Published via [GitHub Executive Insights](https://github.com/solutions/executive-insights "Executive insights, curated just for you")

Secrets—such as API keys, passwords, tokens, encryption keys, and other credentials—are essential for modern software development. Developers frequently interact with credentials throughout the software development process—they securely connect your applications with critical infrastructure, databases, cloud services, and third-party APIs. However, __keeping secrets safe can be challenging__.  Without strict controls and automated safeguards, these credentials can inadvertently end up in repositories, logs, or other unsecured locations, increasing the risk of exposure.

In 2024 alone, we detected more than [39 million leaked secrets](https://github.blog/news-insights/octoverse/octoverse-2024/) on GitHub. According to the [IBM Cost of Data Breach Report (2024)](https://www.ibm.com/reports/data-breach), breaches involving compromised credentials cost organizations an average of $4.88 million per incident—a 10% increase from the previous year. 

> The impact of leaked secrets is growing, and as pressure to rapidly deliver software intensifies, organizations must adopt proactive security without burdening developers.

This article will help you understand how secret leaks occur, their financial and operational impact, and how to assess your organization’s unique risk profile. For current GitHub customers, we’ll also highlight the new secret risk assessment tool, which provides real-time insights into potential vulnerabilities within your codebase—helping teams take proactive security measures.

---

__Are you a current GitHub customer? Have an organization admin [run a secret risk assessment](https://docs.github.com/en/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/viewing-the-secret-risk-assessment-report-for-your-organization?utm_source=EIhub&utm_medium=Article&utm_campaign=GHAS-unbundle) to see your organization's secret leak footprint.__

---
## How do secrets get leaked?
Secret leaks commonly occur when credentials are inadvertently committed to repositories, mistakenly stored in logs, or exposed through misconfigured cloud environments. Attackers typically discover these secrets by scanning public repositories, exploiting misconfigurations, or through phishing and social engineering to infiltrate networks.

Once attackers gain access to these leaked credentials, they can move undetected through your systems, escalating privileges, accessing sensitive information, or even deploying ransomware. For instance, the [2022 LastPass breach](https://www.cybersecuritydive.com/news/lastpass-cyberattack-timeline/643958/) began with attackers gaining access to a single compromised credential, ultimately leading to extensive data exposure and [untold financial losses](https://cointelegraph.com/news/lastpass-threat-actor-steals-over-5-million-from-40-victims). 

<div class="embed-responsive embed-responsive-16by9">
<iframe title="Introduction to secret leaks with GitHub" src="https://www.youtube.com/embed/vMhDkt5JNN0?si=r5Z2oimunGMGbcyk" width="640" height="480" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe></div>

## The hidden costs of data exposure
The true cost of data exposure extends far beyond immediate financial losses. As if a $4.88 million price tag per incident weren’t damaging enough, organizations also face consequences that go beyond financial impact. When sensitive information such as proprietary data, financial records, or customer details is compromised, the resulting damage can severely erode customer and partner trust. According to the [Ponemon Sullivan Privacy Report](https://ponemonsullivanreport.com/2017/11/how-data-breaches-affect-reputation-and-share-value/), “65% of data breach victims lost trust in an organization as a result of a breach.”

Data breaches don’t just harm external reputation and finances—they disrupt internal operations as well. Organizations must redirect significant resources toward remediation and investigations, consuming valuable time and derailing progress on key business goals. Ultimately, the intangible costs—loss of trust, disrupted productivity, and strained relationships—can have an even greater and longer-lasting impact than the immediate financial losses.
## How to analyze your organization’s risk of secret leaks
Understanding and quantifying your organization's exposure to secret leaks is essential for strengthening your security posture and preventing breaches before they occur.

