Closing the gap on code that is already at risk

Copilot Autofix has already made remediation faster inside pull requests, helping teams address issues before they reach production. But the vulnerabilities already sitting in merged code remain a separate problem. Our data suggests that, historically, teams only address about 10% of that lingering security debt, leaving the remaining 90% unprioritized and unresolved.

A graphic showing that with security campaigns, 55% of security debt is fixed by developers compared to around only 10% of security debt without security campaigns.

Security campaigns are designed to close that gap by pairing security expertise with developer workflow. Using Copilot Autofix to generate code suggestions for up to 1,000 code scanning alerts at a time, campaigns let security teams handle triage and prioritization while developers resolve issues without breaking their momentum. Early customer data shows that 55% of alerts included in security campaigns get fixed, roughly a 5.5x improvement over the 10% rate for debt outside campaigns. Alerts included in campaigns also receive about twice as much developer engagement.

From triage to fix: how campaigns work

Security teams and developers bring different strengths to the remediation process. Security teams understand the risks; developers understand the code and how to change it. Security campaigns put those strengths to work together:

  1. Security teams prioritize. They select the risks and repositories that matter, optionally starting from predefined templates based on commonly used themes such as the MITRE top 10 known exploited vulnerabilities. GitHub's security overview provides statistics and metrics to help scope the work.
  2. Developers get notified. Once alerts are selected and a timeline is set, the campaign reaches the developers who own the impacted code, and the work can be planned and managed like any other feature work.
  3. Autofix drafts the remediation. Copilot Autofix immediately suggests automatic fixes for all alerts in a campaign, along with custom help text explaining each problem. Fixing an alert becomes a matter of reviewing a diff and opening a pull request.

Security campaigns are more than alert lists. Notifications make it clear which alerts a developer or team is responsible for, and each campaign has an appointed manager who can track progress and help developers as needed. Security managers get an organization-level view on GitHub to monitor progress and collaborate.

Whats new for campaign planning

Several capabilities are available starting today to make campaign work easier to plan and manage:

  • Draft security campaigns: Security managers can iterate on scope and save campaigns as drafts before publishing them to developers, ensuring the highest-priority alerts are included before work goes live.
  • Automated GitHub Issues: Security managers can optionally create GitHub Issues in affected repositories. These issues are created and updated automatically as the campaign progresses, providing a place to track, manage, and discuss campaign-related work.
  • Organization-level statistics: Security managers can view aggregated statistics showing progress across all active and past campaigns.

For more information about using security campaigns, see About security campaigns in the GitHub documentation.