Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
GitHub Advanced Security is the GitHub exam for securing code, secrets and dependencies on the platform, and this guide covers it as of October 2026. It walks through the GH-500 exam, the six domains and their weights, the format and passing score, what changed in the July 2026 rewrite, how the two-year validity and renewal work, and the roles it fits.
GitHub Advanced Security, earned by passing exam GH-500, is the GitHub certification for the security features built into the platform. It tests whether you can turn on Secret Protection, supply chain security and Code Security, work the alerts they produce through to a fix, and set the policies that stop an organization from shipping the same problem twice.
The credential is GitHub-branded, but Microsoft administers it. You register with a Microsoft Learn account, schedule through Pearson VUE, and the certification record lives in your Microsoft Learn profile. Microsoft rates the exam intermediate and lists administrators, developers, DevOps engineers, solution architects and students as its audience.
GH-500 has no enforced prerequisites, but the audience profile assumes hands-on time with GitHub Advanced Security plus working knowledge of GitHub fundamentals, CI/CD and secure development. The skills measured outline is current as of July 2026, the release Microsoft says changed the exam significantly, and it is published on Microsoft Learn.
Suite structure, Security Overview, public versus enterprise availability, secure SDLC and campaigns. 15 to 20%.
Enablement, push protection, validity checks, delegated bypass and custom patterns. 15 to 20%.
Dependency graph, SBOM export, EPSS prioritization, Dependency Review and update rules. 15 to 20%.
CodeQL and third-party tools, SARIF, scan workflows, triage and autofix. 10 to 15%.
CVE, CWE and advisories, severity rulesets, bulk alert work and CodeQL query suites. 15 to 20%.
Enterprise rollout, default configurations, policies, roles and bypass permissions. 10 to 15%.
Four things that set GitHub Advanced Security apart from the other GitHub exams and from vendor-neutral security credentials in 2026.
Where CSSLP covers secure development in the abstract, GH-500 tests the specific controls GitHub ships, from push protection that blocks a secret before it reaches the repository to CodeQL scanning and Dependency Review checks on a pull request. Since April 2025 GitHub has sold these features as two products, GitHub Secret Protection and GitHub Code Security, and the July 2026 exam uses those names.
Microsoft’s audience profile describes someone who configures security features, triages and remediates alerts, and applies prevention-first practices through policies, workflows and automation. That reads like an AppSec or DevSecOps job description, and the objectives on security campaigns, EPSS scoring and delegated bypass back it up.
Microsoft’s change log says GH-500 changed significantly in July 2026. Secret scanning is now Secret Protection, Dependabot and Dependency Review sit under supply chain security, and code scanning with CodeQL is now Code Security. Our guide to the 2026 GitHub certification track covers what changed across all six exams.
GitHub Advanced Security is valid for two years. GitHub is moving its certifications onto Microsoft’s recertification process, and any GitHub certification that expires before that process is ready gets a six-month extension. GH-500 is not a DoD 8140 credential and does not appear on the qualification matrix. The current matrix is published at the DoD Cyber Exchange.
Its weight is practical instead. When a company keeps its code on GitHub, the person who can set push protection policy, roll a CodeQL default configuration across every repository in an organization and run a remediation campaign is the person its security team needs. GH-500 is the credential that names that skill.
The certification, the GH-500 exam, and what happens after you pass, as of October 2026.
GH-500 sits at the role-based tier of the GitHub track. The right next credential depends on whether you want more of GitHub or recognition beyond it. These three build most directly on what GH-500 tests.
The governance credential. GH-100 changed significantly in July 2026, and its study guide now carries the title GitHub Enterprise Administrator. Implementing secure software development and compliance is its heaviest domain at 25 to 30 percent, so much of what you studied for GH-500 carries straight over.
The automation credential. GH-200 measures five skill areas rewritten in January 2026, including a secure automation domain that covers SHA pinning, OIDC federation, GITHUB_TOKEN permissions and script injection. Code scanning usually runs in Actions, so the two exams meet in the workflow file.
The vendor-neutral step. ISC2’s Certified Secure Software Lifecycle Professional covers eight domains that follow the development lifecycle, asks for four years of experience, and is approved under DoDM 8140.03. It’s the credential to add when you need recognition that doesn’t depend on one platform.
