GitHub Advanced Security Reviews

Name: GitHub Advanced Security
Brand: GitHub
Rating: 4.4 (8 reviews)

4.4 out of 5

8 reviews
100% willing to recommend

What is GitHub Advanced Security?

GitHub Advanced Security secures data by scanning for vulnerabilities in dependencies, secret scanning, and protecting sensitive information. It integrates seamlessly, reducing reliance on multiple tools and optimizing vulnerability detection.

Get the GitHub Advanced Security Buyer's Guide and find out what your peers are saying about GitHub Advanced Security, SonarQube Server (formerly SonarQube), GitLab and more!

GitHub Advanced Security is the #13 ranked solution in application security solutions. PeerSpot users give GitHub Advanced Security an average rating of 8.8 out of 10. GitHub Advanced Security is most commonly compared to SonarQube Server (formerly SonarQube): GitHub Advanced Security vs SonarQube Server (formerly SonarQube). GitHub Advanced Security is popular among the large enterprise segment, accounting for 64% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 14% of all views.

Buyer's Guide

GitHub Advanced Security

February 2025

Get the report

Helped 838,713 peers since 2012

Featured reviews

Sabna Sainudeen

Director, Application Security at Carlsberg

GitHub Advanced Security should look into API security issues, which they currently do not. Additionally, open-source security vulnerabilities are not getting updated in a timely manner. There are features in GitHub Advanced Security that cannot be used within Microsoft, which is strange since they are the same company. It should also focus on developing a software bill of materials (SBOM) to see all open software used in one place.

Read full review

Sirinat-Paphatsirinatthi

Co-Founder at Cloud NC

We keep our firewall security in place. Customers use GitHub because they don't want to coordinate with many tools. GitHub provides advanced security, which is why the customers choose this tool; it allows them to rely solely on GitHub as one platform for everything they need For customers,…

Read full review

reviewer2395785

Senior Solution Architect at a manufacturing company with 10,001+ employees

It finds hardcoded secrets directly in the code and points them out immediately. Then, I can go back to the developers and let them know. I can even block the commit in the repository so they cannot commit until they fix the issue. AI in the backend: CodeQL uses AI algorithms, so it reduces false positives. For example, in a SQL injection, it finds the user input flow of the code instead of looking for hardcoded SQL statements. It looks at where parameters can be created and filled with data. If it ends on a path where it comes from a user, then you really get an SQL injection. If it's just a parameter populated through something else, there is no danger. This is one difference between SonarQube and GitHub Advanced Security. It gives you fewer false positives, so you don't waste time figuring out if it's a real security issue or a false alarm.

Read full review

GitHub Advanced Security mindshare

As of February 2025, the mindshare of GitHub Advanced Security in the Application Security Tools category stands at 8.0%, up from 1.9% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Application Security Tools

PeerAnalyst reports

Type	Title	Date
Category	Application Security Tools	Feb 22, 2025	Download
Product	Reviews, tips, and advice from real users	Feb 22, 2025	Download
Comparison	GitHub Advanced Security vs SonarQube Server (formerly SonarQube)	Feb 22, 2025	Download
Comparison	GitHub Advanced Security vs Veracode	Feb 22, 2025	Download
Comparison	GitHub Advanced Security vs Checkmarx One	Feb 22, 2025	Download

Title	Rating	Mindshare	Recommending
SonarQube Server (formerly SonarQube)	4.0	25.6%	81%	114 interviews Add to research
GitLab	4.3	2.9%	97%	82 interviews Add to research

Valuable Features

GitHub Advanced Security offers server security, including security and dependency scans, and cost-effectiveness through Azure DevOps integration. It provides developer-friendly features and seamless integration within workflows. Users appreciate the extensibility via CodeQL, allowing custom queries specific to their domain. Dependency and secret scans enhance threat detection, while API support facilitates external system integration. Its developer experience, scalability, and ability to incorporate custom CodeQL queries stand out, especially for organizations using GitHub.

"I have not experienced any performance or stability issues with GitHub Advanced Security."
"GitHub Advanced Security is a very developer-friendly solution that is integrated within my development environment."
"GitHub Advanced Security uses artificial intelligence in the backend, specifically CodeQL, to analyze code and provide fewer but more reliable findings, so there are less false positives."

Room for Improvement

GitHub Advanced Security requires a centralized dashboard for comprehensive reporting across projects. Reporting features need enhancement with robust capabilities to track issue resolution and better integration with existing tools. Customization is complex and deployment challenging. Users seek API security attention and timely updates on open-source vulnerabilities. Desired improvements include compatibility with more programming languages, support for container environments, and development of a software bill of materials for open software visibility. Training and guidelines for addressing vulnerabilities are also needed.

