{"meta":{"title":"Interpreting code security risk assessment results","intro":"Understand the results from your code security risk assessment and prioritize vulnerability remediation.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/tutorials","title":"Tutorials"},{"href":"/en/code-security/tutorials/secure-your-organization","title":"Secure your organization"},{"href":"/en/code-security/tutorials/secure-your-organization/interpret-code-security-risk-assessment","title":"Interpret code security risk assessment"}],"documentType":"article"},"body":"# Interpreting code security risk assessment results\n\nUnderstand the results from your code security risk assessment and prioritize vulnerability remediation.\n\n## Introduction\n\nIn this tutorial, you'll interpret your code security risk assessment results, and learn how to:\n\n* Understand risk metrics on the dashboard\n* Identify which repositories and languages are most affected\n* Prioritize vulnerabilities for remediation\n\n## Prerequisites\n\nYou must generate a code security risk assessment report and wait for the scan to complete. See [Running the code security risk assessment for your organization](/en/code-security/how-tos/secure-at-scale/configure-organization-security/configure-specific-tools/assess-your-vulnerability-risk).\n\n## Step 1: Understand your dashboard metrics\n\nOnce your assessment completes, review the key metrics at the top of the dashboard:\n\n* **Total repositories scanned**: The number of repositories that were successfully scanned out of those selected.\n* **Total vulnerabilities found**: The total number of vulnerabilities found across all scanned repositories.\n* **Copilot Autofix**: The number of vulnerabilities that are eligible for Copilot Autofix. Enabling GitHub Code Security gives you access to Copilot Autofix, which can automatically suggest fixes for these alerts.\n\n## Step 2: Review vulnerabilities by language\n\nLook at the **Vulnerabilities by language** chart to understand which languages in your codebase are contributing most to your overall vulnerability count.\n\nIf vulnerabilities are concentrated in a particular language, this may indicate:\n\n* Specific frameworks or patterns in use that introduce common weaknesses\n* Teams working in that language who may benefit from targeted secure coding guidance\n\n## Step 3: Identify the most affected repositories\n\nIn the **Repositories scanned** table, you can see each scanned repository alongside the ratio of vulnerabilities eligible for Copilot Autofix out of the total vulnerabilities found.\n\nThe **Most vulnerable repository** metric at the top of the page highlights the repository with the highest vulnerability count. This is a good place to start when prioritizing remediation.\n\nIf a **high percentage** of repositories contain vulnerabilities, this may indicate:\n\n* Widespread gaps in secure coding practices across teams\n* A need for organization-wide tooling and guardrails like code scanning\n\nIf only a **few** repositories contain vulnerabilities, you can focus remediation efforts on specific teams or codebases.\n\n## Step 4: Review rules detected\n\nScroll to the **Rules detected** table to see a breakdown of vulnerabilities by rule, including:\n\n* **Rule**: The specific class of security issue detected\n* **Rule severity**: The severity level (critical, high, medium, or low)\n* **Distinct repositories**: How many different repositories contain this rule violation\n* **Vulnerabilities found**: The total count of this rule violation across all repositories\n\nThe table sorts by vulnerability count by default, helping you identify the most prevalent issues. Pay particular attention to rules with a **Critical** or **High** severity that appear across multiple repositories, as these represent the greatest risk.\n\n## Step 5: Prioritize remediation\n\nNow that you understand the metrics, prioritize remediation based on risk.\n\nThe highest priority vulnerabilities are **critical and high severity rules that appear across multiple repositories**, because they:\n\n* Represent the greatest potential impact if exploited\n* Are present in code your teams are actively working on\n\nNext, address vulnerabilities that present lower risk or require more effort to remediate:\n\n* **Medium and low severity issues**, which may still pose risk but are less immediately critical\n* **Rules appearing in only one repository**, which represent more contained exposure\n\nAlso look for the following indicators, which may require broader intervention beyond individual fixes:\n\n* **Many repositories affected by the same rule**: Suggests a systemic pattern that may require team training or updated coding standards\n* **High vulnerability counts in a specific language**: May point to framework-level issues or missing scanning tooling for that language\n\nRemediating the vulnerabilities or leaks identified by the risk assessment is easier with  GitHub Advanced Security. Eligible enterprise administrators can start a trial for their entire enterprise straight from the results page.\n\nTo start remediating vulnerabilities with Copilot Autofix, enable GitHub Code Security for your organization. You have two options:\n\n* To enable GitHub Code Security for an individual repository, click **Enable** next to a repository in the \"Repositories scanned\" table.\n* To enable GitHub Code Security across your organization, click **Enable Code Security** at the top of the page. Here, you can choose whether to enable it for all repositories or selected repositories, then review the estimated cost before confirming."}