Agentic AI for DevSecOps | GHAS + GHCP + MDC

01 Why DevSecOps Matters Now

The software supply chain is the primary attack vector. Security must be embedded into every phase of development.

The Threat Landscape

🔥

SolarWinds

Vulnerable supply chain & build machine — 18,000 customers impacted

🔑

Codecov

Leaked developer secrets — Up to 29,000 customers at risk

🪵

Log4j

Vulnerable source code — 40% of business networks globally. 100 attacks/minute at peak.

Applications are the top attack vector
Verizon DBIR 2024

65%

of vulnerabilities still exist after 3 months
Veracode SOSS 2024

of companies avoided web app attacks in production
Contrast Security 2024

70.8%

of organizations have security debt
Veracode SOSS 2024

Industry Standards Alignment

Framework	Scope	Relevance
NIST SSDF	Secure Software Development Framework	U.S. federal and private sector baseline
SLSA	Supply-chain Levels for Software Artifacts	Build integrity and provenance verification
Cyber Resilience Act (CRA)	EU legislation on software security	Mandatory for EU market software products
OpenSSF Scorecard	Open-source security posture scoring	Automated dependency risk evaluation

The Economics of Shifting Left

$80

Development

$240

Build (3×)

$960

Test / QA (12×)

$7,600

Production (95×)

$4.88M

Breach (avg)
IBM 2024

Metric	Value	Source
Cost multiplier	100× more expensive to fix in production vs. development	NIST & IBM Systems Sciences Institute
Exploitation growth	180% growth in vulnerability exploitation as initial breach access	Verizon DBIR 2024
Release pressure	79% say DevOps teams face increasing pressure to shorten cycles	Contrast Security 2024
Security debt	70.8% of organizations have security debt; 89.4% in first-party code	Veracode SOSS 2024

From DevOps → Agentic DevSecOps

graph LR
    A["DevOps\nPeople + Process + Tech\n→ Continuous value delivery"] -->
    B["DevSecOps\nSecurity as shared responsibility\n→ Secure continuous delivery"] -->
    C["Agentic DevOps\nAI agents as team members\n→ Automate & accelerate"] -->
    D["Agentic DevSecOps\nAI agents with security built in\n→ Secure AI-accelerated delivery"]

    style A fill:#1e3a5f,stroke:#3b82f6,stroke-width:2px,color:#e6edf3
    style B fill:#1e1b4b,stroke:#4f46e5,stroke-width:2px,color:#e6edf3
    style C fill:#3b0764,stroke:#7c3aed,stroke-width:2px,color:#e6edf3
    style D fill:#064e3b,stroke:#059669,stroke-width:3px,color:#e6edf3

Three Barriers — Solved by Agentic DevSecOps

🏢

Organization & Team Gaps

Security teams isolated from engineering → Agents embed security in developer workflow

📚

Skill & Knowledge Gaps

Developers lack security expertise → Agents provide just-in-time education

🔧

Tooling Friction

Security tools not built for devs → Agents detect, explain, fix in real-time

02 GitHub Advanced Security — Deep Dive

GitHub is the world's largest developer platform with ~150 million developers. GHAS brings native, first-party security directly into this platform — not bolted on, but built in. The mission: shift the burden from your team to your tools.

Product Structure (Post April 2025)

Announced March 4, 2025, GA April 1, 2025 — GHAS restructured into two standalone products, now available on GitHub Team plans:

Product	What's Included	Price
GitHub Secret Protection	Secret scanning, push protection, AI-powered generic detection, custom patterns, delegated bypass, validity checks	$19/mo per active committer
GitHub Code Security	CodeQL code scanning, Copilot Autofix, Dependabot, security campaigns, third-party SARIF	$30/mo per active committer

GHES Note: On GitHub Enterprise Server, GHAS continues as a bundled add-on to the Enterprise license and was not restructured into the standalone Secret Protection / Code Security products.