__Factors that increase risk:__
- __Complexity of credential usage__: Organizations using a wide variety of credentials across numerous repositories, cloud integrations, and third-party services inherently have more secrets to manage, increasing the likelihood of accidental exposure.
- __Developer access and credential use__: Companies with numerous developers requiring regular access to sensitive credentials face greater exposure risk, particularly when secret rotation processes—periodically updating or replacing credentials to limit their lifetime and reduce exposure risk—are manual or inconsistent.
- __Deployment frequency and speed__: Organizations rapidly shipping new code are at heightened risk, as fast-paced development cycles increase the chance of secrets being inadvertently included or exposed.
- __Manual versus automated processes__: Companies relying heavily on manual checks are more vulnerable compared to those employing integrated, automated security measures.
- __Open source and public repositories__: Contributing to public repositories or sharing code between private and public environments increases the chance of inadvertently exposing secrets. Automated scanning tools regularly monitor public repositories, making exposed credentials quickly discoverable and potentially exploitable.

__Quantifying your organizations risk__
- __Inventory audits__: Continuously identify and catalog secrets used across your codebase, infrastructure, and workflows.
- __Incident history analysis__: Examine past incidents to spot patterns and common weaknesses.
- __Benchmarking against industry standards__: Compare your secret management practices against established security standards such as the [OWASP Application Security Verification Standard (ASVS)](https://github.com/OWASP/ASVS), NIST guidelines, and GitHub's documentation on [keeping your credentials secure](https://docs.github.com/en/rest/authentication/keeping-your-api-credentials-secure?apiVersion=2022-11-28). Gaps in compliance with these guidelines may indicate areas of heightened risk.
- __Security training completion__: Regularly audit developer participation and completion rates for security training and education programs. Organizations with inconsistent or incomplete training practices are more susceptible to secret leaks.

By implementing these strategies, you can improve your understanding of your organization's secret exposure. Identifying and quantifying your risk level is a critical step toward strengthening your security posture and ensuring alignment with your development processes.

---

__Current GitHub customers: Quickly assess your secret exposure__

GitHub’s secret risk assessment provides immediate, aggregated insights into your organization's exposure to leaked credentials. It helps you identify occurrences of publicly exposed secrets, evaluate internal exposure, and pinpoint the most common credential types at risk. Admins can run this assessment directly from their organization’s ‘Security’ tab, enabling rapid action to protect your organization from breaches.

[Share this link](https://docs.github.com/en/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/viewing-the-secret-risk-assessment-report-for-your-organization?utm_source=EIhub&utm_medium=Article&utm_campaign=GHAS-unbundle) with an org admin to __run a secret risk assessment now.__

---

Throughout this article, we've examined the growing risks associated with secret leaks, including how quickly leaked credentials can escalate into costly breaches and the significant, long-term impacts on customer trust and operational productivity.

If you want to go beyond understanding your organization’s exposure and learn more about proactive security measures, check out our in-depth eBook, [Secret Scanning: A Key to Your Cybersecurity Strategy, where you'll discover](https://github.com/resources/whitepapers/secret-scanning-a-key-to-your-cybersecurity-strategy?utm_source=EIhub&utm_medium=Article&utm_campaign=GHAS-unbundle):

- Comprehensive secrets management approaches.
- Key principles to enhance your organization's security posture.
- Practical guidance on implementing or improving your secrets management processes.

Additionally, check out [GitHub Secret Protection](https://github.com/security/advanced-security/secret-protection?utm_source=EIhub&utm_medium=Article&utm_campaign=GHAS-unbundle) to learn how you can prevent secrets from being leaked across your enterprise and have your developers ship secure code, by default.

Want to learn more about the strategic role of AI and other innovations at GitHub? Explore [Executive Insights](https://github.com/solutions/executive-insights) for more thought leadership on the future of technology and business.

39 million secrets leaked last year. Are yours safe? Here’s what you should know.

secret-risk-assessment

Resource Page for /enterprise/understanding-secret-leak-exposure

Understanding your organization's exposure to secret leaks

Published via [GitHub Executive Insights](https://github.com/solutions/executive-insights "Executive insights, curated just for you")

In this episode of [GitHub for Leaders](https://gh.io/GitHubForLeaders), host Anjuan Simmons sits down with cybersecurity researcher Daniel Cuthbert to discuss the evolving challenges of enterprise security facing leaders right now – and why credential leaks remain one of the most costly, yet preventable, threats.

