GitHub: cybersecurity software

GitHub Advanced Security is okay. It checks a lot of scanning boxes - most importantly SCA with dependabot, secrets scanning, and SAST with CodeQL. The tools tends to be very noisy, requires management via GitHub which can be challenging, and tends to generate a lot of false positives leading to operational difficulty over time

What GitHub is

GitHub Advanced Security is okay. It checks a lot of scanning boxes - most importantly SCA with dependabot, secrets scanning, and SAST with CodeQL. The tools tends to be very noisy, requires management via GitHub which can be challenging, and tends to generate a lot of false positives leading to operational difficulty over time The vendor site is github.com. This profile is an entry in the oneNorma directory, not a vendor landing page.

What GitHub covers

GitHub is in the catalog for these capabilities. Categories: Secret Scanning, SCA, and SAST. Catalog tags: Hands-on and Included.

How to evaluate GitHub in a security program

Use GitHub as a stack candidate, not as diligence evidence. The oneNorma score for GitHub is 5.3/10 (percentile 57). If the real gap is in Secret Scanning, SCA, and SAST, a dashboard does not replace a pentest or a control mapped to Law 21.663 or ISO 27001. Compare this profile with what github.com publishes. Contrast it with pentesting and Security Cloud & Compliance.

Classification

Categories

Secret ScanningSCASAST

Tags

Hands-onIncluded

Capabilities by category

SAST

AutofixEnterprise

Secret Scanning

Platform

Frequently asked questions

What is GitHub?

GitHub Advanced Security is okay. It checks a lot of scanning boxes - most importantly SCA with dependabot, secrets scanning, and SAST with CodeQL. The tools tends to be very noisy, requires management via GitHub which can be challenging, and tends to generate a lot of false positives leading to operational difficulty over time Site: github.com.

Which categories does GitHub fall into?

GitHub appears in the oneNorma directory under Secret Scanning, SCA, and SAST. Use those labels to compare it with other vendors for the same problem, not as an official ranking.

Does oneNorma resell or implement GitHub?

No. The GitHub profile (github.com) is for inventory and comparison. oneNorma delivers offensive and compliance evidence (pentesting, cloud compliance), not a vendor license.

Other cybersecurity vendors

More profiles from the vendor directory.