🔒 Prevent: Secret Protection & Push Protection

💡 Stolen or leaked credentials remain the #1 initial attack vector in data breaches, responsible for the largest share of incidents year over year. — IBM Cost of a Data Breach 2021 & 2023

flowchart TD
    A["Developer pushes code"] --> B{"Push Protection\nScanner"}
    B -->|No secret found| C["✅ Push succeeds"]
    B -->|Secret detected| D["🚫 Push BLOCKED"]
    D --> E["Developer sees:\nSecret type, File, Line, Options"]
    E --> F["Remove the secret"]
    E --> G["Mark as false positive"]
    E --> H["Request delegated bypass"]
    H --> I["Security reviewer notified"]
    I --> J{"Reviewer decision"}
    J -->|Approve| K["Push allowed + Audit trail"]
    J -->|Deny| L["Push remains blocked"]

    style A fill:#1e1b4b,stroke:#4f46e5,color:#e6edf3
    style B fill:#3b0764,stroke:#7c3aed,color:#e6edf3
    style C fill:#064e3b,stroke:#059669,color:#e6edf3
    style D fill:#881337,stroke:#e11d48,color:#e6edf3
    style E fill:#78350f,stroke:#d97706,color:#e6edf3
    style F fill:#064e3b,stroke:#059669,color:#e6edf3
    style G fill:#1e293b,stroke:#64748b,color:#e6edf3
    style H fill:#3b0764,stroke:#7c3aed,color:#e6edf3
    style K fill:#064e3b,stroke:#059669,color:#e6edf3
    style L fill:#881337,stroke:#e11d48,color:#e6edf3

Capability	Description
Partner Patterns	200+ partner patterns covering 400+ token types from cloud providers, SaaS platforms, and package registries
Copilot Secret Scanning	AI/ML-powered detection of unstructured secrets — passwords, connection strings, generic credentials
Custom Patterns	Organization-defined regex for internal secret formats
Validity Checks	Automated verification with partner APIs to confirm if a detected secret is still active
Push Protection	Server-side real-time blocking before secrets reach the repository
Delegated Bypass	Governance workflow requiring security team approval for exceptions
Free Secret Risk Assessment	Point-in-time scan of all repos (incl. private/internal/archived) — no license required

🔍 Detect: Code Scanning with CodeQL

CodeQL is GitHub's semantic code analysis engine — treats code as data by building a relational database and running security queries.

Language	Build Mode	Notes
C/C++	`autobuild` or manual	Requires compilation
C#	`autobuild` or manual	.NET framework support
Go	`autobuild`	Automatic
Java/Kotlin	`autobuild` or manual	Maven/Gradle support
JavaScript/TypeScript	No build required	—
Python	No build required	—
Ruby	No build required	—
Swift	`autobuild` or manual	macOS runners required
Rust	`autobuild`	Rust editions 2021 and 2024
GitHub Actions	No build required	Scans workflow YAML for injection and security issues

🔧 Fix: Copilot Autofix — AI-Powered Remediation

flowchart LR
    A["CodeQL\nAlert"] --> B["Autofix Engine\nLLM + CodeQL Context"]
    B --> C["Analyze:\nCWE, data flow"]
    C --> D["Generate:\nCode fix + explanation"]
    D --> E["Validate:\nFix doesn't break"]
    E --> F["PR Comment:\nExplanation + Diff\n+ One-click apply"]

    style A fill:#881337,stroke:#e11d48,color:#e6edf3
    style B fill:#3b0764,stroke:#7c3aed,color:#e6edf3
    style C fill:#1e293b,stroke:#64748b,color:#e6edf3
    style D fill:#1e293b,stroke:#64748b,color:#e6edf3
    style E fill:#1e293b,stroke:#64748b,color:#e6edf3
    style F fill:#064e3b,stroke:#059669,stroke-width:2px,color:#e6edf3