<div class="embed-responsive embed-responsive-16by9">
<iframe title="GitHub for Leaders: How CXOs limit risk without losing speed" src="https://www.youtube.com/embed/vsdOAyWddk4?si=vgp1d8pXPo_Bb7yu" width="640" height="480" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe></div>

The conversation kicks off with a startling stat: nearly one-third of security breaches originate from weak or compromised credentials. Daniel emphasizes why security doesn’t have to be a one-size-fits-all solution but explains how modular, developer-integrated solutions can minimize risk without slowing innovation.

---
__Understanding your organization's exposure to secret leaks__: Credential leaks are expensive, damaging, and on the rise. This article helps you gauge your organization’s specific risk—and how to reduce exposure before it turns into impact. [Learn more >](https://resources.github.com/enterprise/understanding-secret-leak-exposure/) 

---

The conversation also explores how security tooling must evolve to fit seamlessly into developers’ workflows—from real-time feedback in IDEs to GitHub's code scanning capabilities. Daniel highlights the importance of contextual feedback and how tools like Copilot Autofix and CodeQL empower developers to remediate vulnerabilities quickly—without needing to be security experts.

Anjuan and Daniel also examine how leaders can scale security practices without compromising creativity,, as well as build guardrails into the development process that help shift the team from a reactive to a proactive security posture.

As the episode wraps, Anjuan and Daniel talk about the business case for [GitHub Secret Protection](https://github.com/security/advanced-security/secret-protection?utm_source=EIhub&utm_medium=Article&utm_campaign=GHAS-unbundle), the risks of delayed security practices, and how GitHub’s recently unbundled Advanced Security products—including standalone [Secret Protection](https://github.com/security/advanced-security/secret-protection?utm_source=EIhub&utm_medium=Article&utm_campaign=GHAS-unbundle) and [Code Security](https://github.com/security/advanced-security/code-security?utm_campaign=GHAS-unbundle&utm_medium=Article&utm_source=EIhub)—are giving enterprises more flexibility to manage the unique risks they face.

👉 Whether you’re building secure-by-default workflows or trying to get buy-in on shifting security left, this episode offers clarity, practical advice, and inspiration for forward-thinking tech leaders.

---

Want to learn more about the strategic role of security and other innovations at GitHub? Explore [Executive Insights](https://github.com/solutions/executive-insights) for more thought leadership on the future of technology and business.


Insights from the senior leaders changing the way software is developed

for-leaders

Resource Page for /for-leaders/how-cxos-limit-risk-without-losing-speed

GitHub for Leaders: How CXOs limit risk without losing speed

Published via [GitHub Executive Insights](https://github.com/solutions/executive-insights "Executive insights, curated just for you")

Across industries, organizations are turning to AI to automate repetitive tasks, streamline complex processes, and enable workers to focus on more strategic, creative initiatives. Tools like GitHub Copilot—shown to speed up task completion by 46% and improve code quality by 39%—are already transforming the way software gets built.

But successful AI adoption is not so simple. It demands strategic planning, structured implementation, and aligning the technology with organizational goals. Businesses large and small will have to implement an individualized and mindful approach to get the most out of an AI solution. 

One company that has had success with GitHub Copilot adoption is Thomson Reuters, a legal, tax, accounting, and media leader. Let’s take a look at the steps they used to implement and scale GitHub Copilot across their engineering organization, and how you can do the same.
## Setting the stage
Thomson Reuters began their AI journey in 2022. Engineering leaders realized that what started as industry buzz was an opportunity to foster engineering excellence within the company–and GitHub Copilot could be just the thing to accelerate their operations. 

