GitHub has extended the security overview UI to include a set of AI Scan metrics for organization and enterprise administrators. The new view aggregates counts of AI Scan findings, how many were resolved, remediation rates, repository sources, trend data, and the frequency of applied autofix suggestions, allowing teams to gauge the impact of AI‑driven scanning without opening individual pull requests.
New metrics in the security overview
The updated page, now called Code scanning on pull requests, separates CodeQL and AI Scan data into distinct tabs. The AI Scan tab reports:
- Total AI Scan findings generated during the selected reporting period.
- Number of findings that were resolved.
- Calculated remediation rate (resolved ÷ generated).
- Breakdown by repository, showing which repos contributed findings.
- Trend visualisation over the chosen time window.
- Count of findings that included an autofix suggestion versus those that did not.
- How often developers applied the suggested autofixes.
Metrics that previously lived under the “CodeQL pull requests” label are now presented under the CodeQL tab, keeping the two scanning technologies logically separated.
Operational implications
For teams that already use GitHub Code Security or GitHub Advanced Security, the metrics provide a high‑level health check of AI Scan adoption. By monitoring remediation rates and autofix uptake, engineering leads can identify gaps in developer response or configuration issues that may be suppressing the benefit of AI‑generated suggestions. The data also supports capacity planning for security triage, as a rising volume of unresolved findings may indicate a need for additional review resources.
Considerations for implementation
Because the feature is a public preview, it is only available on GitHub.com and GitHub Enterprise Cloud; GitHub Enterprise Server does not receive the update. Organizations should verify that their subscription includes GitHub Code Security or GitHub Advanced Security before expecting the metrics to appear. When enabling the view, administrators should define an appropriate reporting period that aligns with sprint cycles or release cadences to make trend analysis meaningful.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Practitioners should start by reviewing the new AI Scan tab to establish baseline numbers for findings and remediation. Track autofix adoption to decide whether to promote the feature in developer workflows. Use repository‑level breakdowns to prioritize high‑risk codebases for deeper analysis. Finally, incorporate the remediation rate into security KPIs to justify continued investment in AI‑driven scanning or to adjust policy thresholds.