- How Code Security, Secret Protection and Supply Chain Security fit together, and what is available for public repositories versus enterprise.
- The Security Overview and security campaigns.
- An end-to-end secure SDLC, and prevention-first versus gate-based security.
- Alert management, dismissal best practices, and who owns what between developers, security and admins.
GitHub Certification Training Course
GitHub Advanced Security (GH-500) Certification Training Course
Find and fix vulnerabilities, leaked secrets and risky dependencies before they ship, and get ready for the GitHub Advanced Security (GH-500) exam with Accumentum’s live online training.
Course focus: Configure Secret Protection, Code Security with CodeQL and supply chain security, triage and fix alerts, run security at scale, and prepare for the GitHub Advanced Security (GH-500) exam.
Course Overview
Secure code, secrets and dependencies where developers already work.
GitHub Advanced Security puts code scanning, secret detection and dependency protection right where developers work. This course is for the AppSec and DevSecOps people who set it up and act on what it finds. We cover each security suite, how to configure it, and how to turn alerts into fixes.
The course follows the official GH-500 skills outline. You will work with Secret Protection and push protection, the dependency graph, SBOMs, Dependabot and dependency review, Code Security with CodeQL and SARIF, security campaigns, and the policies and roles that control who can dismiss what.
By the end you will know how to roll out GitHub security features across an organization and run a prevention-first program. You will also be ready to sit the GitHub Advanced Security exam.
Course Objectives
Build GitHub security skills and GH-500 exam readiness.
01
Secret Protection
Enable Secret Protection and push protection, respond to secret alerts, and manage custom patterns and bypass rules.
02
Supply Chain Security
Use the dependency graph, SBOMs, Dependabot alerts and dependency review to manage risk in third-party code.
03
Code Security with CodeQL
Set up code scanning with CodeQL or third-party tools, read the results, and fix or dismiss alerts the right way.
04
GH-500 Exam Readiness
Cover all six domains in the official GH-500 skills outline, including security operations and administration at scale.
Who Should Attend
- Application security engineers who own code scanning, secret scanning and dependency risk.
- DevSecOps engineers who build security checks into GitHub workflows and pull requests.
- Developers and DevOps engineers who triage and fix security alerts in their own repositories.
- Administrators and solution architects rolling out GitHub security features across an organization or enterprise.
Prerequisites
- There are no formal prerequisites for the GH-500 exam or for this course.
- GitHub recommends reviewing the related Microsoft Learn modules before the exam. We cover the same skills in class.
- You should be familiar with GitHub fundamentals, CI/CD and secure development concepts.
- The exam is intermediate level, so hands-on time with GitHub security features will help.
Pathway Map
The GitHub Advanced Security course follows the six GH-500 skill domains.
Each module maps to an official exam domain and its published weight, from the security suites themselves to running them at enterprise scale.
Course Content
- Enabling Secret Protection at the repository and organization levels.
- Push protection, validity checks and prioritized alerts for high-confidence secrets.
- The secret alert lifecycle and how to respond and remediate.
- Role-based and delegated bypass, alert recipients, exclusions and custom secret patterns.
- The dependency graph, vulnerability databases and SBOM export.
- Supply chain alerts and security updates, including EPSS scoring for prioritization.
- Dependency review for pre-merge checks and license compliance.
- Update rules, grouping, auto-dismiss, permissions, webhooks and integrations.
- Native CodeQL and third-party code scanning, and SARIF file ingestion.
- Enabling code security with GitHub Actions or an external CI system.
- Reading results and dataflow analysis, autofix and remediation workflows.
- Dismissing alerts, severity classification and fixing scan failures.
- CVE, CWE and GitHub Security Advisory concepts.
- Severity and remediation rulesets, campaign-based remediation and bulk alert management.
- Customizing CodeQL query suites to match your organization’s risk.
- Shifting left with push protection, dependency scanning and pre-merge analysis.
- Enabling security suites at the enterprise, organization and repository levels.
- Feature differences between GitHub Enterprise Cloud and GitHub Enterprise Server.
- Default configurations, inheritance, policies, rulesets and bypass permissions.
- Security roles, alert permissions, CodeQL workflows and APIs for security at scale.
Course Features
Built for practical GitHub security training and GH-500 exam prep.
Interactive Learning
Participate in training sessions, discussions, and hands-on labs with experienced instructors.
Comprehensive Study Materials
Access extensive resources, including e-books, video lectures, and practice exams.
Practical Scenarios
Engage in real-world exercises and case studies to apply GitHub Advanced Security concepts.
Certification Preparation
Receive guidance and tips to successfully pass the GitHub Advanced Security exam.
Certification Exam
Prepare for the official GitHub Advanced Security exam.