Speed Impact (Source: GitHub — "Found means fixed")

3×

All alerts (avg)
28 min vs 1.5 hr

7×

Cross-site Scripting
22 min vs 2.8 hr

12×

SQL Injection
18 min vs 3.7 hr

Covers 90%+ of alert types across all major CodeQL-supported languages
Remediates two-thirds of vulnerabilities with little or no editing
Generates fix suggestions for third-party SARIF findings — not just CodeQL
Available for both new PR alerts and existing security debt (via Security Campaigns)

📈 Scale: Security Campaigns & Debt Reduction

flowchart TD
    A["Security Manager identifies\nsystemic vulnerability"] --> B["Create Campaign:\nTarget CWEs across repos"]
    B --> C["GitHub generates Issues\nwith Autofix suggestions\n(up to 1,000 alerts)"]
    C --> D["Developers receive:\nVulnerability details + Autofix\n+ Runtime context from MDC"]
    D --> E["Campaign Dashboard:\nFixed / Open / In-Progress\nPer-team metrics + SLA"]
    E --> F["Bidirectional sync:\nGitHub ↔ Defender for Cloud"]

    style A fill:#881337,stroke:#e11d48,color:#e6edf3
    style B fill:#1e1b4b,stroke:#4f46e5,color:#e6edf3
    style C fill:#3b0764,stroke:#7c3aed,color:#e6edf3
    style D fill:#064e3b,stroke:#059669,color:#e6edf3
    style E fill:#1e3a5f,stroke:#3b82f6,color:#e6edf3
    style F fill:#064e3b,stroke:#059669,stroke-width:2px,color:#e6edf3

70.8%

Organizations with security debt

89.4%

Security debt in first-party code

46.6%

Flaws that become security debt

📦 Protect: Supply Chain Security

Feature	Function	Automation
Dependency Graph	Maps all direct + transitive dependencies	Automatic
Dependabot Alerts	Matches against GitHub Advisory Database	Automatic
Dependabot Security Updates	Creates PRs to update vulnerable dependencies	Semi-automatic
Dependabot Version Updates	Keeps dependencies current on schedule	Configurable
Dependency Review	PR gate to prevent adding new vulnerabilities	Automatic
Artifact Attestations	Build provenance and integrity verification (SLSA)	Workflow
SBOM Generation	Software Bill of Materials for compliance	Workflow

03 Secure Across the Stack — GHAS + MDC

GitHub Advanced Security + Microsoft Defender for Cloud = Code-to-Cloud security fabric.

Microsoft Defender for Cloud — DevOps Security

graph TB
    subgraph MDC["MICROSOFT DEFENDER FOR CLOUD"]
        direction TB
        DSPM["DevOps Security Posture Management"]
        AGS["Agentless Code Scanning\nZero YAML, zero pipeline changes"]
        PRA["Pull Request Annotations\nIaC findings in developer workflow"]
        CSPM["Defender CSPM\nCloud Security Posture Management"]
        APA["Attack Path Analysis\nChained vulnerability risk"]
        C2C["Code-to-Cloud Mapping\nSource repo ↔ Cloud workload"]
    end

    subgraph CONN["Multi-Pipeline Support"]
        GH["GitHub — Native GitHub App"]
        ADO["Azure DevOps — Extension"]
        GL["GitLab — OAuth"]
    end

    CONN --> MDC

    style MDC fill:#1a0a2e,stroke:#7c3aed,stroke-width:2px,color:#e6edf3
    style CONN fill:#0c1929,stroke:#3b82f6,stroke-width:2px,color:#e6edf3
    style DSPM fill:#2d1654,stroke:#7c3aed,color:#e6edf3
    style AGS fill:#2d1654,stroke:#7c3aed,color:#e6edf3
    style PRA fill:#2d1654,stroke:#7c3aed,color:#e6edf3
    style CSPM fill:#2d1654,stroke:#7c3aed,color:#e6edf3
    style APA fill:#2d1654,stroke:#7c3aed,color:#e6edf3
    style C2C fill:#2d1654,stroke:#7c3aed,color:#e6edf3