But first, they needed to answer several key questions:

- How can GitHub Copilot improve developer efficiency, code quality, and satisfaction?
- Will it align with Thomson Reuters’ broader engineering culture and business goals?
- How can they onboard developers effectively with minimal resistance?

To find these answers, they initiated two small, focused GitHub Copilot pilot programs in  2023. The programs included:

- 100+ engineers from various teams working across a range of tech stacks.
- A commitment from participants to engage in four hours of coding per week with GitHub Copilot and provide weekly feedback.
- A seven-week timeline designed to thoroughly test how GitHub Copilot impacted coding efficiency, quality, and the overall developer experience.

![Thomson Reuters](//images.ctfassets.net/wfutmusr1t3h/3haCu12gZzA9JOv7GpDcuO/6888129493cb5b0a9f3a7de64894c4b0/Screenshot_2025-03-21_at_3.53.03_PM.png)
## Pilot program results
How did it go? 

- 46% faster task completion rate for developers using GitHub Copilot.
- 39% improvement in code quality (measured by the number of changes per PR, indicating more impactful contributions).
- 68% of developers reported a positive user experience, describing the tool as intuitive and easy to integrate into their workflows.

Participant comments further reflected their excitement:

- “It’s like having a mind-reading coding buddy.”
- “I couldn’t imagine working without GitHub Copilot now.”
- “A magical experience—unless, of course, the AI suggestions were off-target!”

Clearly, the pilot outcomes were enough to pave the way for broader adoption.
## Scaling GitHub Copilot across the enterprise
After the pilot’s success, it was time to move from testing to full implementation. Thomson Reuters created a four-stream strategy to scale adoption effectively:
1. Rollout and adoption: By automating license activation and usage tracking, they efficiently onboarded over 2,000 seats for developers across multiple teams.
2. Enablement and training: They established a community of champions—early adopters who became advocates for the tool—and offered in-depth training resources to empower them to make the most of GitHub Copilot.
3. Measurement and reporting: Metrics such as developer efficiency, code quality, and satisfaction, combined with monthly surveys, ensured that any challenges were addressed promptly. This approach also provided a clear way to track ongoing success.
4. Best practices and continuous improvement: The team shared success stories and use cases internally to maintain enthusiasm and optimize strategies for long-term ROI.

## Sustained performance metrics
By expanding their data collection and feedback loops, Thomson Reuters observed the following:

- A 45% decrease in pull request (PR) durations.
- A 44% increase in the number of changes per PR, indicating more impactful contributions from developers.

Even more striking? Developers reported using their newfound efficiency to engage in learning, research, and innovative pursuits, enhancing their overall job satisfaction.

---

Want to ensure a successful GitHub Copilot rollout?

Make data-driven decisions by tracking active and engaged users, language preferences, and IDE usage. 

[Explore the metrics guide now >](https://docs.github.com/en/copilot/managing-copilot/managing-github-copilot-in-your-organization/reviewing-activity-related-to-github-copilot-in-your-organization/analyzing-usage-over-time-with-the-copilot-metrics-api "Explore the metrics guide now>")

---
## Lessons for enterprise leaders

Lessons for enterprise leaders
For enterprise leaders like you looking to adopt AI tools like GitHub Copilot, here are the timeless lessons from Thomson Reuters:

1. __Start small and scale__
Pilot programs allow enterprises to test the waters, collect precise feedback, and refine adoption strategies before committing to full-scale implementation.

2. __Focus on the metrics that matter__
Establish quantitative and qualitative metrics early on (even before you start your trial). Whether it’s coding speed or developer satisfaction, identify KPIs that matter to your organization.

3. __Invest in training and support__
Don’t assume everyone will adapt naturally to AI tools. A structured enablement program ensures developers of all skill levels can benefit.

4. __Build a community of champions__
Identifying enthusiastic early adopters who can inspire others is crucial. Their success stories establish trust and excitement for broader teams.