GH-500 sits at the role-based tier of the GitHub track. GH-900 is an optional starting point below it, and from here the path branches into enterprise governance on GitHub or vendor-neutral secure software credentials.
The GitHub groundwork
Security on GitHub
Governance or vendor-neutral
Two questions to answer before you commit: can you sit it, and should you pursue GH-500 specifically. Here’s a straight answer to both.
No enforced prerequisites and no experience check.
GitHub and Microsoft enforce no prerequisite certification and no minimum experience. You create a Microsoft Learn account, register with a personal Microsoft account rather than a work account so the record stays with you when you change jobs, and schedule through Pearson VUE, either online proctored or at a test center.
The outline assumes you’ve administered these features.
A free account shows you secret scanning, code scanning and Dependabot alerts on public repositories. It won’t show you delegated bypass, security campaigns, enterprise default configurations, or how features differ between GitHub Enterprise Cloud and GitHub Enterprise Server, and the July 2026 outline tests all of them. Get access to an organization with Secret Protection and Code Security turned on before you book, or train somewhere that provides one.
GH-500 supports a security role rather than qualifying you for one on its own. These are the six roles where configuring and running GitHub’s security features is part of the job.
Owns how vulnerabilities get found and fixed in the code base. GH-500 covers the CodeQL setup, SARIF ingestion from other scanners, alert triage and remediation workflows that fill most of the week when the code lives on GitHub.
Builds security checks into the delivery pipeline. GH-500 tests code scanning workflows in GitHub Actions or external CI, Dependency Review as a pre-merge check, and push protection that stops a secret before it lands in the commit history.
Runs remediation as a program instead of a backlog. The security operations domain covers severity rulesets, campaign-based remediation, bulk alert management and EPSS scoring for supply chain alerts, which is how a manager decides what gets fixed first.
Rolls security features out at enterprise, organization and repository level. GH-500’s administration domain covers default configurations, inheritance, bypass permissions and the APIs for configuring security at scale, and it overlaps heavily with GH-100.
Fixes what the scanners find. GH-500 shows a developer can read dataflow results, judge an autofix suggestion, clear a push protection block properly and follow the dismissal rules a security team sets.
Designs how code moves from commit to production. Microsoft lists solution architects in the GH-500 audience, and the secure SDLC and prevention-first objectives match the decisions an architect makes about where each check sits.
GH-500 is the security exam in the GitHub track. Here’s how it lines up against the GitHub fundamentals exam, the administration exam it overlaps with most, and ISC2’s vendor-neutral secure software credential.
| GitHub Advanced Security (GH-500) | GitHub Foundations (GH-900) | GitHub Administration (GH-100) | ISC2 CSSLP | |
|---|---|---|---|---|
| Issuer | GitHub, administered by Microsoft | GitHub, administered by Microsoft | GitHub, administered by Microsoft | ISC2 |
| Level | Intermediate | Fundamentals | Intermediate | Experience-gated |
| Focus | Securing code, secrets and dependencies on GitHub | Working in GitHub | Running GitHub Enterprise | Building software securely, any platform |
| Current Outline | July 2026 | January 2026 | July 2026 | September 15, 2023 |
| Exam Time | 100 min | 100 min | 100 min | 3 hours |
| Experience | None enforced | None | None enforced | 4 years in 1 or more domains |
| Passing Score | 700 of 1000 | 700 of 1000 | 700 of 1000 | 700 of 1000 |
| Cost (US) | $99 | $99 | $99 | ~$599 |
| Validity | 2 years | Does not expire | 2 years | 3 years, 90 CPEs |
| Best For | AppSec and DevSecOps engineers whose code lives on GitHub | New GitHub users and non-developer roles | Enterprise and organization administrators | People who ship code and want platform-neutral recognition |
Microsoft prices GitHub exams by the country where you test, so fees vary outside the United States. GH-500, GH-900 and GH-100 don’t appear on the DoD 8140 matrix, while ISC2 lists CSSLP as approved under DoDM 8140.03. The two-year GitHub credentials are moving onto Microsoft’s recertification process, so check your expiration date in your Microsoft Learn profile.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
As a Microsoft training partner, we teach GH-500 inside our GitHub Enterprise Certification Track, a five-day live boot camp that covers four exams: GH-100, GH-200, GH-300 and GH-500. Day four is given to Advanced Security, with labs in a hosted GitHub Enterprise organization that has Advanced Security enabled. Official Microsoft Courseware, vouchers for all four exams and a free retake are included.
