secrets prevented: The number of preventable secrets detected.
Time saved: Total hours saved by preventing these secrets, based on your input.
Potential savings with push protection: The total estimated labor cost avoided.
Did you successfully use the ROI calculator to estimate the cost savings of using push protection on your organization?
Next, review the results to understand their implications and determine the appropriate scope for rolling out push protection in your organization. Keep the following information in mind as you interpret your results.
The calculator does:
Estimate savings for secrets blocked by push protection only.
Base results on your risk assessment and assumptions you provide.
Provide estimates based on labor cost avoidance only.
Provide a modeled baseline for preventable leaks if no secrets were detected in the current scan window.
The calculator does not:
Include any costs related to data breaches or external impacts. For informational purposes, the cost of a data breach averaged $4.88M in 2024 according to IBM.
Include time savings from other GitHub Secret Protection features.
Support currencies other than USD.
Troubleshooting
If you run into problems using the calculator, use the following table to troubleshoot.
Issue
Action
Preventable secrets = 0
When no preventable secrets are detected, the calculator displays a default baseline value (such as 70) for modeling purposes. To replace the baseline with real data, enable push protection on more repositories and allow secret scanning to collect more information.
Estimated savings shows $5M+
The calculator is capped at $5M. If your modeled savings exceed this threshold, the value will be displayed as "$5M+" in the UI. To get the precise amount, export your input values (preventable secrets, time to remediate, and developer salary) and replicate the formula in a spreadsheet: (Secrets prevented) × (Time to remediate) × (Hourly rate) where hourly rate is calculated as Salary ÷ 2080.
Value seems low
Review your inputs for time to remediate and average developer compensation. Ensure you have included all steps involved in remediation (such as revoke, rotate, validate, and notify) and that the salary reflects a fully loaded annual cost.
Value seems high
Double-check your input values for time to remediate and average compensation to make sure they are realistic and not overstated. Remove any outliers that could be skewing the estimate.