5. __Keep it collaborative__
AI tools like GitHub Copilot thrive on collaboration. They’re designed to complement human effort—not replace it. Promote this mindset to avoid overreliance or misuse.

6. __Iterate and adapt__
AI adoption is a living process. Build feedback loops into your strategy to continually refine and improve as you learn more about the technology’s impact.

<div class="embed-responsive embed-responsive-16by9">
<iframe title="Complex migrations: Why failing forward helps push past resistance to change" src="https://www.youtube.com/embed/0CXSRt8ZiQI?si=zZHDCfNgtV8D8OxA" width="640" height="480" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe></div>

## AI in enterprises is here to stay—are you in?
GitHub Copilot is a profound step toward the future of software development. By freeing up developers from repetitive coding tasks, it empowers them to focus on creative problem-solving, big-picture thinking, and innovation.

Thomson Reuters provides a clear roadmap for enterprises to successfully integrate AI, from thoughtful piloting to seamless scaling. Their outcome? Higher efficiency, better code, and happier developers.

If you’re ready to follow in their footsteps, [get started now >](https://github.com/enterprise)

---

Want to learn more about the strategic role of AI and other innovations at GitHub? Explore [Executive Insights](https://github.com/solutions/executive-insights) for more thought leadership on the future of technology and business.

Has your organization implemented AI into your software engineering process yet?

How Thomson Reuters successfully adopted AI (and how your organization can, too)

<div class="embed-responsive embed-responsive-16by9">
  <iframe src="https://www.youtube.com/embed/PS3YQ2DcvDg" width="640" height="375" frameborder="0" allowfullscreen></iframe>
</div>

The future of software development is evolving fast—are you ready to stay ahead? Join us for an exclusive look at GitHub’s latest innovations and a sneak peek at what’s coming next. From AI-powered code reviews and enhanced IDE support to advanced security features and new collaboration tools, this session is designed to help your team build, ship, and scale faster than ever.

What’s in store for you: 
- A look at GitHub’s upcoming features and enhancements—plus the strategy driving their development.
- Insights from product leaders on how AI and automation are shaping the future of software development.
- Best practices to boost security, collaboration, and developer productivity.

Don’t miss this opportunity to stay ahead of the curve and see how GitHub can help your organization drive efficiency, security, and innovation.

Form_Ungated_Contact

Tell us more about your needs

Wondering how GitHub can help your business?

Unlock what’s next: GitHub Roadmap Webinar, Q1 2025


The design features a dark background with abstract, futuristic blue and gold gradient shapes and circuit-like line elements. The GitHub logo is displayed in the bottom left corner. The text announces the event date as Thursday, March 27, 2025 and speaker is Mario Rodriguez, Chief Product Officer, GitHub.

/webcasts/github-roadmap-webinar-q1-americas

Resource Page for /webcasts/github-roadmap-webinar-q1-americas

CO-GHP-WBNR-FY25-03Mar-13-Quarterly-Roadmap-Webinar-Q1-2025-AMER-8487

GitHub Roadmap Webinar, Q1 2025 - Americas

<div class="embed-responsive embed-responsive-16by9">
  <iframe src="https://www.youtube.com/embed/hcWezL8p_84" width="640" height="375" frameborder="0" allowfullscreen></iframe>
</div>

The future of software development is evolving fast—are you ready to stay ahead? Join us for an exclusive look at GitHub’s latest innovations and a sneak peek at what’s coming next. From AI-powered code reviews and enhanced IDE support to advanced security features and new collaboration tools, this session is designed to help your team build, ship, and scale faster than ever.

What’s in store for you: 
- A look at GitHub’s upcoming features and enhancements—plus the strategy driving their development.
- Insights from product leaders on how AI and automation are shaping the future of software development.
- Best practices to boost security, collaboration, and developer productivity.

Don’t miss this opportunity to stay ahead of the curve and see how GitHub can help your organization drive efficiency, security, and innovation.