The full GitHub track, the Microsoft program that runs its exams, and the study and security reading that sits next to GH-500.
The current structure of all six GitHub exams as of September 2026, including the July 2026 GH-500 rewrite and its new weights, where candidates lose points, and the order that makes sense for AppSec, DevOps and admin roles.
The full Microsoft catalog, from fundamentals through the associate and expert tiers, with exam details and the job roles each path leads to. Useful context once your GH-500 record lands in your Microsoft Learn profile.
How Microsoft certification has followed each generation of Microsoft technology, and why the credentials change when the products underneath them do.
How to read an official outline, what the verbs in each objective signal, and how to turn domain weights into study hours. Microsoft publishes its version as the study guide on Microsoft Learn.
Check-in, ID matching, breaks, online proctoring and retake windows compared across vendors, including Microsoft’s 24-hour and 14-day retake rules and its Pearson VUE waiver process.
The ten risks OWASP ranks for AI agents that call tools and act with delegated authority, including a supply chain risk that plays out at runtime rather than at build time.
How the three performance-based Kubernetes exams differ, and why the CKS, which gives supply chain security 20 percent of its weight, requires a passing CKA first.
The GH-500 exam is organized into six domains with a flat weighting. Four sit at 15 to 20 percent, and the other two, Code Security and suites administration, sit at 10 to 15 percent. Click any domain for what it covers.
How the Security suites are structured and how Code Security, Secret Protection and Supply Chain Security differ, including what’s available on public repositories versus enterprise environments and what the Security Overview shows. Also covers secure SDLC strategy, prevention-first versus gate-based approaches, security campaigns, alert responsibilities across developer, security and admin roles, and delegated bypass.
Enabling Secret Protection at repository and organization level, and how its behavior differs between public and private or enterprise repositories. Also covers push protection, validity checks and prioritized alerts for high-confidence secrets, the alert lifecycle and remediation, role-based and delegated bypass policies, alert recipients and exclusions, and custom secret patterns.
Dependency security tooling, vulnerability databases, the dependency graph and SBOM export formats. Also covers supply chain alert prioritization with EPSS scoring, remediation through campaigns and pull requests, auto-dismiss behavior, Dependency Review as a pre-merge license and compliance check, grouped update rules, alert assignment, webhooks and external notifications.
Native and third-party code scanning, choosing between CodeQL and other analysis tools, and SARIF file ingestion. Also covers enabling scanning through GitHub Actions or an external CI system, workflow templates, matrix builds and scan frequency, dataflow analysis results, autofix, alert dismissal and severity, and troubleshooting failed or slow scans.
CVE, CWE and GitHub Security Advisory concepts, and remediation that runs end to end across alerts and advisories. Also covers severity and remediation rulesets, campaign-based and bulk alert work, automated dismissal and documentation, custom CodeQL query suites, alert ownership across roles, cross-suite rulesets, and prevention through push protection, dependency scanning and pre-merge analysis.
Enabling the Security suites at enterprise, organization and repository level, and the feature differences between GitHub Enterprise Cloud and GitHub Enterprise Server. Also covers default configurations and inheritance, enterprise and organization policies and rulesets, enforcement boundaries and bypass permissions, administrator, security manager and developer roles, approved CodeQL workflows, and the APIs used to configure security at scale.
Domains and weights reflect the Microsoft Learn GH-500 study guide, skills measured as of July 2026, the release Microsoft says changed the exam significantly. Microsoft refreshes GitHub exams periodically, so confirm the current outline on Microsoft Learn before scheduling.
The questions candidates ask most often when researching the GitHub Advanced Security certification.