Agentless Code Scanning

Scanner	Target	Language / Framework
Bandit	Application code	Python
ESLint (security rules)	Application code	JavaScript / TypeScript
Checkov	IaC	Terraform, Kubernetes, Dockerfile, ARM, Bicep, CloudFormation
Template Analyzer	IaC	ARM, Bicep
Trivy	Dependencies	OS packages and repo manifests (npm, pip, Maven, NuGet, Go, Cargo)
Syft	SBOM	Generates dependency inventory across 30+ ecosystems

Code-to-Cloud Mapping & Attack Path Analysis

graph LR
    A["GitHub Repo\nSQL Injection in /src/api\nCodeQL finding"] -->|builds| B["Container Image\nVulnerable base image\nRegistry scan"]
    B -->|deploys to| C["AKS Pod\nInternet exposed\nSensitive data access"]
    C --> D["ATTACK PATH\nCRITICAL 9.8"]
    D --> E["Internet Exposure"]
    D --> F["Sensitive Data"]
    D --> G["Code Vuln + Unpatched Base"]
    D --> H["Lateral Movement"]

    style A fill:#4a1530,stroke:#e11d48,stroke-width:2px,color:#e6edf3
    style B fill:#42290a,stroke:#d97706,stroke-width:2px,color:#e6edf3
    style C fill:#4a1530,stroke:#e11d48,stroke-width:2px,color:#e6edf3
    style D fill:#4a1042,stroke:#db2777,stroke-width:3px,color:#e6edf3
    style E fill:#3d0f1e,stroke:#f43f5e,color:#e6edf3
    style F fill:#3d0f1e,stroke:#f43f5e,color:#e6edf3
    style G fill:#3d0f1e,stroke:#f43f5e,color:#e6edf3
    style H fill:#3d0f1e,stroke:#f43f5e,color:#e6edf3

GHAS + MDC Integration Architecture

graph TB
    subgraph DEV["DEVELOPER INNER LOOP"]
        IDE["IDE + Copilot"] --> PUSH["git push\n+ Push Protection"]
        PUSH --> PR["Pull Request\n+ Code Review"]
        PR --> CICD["CI/CD Pipeline"]
    end

    subgraph GHAS["GITHUB ADVANCED SECURITY"]
        SP["Secret Protection\n+ Push Protection"]
        CS["CodeQL Code Scanning\n+ Copilot Autofix"]
        DEP["Dependabot\nSupply Chain Security"]
        SC["Security Campaigns"]
    end

    subgraph BRIDGE["GHAS + MDC INTEGRATION"]
        C2C["Bidirectional Sync\nAlerts, Context, Fix Status"]
    end

    subgraph MDCS["MICROSOFT DEFENDER FOR CLOUD"]
        DSPM["DevOps Security\nPosture Mgmt"]
        AGS["Agentless Code\n+ IaC Scanning"]
        CSPM["Defender CSPM\n+ Attack Paths"]
        PRA["PR Annotations"]
    end

    subgraph CLOUD["CLOUD WORKLOADS"]
        RC["Runtime Context\nInternet, Data, Identity, Network"]
    end

    DEV --> GHAS
    GHAS --> BRIDGE
    BRIDGE --> MDCS
    MDCS --> CLOUD

    style DEV fill:#0c1929,stroke:#3b82f6,stroke-width:2px,color:#e6edf3
    style GHAS fill:#1a1540,stroke:#4f46e5,stroke-width:2px,color:#e6edf3
    style BRIDGE fill:#0a2e1e,stroke:#059669,stroke-width:3px,color:#e6edf3
    style MDCS fill:#1a0a2e,stroke:#7c3aed,stroke-width:2px,color:#e6edf3
    style CLOUD fill:#0a1e2e,stroke:#0ea5e9,stroke-width:2px,color:#e6edf3