The design features a dark background with abstract, futuristic blue and gold gradient shapes and circuit-like line elements. The GitHub logo is displayed in the bottom left corner. The text says the event date is Thursday, March 27, 2025.

/webcasts/github-roadmap-webinar-q1

Resource Page for /webcasts/github-roadmap-webinar-q1-asia-pacific

CO-GHP-WBNR-FY25-03Mar-13-Quarterly-Roadmap-Webinar-Q1-2025-APAC-8487

GitHub Roadmap Webinar, Q1 2025 - Asia Pacific

<div class="embed-responsive embed-responsive-16by9">
  <iframe src="https://www.youtube.com/embed/IrG4Kn1Zr4c" width="640" height="375" frameborder="0" allowfullscreen></iframe>
</div>

The future of software development is evolving fast—are you ready to stay ahead? Join us for an exclusive look at GitHub’s latest innovations and a sneak peek at what’s coming next. From AI-powered code reviews and enhanced IDE support to advanced security features and new collaboration tools, this session is designed to help your team build, ship, and scale faster than ever.

What’s in store for you: 
- A look at GitHub’s upcoming features and enhancements—plus the strategy driving their development.
- Insights from product leaders on how AI and automation are shaping the future of software development.
- Best practices to boost security, collaboration, and developer productivity.

Don’t miss this opportunity to stay ahead of the curve and see how GitHub can help your organization drive efficiency, security, and innovation.


Resource Page for /webcasts/github-roadmap-webinar-q1-europe-middle-east-africa

CO-GHP-WBNR-FY25-03Mar-13-Quarterly-Roadmap-Webinar-Q1-2025-EMEA-8487

GitHub Roadmap Webinar, Q1 2025 - Europe, Middle East and Africa

Home > Bottom > Banner (Accelerate...)

Curate blazing fast developer environments and help your organization be more agile, secure, and efficient.

Home > Bottom > Card #1 (Codespaces)

Ship secure applications with a community-driven, developer-first approach.


Home > Bottom > Card #2 (Adv. Sec.)

Automate your software workflows with a powerful DevOps toolkit and built-in CI/CD.

Home > Bottom > Card #3 (Actions)

Safely publish and consume packages within your organization.

Home > Bottom > Card #4 (Packages)

Home > Feature > Banner > CTA

Home > Feature > Banner (Learning Pathways)

Bring the power of generative AI to engineering teams with GitHub Copilot. Learn how you can maximize developer velocity and innovation.


Copilot card

Stay one step ahead by shipping your software securely within GitHub: Identify and fix security issues directly in the developer flow.

Security Card

Learn why more than 90% of the Fortune 100 use GitHub—the leading developer platform compared to alternative solutions.

Why GitHub? Card

Become a GitHub expert in CI/CD, application security, governance, and AI-developer tools through expert-guided learning pathways with tips and insights from leading enterprise organizations.

Resource Page for /learn/build-like-the-leading-tech-innovators

CO-GHG-CONTACT-FY23-10Oct-01-WW-Resources-Contact-Request/406214

GitHub Learning Pathways

Home > Final > Banner > CTA

Home > Final > Banner (Sales Team)

Home > Hero > CTA #1

Home > Hero > CTA #2

Set your business up for success with solutions to any number of common questions.

Resources to help enterprise teams do their best work

Copilot

Security

Why GitHub?

GitHub Learning Pathways

Latest articles

Understanding your organization's exposure to secret leaks

GitHub for Leaders: How CXOs limit risk without losing speed

How Thomson Reuters successfully adopted AI (and how your organization can, too)

Browse by topic

Latest videos

GitHub Roadmap Webinar, Q1 2025 - Americas

GitHub Roadmap Webinar, Q1 2025 - Asia Pacific

GitHub Roadmap Webinar, Q1 2025 - Europe, Middle East and Africa

Accelerate innovation with the platform developers love

Codespaces

Advanced Security

Actions

Packages

Questions? Reach out to our sales team