GH-500 Exam Readiness
Accumentum’s GitHub Advanced Security course follows the official GH-500 skills outline and prepares you for every domain on the exam.
After the course you will be ready to take the official GitHub Advanced Security (GH-500) exam. GitHub designed it for people with a deep understanding of GitHub and its security features and hands-on experience securing software development workflows.
The exam is intermediate level and runs 100 minutes. You can take it at a Pearson VUE testing center or online, in English, Portuguese, Spanish, Korean or Japanese. A score of 700 or higher is required to pass.
The certification is valid for 2 years. GitHub is moving to Microsoft’s recertification process, which will let you keep your certification current without retaking the full exam.
Skills Measured
What Microsoft says GH-500 measures.
Microsoft publishes the skills measured for Exam GH-500 as of July 2026. Here are all 6 domains, 25 skill groups and 70 tasks in Microsoft's own wording. Our course maps a lesson or lab to each one.
Understand GitHub Security suites and architecture
Part of Describe GitHub Security suites, features, and ecosystem (15 to 20%)
- Describe GitHub Security suite structure and navigation
- Contrast Code Security, Secret Protection, and Supply Chain Security
- Differentiate security feature availability for public repositories vs. enterprise environments
- Explain features and benefits of the Security Overview
Apply secure SDLC and security strategies
Part of Describe GitHub Security suites, features, and ecosystem (15 to 20%)
- Explain differences and interplay between Secret Protection and Code Security
- Describe end-to-end secure SDLC using GitHub Security suites
- Compare prevention-first approaches vs. gate-based security strategies
- Explain security campaigns and their role in reducing risk
Detect, manage, and respond to security alerts
Part of Describe GitHub Security suites, features, and ecosystem (15 to 20%)
- Identify vulnerability and secret detection mechanisms
- Choose and act on security alerts (alert management, policies, workflows)
- Explain implications and best practices for ignoring or dismissing alerts
- Describe developer, security, and admin responsibilities for alerts and remediation
Manage access, governance, and supply chain security
Part of Describe GitHub Security suites, features, and ecosystem (15 to 20%)
- Explain alert access management, roles, delegated bypass, and enforcement
- Describe supply chain security concepts and alert information across the SDLC
Enable and configure Secret Protection
Part of Configure and use Secret Protection (formerly secret scanning) (15 to 20%)
- Enable GitHub Secret Protection at the repository and organization levels
- Configure Secret Protection settings and feature availability
- Contrast Secret Protection behavior for public vs. private/enterprise repositories
Prevent secret exposure
Part of Configure and use Secret Protection (formerly secret scanning) (15 to 20%)
- Explain Push Protection and how it prevents secrets at the source
- Describe validity checks and prioritized alerting for high-confidence secrets
Manage and respond to Secret Protection alerts
Part of Configure and use Secret Protection (formerly secret scanning) (15 to 20%)
- Describe the Secret Protection alert lifecycle (creation, status, dismissal)
- Respond to secret alerts and apply appropriate remediation actions
- Explain implications and best practices for dismissing or ignoring alerts
Control access, policies, and customization
Part of Configure and use Secret Protection (formerly secret scanning) (15 to 20%)
- Explain role-based and delegated bypass policies in Secret Protection
- Configure alert recipients and exclusions
- Create and manage custom secret patterns
Understand and manage dependency and supply chain risks
Part of Configure and use supply chain security (formerly Dependabot/Dependency Review) (15 to 20%)
- Comprehensive dependency security (tools, vulnerability databases, SBOMs)
- Generate and interpret the dependency graph
- SBOM usage: export options, formats, and supply chain context
Detect, prioritize, and respond to supply chain alerts
Part of Configure and use supply chain security (formerly Dependabot/Dependency Review) (15 to 20%)
- Supply chain alerts and security updates (prioritization, EPSS scoring)
- Remediating supply chain alerts through campaigns and pull requests
- Auto-dismiss behavior and security campaign configuration
Secure dependencies during development
Part of Configure and use supply chain security (formerly Dependabot/Dependency Review) (15 to 20%)
- Dependency Review (pre-merge checks, license and compliance validation, configuration)
- Advanced dependency update rules (grouping, auto-dismiss, update strategies)
Configure policies, permissions, and integrations
Part of Configure and use supply chain security (formerly Dependabot/Dependency Review) (15 to 20%)
- Permissions and role-based alert assignment
- Workflow management for dependency and supply chain security
- External notifications, webhooks, and security integrations
Understand code scanning approaches and tooling
Part of Configure and use Code Security (formerly Code Scanning with CodeQL) (10 to 15%)
- Native and third-party code scanning options
- Choosing between CodeQL and third-party analysis tools
- SARIF file ingestion, management, and interoperability
Set up and configure Code Security
