Product1 publisher3 min readPublished
GitHub triples the license ceiling for self-serve Advanced Security trials
Mid-size engineering teams can now run GitHub Advanced Security against their own repositories for 30 days without a sales call, and then they have to decide what a good result looks like. Mitch Ashley of The Futurum Group says the bottleneck was procurement.
The Product Desk · Product desk
What happened
- GitHub raised the eligibility ceiling for self-serve GitHub Advanced Security trials from enterprises with up to 100 licenses to those with up to 300.
- An eligible Enterprise Cloud organization starts the 30-day trial itself from the Billing and licensing page in enterprise settings, without a sales conversation first.
- The trial covers both Code Security and Secret Protection, and they can be switched on across every organization the enterprise runs.
- December's change opened eligibility to more Enterprise customers and set a 180-day cooldown, so an organization that tried GHAS and declined can start a second trial later.
- In May, GitHub let eligible admins launch a trial straight from a Secret Protection or Code Security risk assessment instead of a separate setup flow.
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- decision The evaluation moves to whoever holds billing access, so the admin who can start the trial is also the person who produces the evidence that settles the purchase.
- constraint Thirty days is short for a security evaluation that needs a full remediation cycle to prove anything, and the clock runs out whether or not the measurement is finished.
- capability Prevention becomes measurable inside the window, because blocks happen at commit time and can be counted even when nothing has been fixed yet.
- exposure Turning secret scanning on across every organization at once hands the team that did it a list of exposed credentials it now knows about, purchase or no purchase.
The 300-license number is an entry gate. An organization that qualifies can add any number of committers once the trial is running [4], and switch both products on across every organization the enterprise runs [3]. The ceiling decides who is allowed to begin. After that, the size of the test is whatever the team's real repository count happens to be.
Three times the old ceiling means 200 licenses of new headroom [17], and that band is where the awkward cases sit. devops.com describes the adoption problem as the companies scaling fast enough that their attack surface outgrows their process, unable to justify a sales call just to find out whether a product fits [18]. Mitch Ashley, vice president and practice lead for CIO & Technology Buyers and Software Lifecycle Engineering at The Futurum Group [11], reads the change as a distribution play. "Widening self-serve trials is a distribution move that targets the real bottleneck in security tooling evaluations, which is usually procurement," Ashley said [12]. "Teams in that 100-to-300 band already carry the secret sprawl GHAS is built to find," he said [13].
What the trial has to prove is the harder half. Code Security runs CodeQL across a repository and flags vulnerable patterns and risky dependencies [7]. Secret Protection scans for exposed credentials and API keys, and it can block a pull request outright when it finds one instead of filing a report after the fact [6]. devops.com argues the second capability is the one to judge, on the grounds that AI-assisted development increases commit volume [16]. No figure for that increase appears in the piece [19].
Ashley said the standard has moved. "What a trial has to answer has changed. Scan-find-fix was built for code written at human speed," he said [14]. "Watch whether teams judge this on what it blocks at commit rather than what it reports on day 30," he said [15].
The 30 days can produce two counts, and they need to be kept apart. The first is findings opened by the initial CodeQL pass, which tracks how old and how large the repositories are more than anything the tool did during the window [7]. The second is pull requests Secret Protection refused [6], which is a count of credentials that did not land in a repository between day one and day 30.
That first number is work for someone next quarter. The second is the one the admin who turned this on will have to put in front of finance, because the trial ends at day 30 unless something is bought [5].
The two products were split out of the old bundled GHAS last year [10], so a team in the new band can also find out which of the two it actually wants. That is a live question for anyone whose leaked-credential problem and whose dependency problem are not the same size.
What to watch
- Whether GitHub raises the self-serve ceiling again past 300 licenses, or publishes conversion figures from the widened trials.
- Whether GitHub's own trial materials start reporting blocked pull requests instead of findings counts.
- Whether the 180-day cooldown gets shortened for organizations in the new 100-to-300 band.