GitHub adds AI Scan findings and autofix metrics to security overview

GitHub's October 13 announcement adds AI Scan for pull requests to organization and enterprise security overview. The page formerly named CodeQL pull requests is now Code scanning on pull requests, with separate CodeQL and AI Scan tabs.

The AI Scan tab reports total findings, findings with and without an autofix suggestion, findings resolved, remediation rate, repositories that generated findings, trends for the selected reporting period, and how often developers applied autofix suggestions. Existing CodeQL metrics move under the CodeQL tab.

The separation prevents unlike engines from being silently combined. Teams can inspect AI Scan activity without treating it as additional CodeQL output.

A security team can now see where AI Scan produces findings, whether developers resolve them and whether autofix suggestions are used, without opening every pull request. That supports bounded questions such as which repositories are active, whether remediation is occurring and where enablement deserves follow‑up. Use the selected reporting period and repository coverage as part of every readout. A raw finding count is difficult to compare when pull‑request volume, repository participation or rollout dates differ. Preserve the denominator inputs separately if the dashboard does not expose a directly comparable rate. An increase after rollout can mean greater coverage or detection rather than worsening code. Pair the dashboard with enablement and pull‑request volume before drawing a trend conclusion.

GitHub says the metrics include a remediation rate and the frequency with which developers apply autofix suggestions. Those signals describe response to findings. They do not by themselves establish that AI Scan prevented exploitable vulnerabilities, reduced production incidents or found every relevant flaw. Keep the claims narrow: generated, resolved and suggestion‑applied counts can measure adoption and handling. Security efficacy needs a separate design with validated findings, comparable coverage and an outcome definition. A low autofix‑use rate can reflect suggestion quality, local policy or developers choosing a manual fix. Review a small sample of closed findings before changing rollout policy. Confirm whether the resolution was an applied suggestion, a different patch, dismissal or code change that removed the finding.

The release is a public preview on GitHub.com, including GitHub Enterprise Cloud, for customers with GitHub Code Security or GitHub Advanced Security. GitHub Enterprise Server is not supported for this release. The current [AI‑powered security detections documentation](https://docs.github.com/code‑security/concepts/code‑scanning/ai‑powered‑security‑detections) should be used to verify the feature's supported surfaces and behavior as preview details change. Record account plan, deployment type and reporting period with each dashboard capture. A missing tab can therefore mean unsupported deployment, missing product access, insufficient administrator permissions or no enabled repositories. Diagnose those states before interpreting an empty chart as zero findings.

Start with the enabled repository set and the reporting window. Record repositories with activity, total findings, findings with autofix, resolved findings and suggestion applications. Then inspect outliers rather than ranking teams from one aggregate rate. Repeat on a fixed cadence only after the cohort is stable enough to compare. Keep CodeQL and AI Scan series separate, because each engine and rollout can have different coverage. Treat the preview dashboard as an operational baseline, not a causal experiment. The new metrics make AI Scan easier to govern at scale while preserving the need for validation and context. Follow [GitHub's OpenTools organization page](https://opentools.ai/organizations/github) for related security releases. *Figure: The AI Scan measurement funnel from findings through remediation and autofix use. Sources: [GitHub's announcement](https://github.blog/changelog/2026‑10‑13‑code‑scanning‑ai‑scan‑metrics‑in‑security‑overview/) and the [AI‑powered security detections documentation](https://docs.github.com/code‑security/concepts/code‑scanning/ai‑powered‑security‑detections). Figure by OpenTools Team; no third‑party expressive material used.*