If you only run Copilot on GitHub: what GitHub Advanced Security covers natively

Who this note is for

Some teams have a simple estate: every repository on GitHub Team or Enterprise Cloud, and GitHub Copilot as the only coding agent. For them the question is not which platform to buy but whether GitHub's own features are enough. This note sets out what GitHub documents, from pages read in September 2026 and updated on 11 October 2026.

What GitHub covers

Code. GitHub Code Security includes code scanning, the CodeQL CLI, Copilot Autofix, dependency review, security overview and campaigns. AI Scan, which finds vulnerabilities in pull requests, is in public preview and since 16 September 2026 no longer requires CodeQL default setup.

Other tools. GitHub's plans page says findings from other scanning tools can be centralized in code scanning through SARIF upload.

Secrets. GitHub Secret Protection includes secret scanning, push protection, AI-detected secrets and custom patterns. Since 9 September 2026 a ruleset rule in public preview can block a pull request from merging while secret scanning alerts remain open.

The Copilot coding agent. It runs CodeQL, the GitHub Advisory Database and secret scanning on its own changes, without a GHAS license, according to GitHub's changelog of 28 October 2025.

Fixes. Agentic autofix is generally available for Code Quality findings since 9 September 2026: a developer can assign up to 25 findings to Copilot at once, and Copilot fixes them on a branch, validates its changes and opens a pull request. Agentic autofix for code scanning alerts is in public preview. Since 25 September 2026 fix patterns are stored in Copilot Memory for customers who have it enabled.

What it costs

GitHub publishes the prices: GitHub Secret Protection is $19 and GitHub Code Security is $30 per active committer per month. For 50 active committers, both together come to $2,450 a month at list price. The agent risk calculator does this arithmetic for any team size.

Where the gaps are

• Other agents. The built-in checks cover GitHub's own Copilot coding agent. The pages we read show no controls for third-party agents. If one developer starts using a second agent, it is outside this coverage.
• The IDE and the endpoint. IDE-side checks and controls on what an agent runs or installs on a developer's machine are not described on the pages we read.
• Triage context. Security overview and campaigns organize findings; reachability or business-context scoring is not described.
• Other platforms. Repositories outside GitHub are not covered.

How it scores here

GitHub Advanced Security scores 9 of 10 on agentic remediation, tied highest in our set, and 3.8 on the agent governance group, among the lowest in the top 10, because its agent controls cover one agent. It ranks 6 of 9 at 6.35 on our published weights.

When to look further

If your estate stays this simple, GitHub's native features may be enough. Look further when a second coding agent appears, when you need policy on what agents install or run, or when findings from other scanners need one queue. The alternatives page lists where each other platform scores higher.

Settings worth turning on first

For a team that stays on GitHub's native features, three settings described on GitHub's pages do the most work. Turn on push protection so secrets are blocked before they reach the repository. Use the ruleset rule, in public preview, that blocks merges while secret scanning alerts are open, once you are comfortable with preview terms. And route Code Quality findings to agentic autofix in a small number of repositories first, so reviewers can judge the fixes before the volume grows. Each of these keeps a person in the loop at the pull request, which is where GitHub's controls act.