Production-Aware Alert Prioritization

Risk Factor	Source	Impact
Internet Exposure	MDC Network Analysis	+Critical if public-facing
Sensitive Data Access	MDC Data Classification	+High if PII/financial data
Critical Resource	MDC Resource Tags	+High if production workload
Lateral Movement	MDC Attack Path Analysis	+Critical if pivot point
Identity Risk	MDC Identity Analysis	+High if over-permissioned

Licensing Requirements

Feature	Required License
GHAS Code Scanning (CodeQL)	GitHub Code Security
GHAS Secret Scanning + Push Protection	GitHub Secret Protection
Copilot Autofix	GitHub Code Security (included)
Copilot Coding Agent	Any paid GitHub Copilot plan
MDC DevOps Security (basic)	Defender for Cloud (Free tier)
MDC Agentless Scanning + PR Annotations	Defender CSPM
MDC Attack Path Analysis	Defender CSPM
GHAS + MDC Native Integration	GitHub Code Security + Defender CSPM

04 Agentic AI for DevSecOps

AI-powered agents operating as members of your dev team — automate, optimize, and secure every stage of the SDLC.

The Agentic Evolution

📊 Developers spend only ~20% of their time writing code. The other 80% goes to planning, securing, governing, and maintaining. Agentic AI reclaims that 80% by embedding autonomous agents across the entire lifecycle.

Dimension	Without Agents	With Agents
Competence — What they know	Limited to individual expertise	AI provides security knowledge on-demand
Capability — What they can do	Constrained by tooling familiarity	Agents detect, explain, fix, and validate
Capacity — How much they can do	Bounded by human hours	Agents work in parallel, asynchronously

graph TB
    subgraph BEFORE["TRADITIONAL DevSecOps"]
        B1["Manual code review"]
        B2["Security team bottleneck"]
        B3["Delayed remediation\nweeks / months"]
        B4["Skill gaps block adoption"]
    end

    subgraph AFTER["AGENTIC DevSecOps"]
        A1["AI agents detect & fix\nin real-time"]
        A2["Security embedded in\ndeveloper workflow"]
        A3["Immediate remediation\nminutes / hours"]
        A4["Just-in-time education"]
    end

    BEFORE -->|"Agentic Transformation"| AFTER

    style BEFORE fill:#4a1530,stroke:#e11d48,stroke-width:2px,color:#e6edf3
    style AFTER fill:#0a2e1e,stroke:#059669,stroke-width:2px,color:#e6edf3

GitHub Copilot Coding Agent

Generally available since May 19, 2025 for all paid Copilot subscribers. Operates as an autonomous team member.

flowchart TD
    A["Assign GitHub Issue\nto Copilot"] --> B["👀 Agent starts\nSecure sandbox via\nGitHub Actions"]
    B --> C["Clones repo → Sets up env\n→ Analyzes with RAG"]
    C --> D["Edits → Builds → Tests\nPushes to draft PR"]
    D --> E["Requests human review\nResponds to PR comments"]
    E --> F["Human approves\n→ CI/CD → Merged"]

    style A fill:#1e1b4b,stroke:#4f46e5,color:#e6edf3
    style B fill:#3b0764,stroke:#7c3aed,color:#e6edf3
    style C fill:#1e293b,stroke:#64748b,color:#e6edf3
    style D fill:#1e293b,stroke:#64748b,color:#e6edf3
    style E fill:#78350f,stroke:#d97706,color:#e6edf3
    style F fill:#064e3b,stroke:#059669,stroke-width:2px,color:#e6edf3

Built-in Security Policies

Policy	Protection
Branch restrictions	Agent can only push to branches it created
Review enforcement	Requester cannot approve the agent's PR
Network isolation	Internet access limited to trusted destinations (customizable)
CI/CD gating	Actions workflows require human approval before running
Existing rules apply	Repository rulesets and org policies fully enforced