Part of Configure and use Code Security (formerly Code Scanning with CodeQL) (10 to 15%)
- Enable code security using GitHub Actions or external CI systems
- Configure code scanning workflows and workflow templates
- Use matrix builds and define appropriate scan frequency
Analyze, triage, and remediate code scanning results
Part of Configure and use Code Security (formerly Code Scanning with CodeQL) (10 to 15%)
- Review scan results, including dataflow analysis insights
- Alert lifecycles, autofix capabilities, and remediation workflows
- Dismissing alerts and managing severity and category classifications
Optimize and automate Code Security operations
Part of Configure and use Code Security (formerly Code Scanning with CodeQL) (10 to 15%)
- Advanced configuration and customization
- Troubleshooting scan failures and performance issues
Understand vulnerability context and remediation frameworks
Part of Security operations: best practices, prioritization, and remediation (15 to 20%)
- CVE, CWE, and GitHub Security Advisory concepts
- End-to-end remediation workflows across security alerts and advisories
Prioritize and manage security work at scale
Part of Security operations: best practices, prioritization, and remediation (15 to 20%)
- Defining, prioritizing, and enforcing severity and remediation rulesets
- Campaign-based remediation strategies and bulk alert management
- Automated alert dismissal and documentation practices
Customize and optimize security detection
Part of Security operations: best practices, prioritization, and remediation (15 to 20%)
- Customizing CodeQL query suites and language-specific analysis
- Tailoring security detection to organizational risk profiles
Collaborate across roles and enforce governance
Part of Security operations: best practices, prioritization, and remediation (15 to 20%)
- Security roles, delegated exceptions, and alert ownership
- Collaboration on alerts and security campaigns across teams
- Cross-suite rulesets, policies, and enforcement mechanisms
Shift left and strengthen preventive security
Part of Security operations: best practices, prioritization, and remediation (15 to 20%)
- Early vulnerability prevention through push protection, dependency scanning, and pre-merge analysis
Roll out and manage security features at scale
Part of GitHub Security suites administration (10 to 15%)
- Enable GitHub Security Suites at enterprise, organization, and repository levels
- Understand feature availability and differences across GitHub Enterprise Cloud and GitHub Enterprise Server
Configure security features and defaults
Part of GitHub Security suites administration (10 to 15%)
- Enable Code Security (CodeQL), Secret Protection, and Supply Chain Security
- Define default configurations and inheritance behavior
Define governance, access, and Code Security workflows
Part of GitHub Security suites administration (10 to 15%)
- Define enterprise and organization security policies and rulesets
- Configure enforcement boundaries, bypass permissions, and exceptions
- Define administrator, security manager, and developer roles
- Configure permissions for managing and dismissing security alerts
- Enable and configure default or approved custom CodeQL workflows
- Understand APIs and automation methods for large-scale security configuration and governance
Manage CodeQL and security automation
Part of GitHub Security suites administration (10 to 15%)
- Enable and configure default or approved custom CodeQL workflows
- Understand available APIs and automation methods for large-scale security configuration and governance
Who It Is For
The GH-500 candidate profile.
Here's how Microsoft describes the person this exam is built for. Candidates for this exam have experience using GitHub Advanced Security (GHAS) to secure code, secrets, and dependencies across the software development lifecycle. They can configure security features, triage and remediate alerts, and apply prevention-first practices using policies, workflows, and automation. Candidates are familiar with GitHub fundamentals, CI/CD, and secure development concepts.
Study Plan
How we work through GH-500.
We open with Describe GitHub Security suites, features, and ecosystem, which Microsoft weights at 15 to 20%. Its skill groups are "Understand GitHub Security suites and architecture", "Apply secure SDLC and security strategies", "Detect, manage, and respond to security alerts" and "Manage access, governance, and supply chain security".
Next comes Configure and use Secret Protection (formerly secret scanning), worth 15 to 20% of the exam. Microsoft breaks it into "Enable and configure Secret Protection", "Prevent secret exposure", "Manage and respond to Secret Protection alerts" and "Control access, policies, and customization".
After that we move to Configure and use supply chain security (formerly Dependabot/Dependency Review), which counts for 15 to 20%. You'll see it split into "Understand and manage dependency and supply chain risks", "Detect, prioritize, and respond to supply chain alerts", "Secure dependencies during development" and "Configure policies, permissions, and integrations".
Then we take on Configure and use Code Security (formerly Code Scanning with CodeQL), at 10 to 15% of your score. Inside it are "Understand code scanning approaches and tooling", "Set up and configure Code Security", "Analyze, triage, and remediate code scanning results" and "Optimize and automate Code Security operations".
