{"meta":{"title":"Interpreting code security risk assessment results","intro":"Understand the results from your code security risk assessment and prioritize vulnerability remediation.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/tutorials","title":"Tutorials"},{"href":"/en/code-security/tutorials/secure-your-organization","title":"Secure your organization"},{"href":"/en/code-security/tutorials/secure-your-organization/interpret-code-security-risk-assessment","title":"Interpret code security risk assessment"}],"documentType":"article"},"body":"# Interpreting code security risk assessment results\n\nUnderstand the results from your code security risk assessment and prioritize vulnerability remediation.\n\n## Introduction\n\nIn this tutorial, you'll interpret your code security risk assessment results, and learn how to:\n\n* Understand risk metrics on the dashboard\n* Identify which repositories and languages are most affected\n* Prioritize vulnerabilities for remediation\n\n## Prerequisites\n\nYou must generate a code security risk assessment report and wait for the scan to complete. See [Running the code security risk assessment for your organization](/en/code-security/how-tos/secure-at-scale/configure-organization-security/configure-specific-tools/assess-your-vulnerability-risk).\n\n## Step 1: Understand your dashboard metrics\n\nOnce your assessment completes, review the key metrics at the top of the dashboard:\n\n* **Total repositories scanned**: The number of repositories that were successfully scanned out of those selected.\n* **Total vulnerabilities found**: The total number of vulnerabilities found across all scanned repositories.\n* **Copilot Autofix**: The number of vulnerabilities that are eligible for Copilot Autofix. Enabling GitHub Code Security gives you access to Copilot Autofix, which can automatically suggest fixes for these alerts.\n\n## Step 2: Review vulnerabilities by language\n\nLook at the **Vulnerabilities by language** chart to understand which languages in your codebase are contributing most to your overall vulnerability count.\n\nIf vulnerabilities are concentrated in a particular language, this may indicate:\n\n* Specific frameworks or patterns in use that introduce common weaknesses\n* Teams working in that language who may benefit from targeted secure coding guidance\n\n## Step 3: Identify the most affected repositories\n\nIn the **Repositories scanned** table, you can see each scanned repository alongside the ratio of vulnerabilities eligible for Copilot Autofix out of the total vulnerabilities found.\n\nThe **Most vulnerable repository** metric at the top of the page highlights the repository with the highest vulnerability count. This is a good place to start when prioritizing remediation.\n\nIf a **high percentage** of repositories contain vulnerabilities, this may indicate:\n\n* Widespread gaps in secure coding practices across teams\n* A need for organization-wide tooling and guardrails like code scanning\n\nIf only a **few** repositories contain vulnerabilities, you can focus remediation efforts on specific teams or codebases.\n\n## Step 4: Review rules detected\n\nScroll to the **Rules detected** table to see a breakdown of vulnerabilities by rule, including:\n\n* **Rule**: The specific class of security issue detected\n* **Rule severity**: The severity level (critical, high, medium, or low)\n* **Distinct repositories**: How many different repositories contain this rule violation\n* **Vulnerabilities found**: The total count of this rule violation across all repositories\n\nThe table sorts by vulnerability count by default, helping you identify the most prevalent issues. Pay particular attention to rules with a **Critical** or **High** severity that appear across multiple repositories, as these represent the greatest risk.\n\n## Step 5: Prioritize remediation\n\nNow that you understand the metrics, prioritize remediation based on risk.\n\nThe highest priority vulnerabilities are **critical and high severity rules that appear across multiple repositories**, because they:\n\n* Represent the greatest potential impact if exploited\n* Are present in code your teams are actively working on\n\nNext, address vulnerabilities that present lower risk or require more effort to remediate:\n\n* **Medium and low severity issues**, which may still pose risk but are less immediately critical\n* **Rules appearing in only one repository**, which represent more contained exposure\n\nAlso look for the following indicators, which may require broader intervention beyond individual fixes:\n\n* **Many repositories affected by the same rule**: Suggests a systemic pattern that may require team training or updated coding standards\n* **High vulnerability counts in a specific language**: May point to framework-level issues or missing scanning tooling for that language\n\nRemediating the vulnerabilities or leaks identified by the risk assessment is easier with GitHub Advanced Security. Owners of eligible organizations on GitHub Team can start a trial from a completed code security risk assessment.\n\nTo start remediating vulnerabilities with Copilot Autofix, enable GitHub Code Security for your organization. You have two options:\n\n* To enable GitHub Code Security for an individual repository, click **Enable** next to a repository in the \"Repositories scanned\" table.\n* To enable GitHub Code Security across your organization, click **Enable Code Security** at the top of the page. Here, you can choose whether to enable it for all repositories or selected repositories, then review the estimated cost before confirming."}