"GitHub Advanced Security should look into API security issues, which they currently do not. Additionally, open-source security vulnerabilities are not getting updated in a timely manner."
"Open-source security vulnerabilities are not getting updated in a timely manner."
"Maybe make it compatible with more programming languages. Have a customized ruleset where the end-user can create their own rules for scanning."

Pricing

"The solution is expensive."
"The current licensing model, which relies on active commitments, poses challenges, particularly in predicting and managing growth."

Popular Use Cases

Users employ GitHub Advanced Security primarily to enhance security for applications by scanning for vulnerabilities in dependencies and identifying hard-coded secrets. This tool is integrated into development environments to secure data, identify potential vulnerabilities, and improve the developer experience. Organizations choose it for its comprehensive analysis using CodeQL to produce reliable findings, allowing developers to focus on critical issues. Customers appreciate its ability to consolidate security tools within GitHub for streamlined operations.

Service and Support

GitHub Advanced Security's customer service is generally well-regarded, with users finding the team responsive and accommodating. Users often collaborate with GitHub's professional services team and receive support via email for technical issues, though time zone differences can be challenging for some. The service is typically rated around eight or nine out of ten, with support quality often varying based on issue priority. Documentation from Microsoft is also frequently consulted for technical problems.

Deployment

GitHub Advanced Security's initial setup is straightforward, requiring enterprise admins to enable it before repo admins take over. Recent improvements include auto-generated analysis files for certain languages. One-click integration reduces setup costs and requires minimal maintenance. Companies deploy in a week and often need ten engineers for implementation, though setup is quick, sometimes taking only two hours. Seamless integration with Azure DevOps and absence of complaints suggest a smooth enabling process.

Scalability

GitHub Advanced Security supports scalability, accommodating hundreds to over a thousand users within organizations. Users report it facilitates onboarding effectively but note some limitations in analyzing capabilities when compared to other tools. While suitable for enterprises, recommendations suggest it fits small and medium businesses as well.

Stability

GitHub Advanced Security is praised for its stability and performance. Users report no downtime or technical issues and commend its serverless architecture in Azure DevOps for eliminating scaling concerns. Challenges exist in workflow analysis, but these do not impact overall stability. Administrative overhead is reduced, with no need for server upgrades. Stability receives high ratings, frequently cited as nine out of ten or described as very stable by users experiencing no performance issues.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our GitHub Advanced Security Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

14%

Computer Software Company

11%

Manufacturing Company

Government

Insurance Company

Retailer

Comms Service Provider

Healthcare Company

Energy/Utilities Company

University

Media Company

Construction Company

Educational Organization

Non Profit

Real Estate/Law Firm

Hospitality Company

Transportation Company

Wholesaler/Distributor

Legal Firm

Pharma/Biotech Company

Outsourcing Company

Consumer Goods Company

Logistics Company

Recreational Facilities/Services Company

Mining And Metals Company

Marketing Services Firm

Compare GitHub Advanced Security with alternative products

Learn more about GitHub Advanced Security

GitHub Advanced Security is designed to enhance security awareness by offering comprehensive tools for secret scanning, code analysis, and SCSS dependency checks. AI-driven features deliver accurate security insights while minimizing false positives. It provides valuable integration with Azure DevOps, maintaining control within dashboards and enabling external systems' support through APIs. With CodeQL, users can perform custom queries across projects. Propelled by Microsoft, the platform enhances operational frameworks with essential security features, although improvements are needed in dashboard consolidation, reporting, and integration mechanisms. Users seek better customizability, language support, and training resources to ensure smoother implementation.

What are the key features of GitHub Advanced Security?

Security and Dependency Scanning: Identifies vulnerabilities in code and dependencies.
Secret Scanning: Detects sensitive information exposure.
Cost-effectiveness: Reduces the need for multiple security tools.
Developer Experience: Integrates seamlessly with development environments.
Extensibility: Custom queries via CodeQL and integration support.

What benefits and ROI can users expect?

Improved Security Posture: Enhanced visibility reduces risk.
Operational Efficiency: Streamlines processes with fewer tools.
Actionable Insights: AI-driven analysis provides clear guidance.
Enhanced Collaboration: Facilitates team integration through shared dashboards.

Industries implement GitHub Advanced Security to maintain robust security standards. It is favored by technology sectors seeking seamless integration with Azure DevOps and looking for customizable security tools tailored to project needs. Financial institutions value its accurate threat detection and compliance support, while enterprises focus on its comprehensive dependency scanning and code analysis capabilities to safeguard critical assets. The adaptability of GitHub Advanced Security across different operational environments illustrates its practical benefits.