Custom Security Agents

Specialized versions of the Copilot coding agent tailored to security workflows:

🛡️

Security Main Agent

Reviews repository for security issues and produces a comprehensive security report

🔍

Security Code Review Agent

Security-focused code reviewer checking for common vulnerabilities (CWEs)

📋

Security Plan Creation Agent

Threat modelling and security architecture with framework expertise

⚙️

Security Pipeline Agent

Detects CI workflow weaknesses, auto-patches GitHub Actions & Azure DevOps YAML

🏗️

Security IaC Agent

Finds insecure defaults and misconfigurations across IaC and cloud configs

📦

Security Supply Chain Agent

Detects secret leaks, dependency risks, and repo misconfigurations with PR-ready fixes

End-to-End Agentic Architecture

graph TB
    subgraph PREVENT["🔒 PREVENT"]
        P1["Secret Protection\nPush Protection"]
        P2["Copilot Secret Scanning\nAI-powered detection"]
        P3["Custom Security Agents\nPre-commit in VS Code"]
    end

    subgraph DETECT["🔍 DETECT"]
        D1["CodeQL Code Scanning"]
        D2["MDC Agentless Scanning"]
        D3["Dependabot"]
        D4["MDC PR Annotations"]
    end

    subgraph FIX["🔧 FIX"]
        F1["Copilot Autofix"]
        F2["Copilot Coding Agent"]
        F3["Security Campaigns"]
        F4["Custom Security Agents"]
    end

    subgraph MONITOR["📊 MONITOR"]
        M1["Defender CSPM\nAttack Paths"]
        M2["Code-to-Cloud Mapping"]
        M3["Security Overview\nDashboard"]
        M4["Audit Logs → SIEM"]
    end

    PREVENT --> DETECT --> FIX --> MONITOR
    MONITOR -->|"Runtime context\nenriches prioritization"| DETECT

    style PREVENT fill:#0a2e1e,stroke:#059669,stroke-width:2px,color:#e6edf3
    style DETECT fill:#0c1929,stroke:#4f46e5,stroke-width:2px,color:#e6edf3
    style FIX fill:#1a0a2e,stroke:#7c3aed,stroke-width:2px,color:#e6edf3
    style MONITOR fill:#2e1f0a,stroke:#d97706,stroke-width:2px,color:#e6edf3

05 DevSecOps Blueprint

Complete tooling matrix and maturity model for implementing Agentic DevSecOps at scale.

DevSecOps Tooling Matrix

Category	Guideline	Tools & Capabilities	Automation
Secrets Scanning	Detect and prevent hard-coded secrets	GitHub Secret Protection, Push Protection, Copilot Secret Scanning, Custom Patterns	Automatic
SCA	Manage dependency risks	Dependabot, Dependency Review, Artifact Attestations, SBOM, OpenSSF Scorecard, SLSA	Workflow / Auto
SAST	Detect code vulnerabilities	CodeQL (Default & Advanced), Copilot Autofix, 3rd Party SARIF	Workflow / Auto
IaC Scanning	Secure infrastructure configs	MSDO: Checkov, Template Analyzer, Terrascan, Trivy	Workflow
CIS	Secure container supply chain	MSDO: Checkov, Terrascan, Trivy, Anchore Grype	Workflow
DAST	Test running applications	OWASP ZAP (maintained by Checkmarx)	Workflow
Continuous Scanning	Runtime posture monitoring	Microsoft Defender for Cloud, Sentinel, Azure Policy	Workflow / Auto
Compliance	Governance & audit	GHAS Security Configurations (Policy-as-Code), Delegated Bypass, Audit Logs	Enforced