GitHub Advanced Security, earned by passing exam GH-500, is the GitHub certification for securing code, secrets and dependencies. It tests whether you can configure Secret Protection, supply chain security and Code Security, work the alerts they raise through to a fix, and govern those features across an organization or enterprise. Microsoft rates it at the intermediate level.
Microsoft administers it, but the credential stays GitHub-branded. You register with a Microsoft Learn account, schedule through Pearson VUE, and the certification appears in your Microsoft Learn profile, but the title is GitHub Advanced Security rather than a Microsoft Certified credential. Training Camp teaches it as a Microsoft training partner using Official Microsoft Courseware.
No prerequisite certification or experience check is enforced, so anyone can register. Microsoft writes the exam for people who already use GitHub Advanced Security to secure code, secrets and dependencies, and who know GitHub fundamentals, CI/CD and secure development concepts. Treat that audience profile as the real entry bar.
The six domains are Describe GitHub Security suites, features, and ecosystem (15 to 20 percent), Configure and use Secret Protection (15 to 20 percent), Configure and use supply chain security (15 to 20 percent), Configure and use Code Security (10 to 15 percent), Security operations: best practices, prioritization, and remediation (15 to 20 percent), and GitHub Security suites administration (10 to 15 percent). No single domain dominates the score.
Microsoft doesn’t publish a question count for GH-500. You get 100 minutes, the exam is proctored, and it may include interactive components. The Microsoft Learn lookup that some role-based Microsoft exams allow is not available on GitHub exams, so everything has to come from what you know.
You need 700 on Microsoft’s scale of 1 to 1,000. It’s a scaled score, so 700 doesn’t mean 70 percent correct, and there’s no penalty for a wrong answer. If you fail, you can retake after 24 hours, then wait 14 days between later attempts, with a limit of five attempts in 12 months.
The GH-500 exam costs $99 USD in the United States as of October 2026, the same as the other GitHub exams. Microsoft prices by the country where the exam is proctored, so check the exam page for your region. Training Camp’s GitHub Enterprise Certification Track includes the GH-500 voucher, plus vouchers for GH-100, GH-200 and GH-300 and a free retake.
Microsoft’s change log says the exam changed significantly in July 2026, with objectives added, removed, moved and reworded. The domains now use GitHub’s current product names: Secret Protection (formerly secret scanning), supply chain security (formerly Dependabot and Dependency Review) and Code Security (formerly code scanning with CodeQL). The outline has six domains, including one on security operations and one on administering the Security suites. Check the skills measured date on any practice test before you rely on it.
No. GH-500 doesn’t appear on the DoD 8140 qualification matrix, so it won’t satisfy a cyber-coded position requirement on its own. If you need an 8140 credential for secure software work, ISC2 lists CSSLP as approved under DoDM 8140.03. See the full DoD 8140 work role paths.
Yes. GitHub certifications are valid for two years. GitHub is moving them onto Microsoft’s recertification process, which will let holders renew without retaking the full exam, and certifications that expire before that process is ready get a six-month extension. If yours has already lapsed, GitHub asks you to email learn@github.com for one exam voucher to cover your first renewal attempt.
GH-500 fits application security engineers, DevSecOps engineers, security managers who run remediation programs, GitHub enterprise and organization administrators, developers who act as security champions, and solution architects who design delivery pipelines. It supports those roles rather than qualifying you for one on its own.
GH-100 GitHub Administration overlaps the most. Its July 2026 outline gives implementing secure software development and compliance 25 to 30 percent, covering secret scanning, CodeQL and Dependabot from the administrator’s side. GH-200 GitHub Actions comes next for anyone who runs code scanning in workflows. Training Camp’s GitHub Enterprise Certification Track covers GH-100, GH-200, GH-300 and GH-500 in one five-day boot camp.
If your organization keeps its code on GitHub and you own the security alerts, yes. It costs $99, the July 2026 outline matches how GitHub now names and sells these features, and the exam tests program-level work such as campaigns, EPSS prioritization and rulesets. If your security work happens outside GitHub, a vendor-neutral credential such as CSSLP will carry further.
If you’re weighing the certification, planning the GitHub track for a security team, or arranging GitHub training for a group, tell us where you are and we’ll help you map out the right path.