Shift-Left Security Maturity Model

Level	Practice	Tools
L1 — Reactive	Manual security reviews	Ad-hoc scanning
L2 — Automated	CI/CD-integrated scanning	CodeQL default setup, Dependabot
L3 — Proactive	Push protection, PR gates	Secret scanning push protection, CodeQL PR checks
L4 — Contextual	Runtime-aware prioritization	GHAS + MDC, attack path analysis
L5 — Agentic	AI-powered autonomous security	Copilot Autofix, Coding Agent, Campaigns, Custom Agents

Recommended Rollout

Phase 1 — Foundation

Enable & Connect

Enable GHAS on all repos
Connect GitHub to MDC
Enable secret scanning + push protection
Configure Dependabot

Phase 2 — Hardening

Strengthen & Enforce

Advanced CodeQL for critical repos
Agentless scanning in MDC
PR annotations + delegated bypass
MSDO workflow integration

Phase 3 — Intelligence

Contextualize & Campaign

GHAS + MDC native integration
Attack path analysis
Security campaigns
Copilot Autofix on all repos

Phase 4 — Agentic

Automate & Scale

Copilot Coding Agent for security
Custom security agents
Audit logs to SIEM
Track debt reduction KPIs

06 Key Takeaways & Call to Action

Agentic DevSecOps — where we're going and how to get started.

🤖

Agentic DevSecOps is Essential

For building secure AI apps and agents at scale — security as a first-class citizen of every workflow

🔗

GHAS + GHCP + MDC

Together provide a comprehensive code-to-cloud security fabric — bidirectional, contextual, AI-driven

⚡

3–12× Faster Remediation

Copilot Autofix and the Coding Agent dramatically reduce manual remediation effort

📐

Scalable Blueprint

Operationalize application security at scale while maintaining development velocity

🔄

Reusable Patterns

Proven guidelines to detect secrets, dependencies, and code vulnerabilities automatically

Which DevSecOps agents will you be creating?

Shift security left · Leverage agentic AI · Accelerate secure innovation · Reduce security debt

Demo repo: githubabcs-devops/gh-advsec-devsecops

Demo: What Was Demonstrated

#	Scenario	Tools in Action
1	Secret detected & blocked — Push protection preventing a GitHub PAT from being committed	GitHub Secret Protection, Push Protection
2	Copilot Autofix in action — SQL injection fixed in <30 seconds with one-click apply	CodeQL, Copilot Autofix
3	Custom security agent — Security IaC Agent finding misconfigured Kubernetes RBAC	Custom Agents, VS Code
4	Security campaign dashboard — Org-wide XSS remediation campaign	Security Campaigns, Copilot Autofix
5	MDC code-to-cloud — Tracing a code vulnerability to its internet-exposed runtime	Defender CSPM, Attack Path Analysis

07 References

All sources used in this guide — grounded in public GitHub, Microsoft, and industry documentation.

GitHub Documentation

Resource	URL
About GitHub Advanced Security	docs.github.com
GHAS Product Restructure (March 2025)	github.blog/changelog
CodeQL Documentation	codeql.github.com
Copilot Autofix — Found Means Fixed	github.blog
Copilot Coding Agent (GA)	github.blog
Copilot — The Agent Awakens	github.blog
About Custom Agents	docs.github.com
Secret Scanning Documentation	docs.github.com

Microsoft Documentation

Resource	URL
Defender for Cloud DevOps Security	learn.microsoft.com
GHAS Integration with MDC	learn.microsoft.com
Connect GitHub to Defender for Cloud	learn.microsoft.com
Agentless Code Scanning	learn.microsoft.com
Attack Path Analysis	learn.microsoft.com

Industry Reports

Resource	Source
Data Breach Investigations Report 2024	Verizon
Cost of a Data Breach Report 2024	IBM
State of Software Security 2024	Veracode
State of DevSecOps Report 2024	Contrast Security
NIST Secure Software Development Framework	NIST
SLSA Framework	slsa.dev