We follow with Security operations: best practices, prioritization, and remediation, which Microsoft weights at 15 to 20%. The groups here are "Understand vulnerability context and remediation frameworks", "Prioritize and manage security work at scale", "Customize and optimize security detection", "Collaborate across roles and enforce governance" and "Shift left and strengthen preventive security".
We close with GitHub Security suites administration, worth 10 to 15% of the exam. It holds "Roll out and manage security features at scale", "Configure security features and defaults", "Define governance, access, and Code Security workflows" and "Manage CodeQL and security automation".
Describe GitHub Security suites, features, and ecosystem carries the most weight, so it gets the most lab time. In the last week you take Microsoft's free practice assessment, review whatever it flags and try the exam sandbox so the interface holds no surprises.
Exam Policies
What to know before you book GH-500.
GH-500 leads to the GitHub Advanced Security certification. Microsoft requires a score of 700 or greater to pass, and you get 100 minutes to complete the exam. It's proctored and may include interactive components.
The exam is offered in English, Spanish, Portuguese (Brazil), Korean and Japanese. If it isn't available in your preferred language, Microsoft lets you request an extra 30 minutes. You can also request accommodations if you use assistive devices or need extra time.
If you don't pass, you can retake the exam 24 hours after your first attempt. Waits for later retakes vary under Microsoft's retake policy. Exam price depends on the country or region where the exam is proctored.
Microsoft notes that the bullets under each skill show how the skill is assessed, and related topics may also appear. Most questions cover generally available features, though Preview features can show up if they're commonly used.
GitHub certifications are valid for 2 years. GitHub is moving to Microsoft's recertification process so you can maintain a certification without retaking the full exam, and certifications that expire before that process is available are extended by 6 months.
See the GitHub Advanced Security certification page on Microsoft Learn.
Career Outlook
Where GH-500 can take you.
For a sense of pay, BLS puts the May 2025 median annual wage for information security analysts at $129,180. BLS also projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than the average for all occupations. That figure is a national midpoint. Where you live, how long you have been in the field and who you work for all move the number. Source: BLS Occupational Outlook Handbook.
Funding and PathPay
Ways to pay for GH-500 training.
Paying on your own? GH-500 prep is eligible for PathPay, our monthly payment plan. Terms of 3, 4 and 6 months carry no added fee. 9, 12 and 18 month terms add 5%, 10% and 15%. Course access opens when your first payment clears.
Our funding page lists every other way to pay, and you can always talk with us or email info@accumentum.net before you enroll.
Frequently Asked Questions
Answers to common questions about Accumentum’s GitHub Advanced Security course, the GH-500 exam, eligibility, delivery and payment.
It shows you can use GitHub Advanced Security to protect code, secrets and dependencies across the software development lifecycle, from configuration to triage and remediation. The exam code is GH-500.
AppSec and DevSecOps engineers, plus developers, DevOps engineers and admins who configure GitHub security features or act on their alerts.
There are no formal prerequisites. You should be familiar with GitHub fundamentals, CI/CD and secure development concepts. GitHub recommends reviewing the related Microsoft Learn modules first.
Six domains: GitHub security suites, features and ecosystem (15 to 20%), Secret Protection (15 to 20%), supply chain security (15 to 20%), Code Security with CodeQL (10 to 15%), security operations (15 to 20%), and security suites administration (10 to 15%).
The exam runs 100 minutes. You can take it at a Pearson VUE testing center or online. It is offered in English, Portuguese, Spanish, Korean and Japanese.
You need a score of 700 or higher.
It is valid for 2 years. GitHub is moving to Microsoft’s recertification process, which will let you renew without retaking the full exam.
The course is delivered live online by an instructor, with hands-on practice in GitHub between sessions.
Yes. PathPay lets you pay for your training over time instead of all at once. You can enroll through PathPay from this page or contact us with any questions.
Microsoft lists these domains:
- Describe GitHub Security suites, features, and ecosystem, 15 to 20%
- Configure and use Secret Protection (formerly secret scanning), 15 to 20%
- Configure and use supply chain security (formerly Dependabot/Dependency Review), 15 to 20%
- Configure and use Code Security (formerly Code Scanning with CodeQL), 10 to 15%
- Security operations: best practices, prioritization, and remediation, 15 to 20%
- GitHub Security suites administration, 10 to 15%
Describe GitHub Security suites, features, and ecosystem is the largest at 15 to 20%. We give it the most lab time.
You can retake it 24 hours after your first attempt. Later retakes have longer waits under Microsoft's retake policy.
Yes. Microsoft offers a free practice assessment, plus an exam sandbox that shows you the exam interface.
Enrollment
Enroll in the GitHub Advanced Security (GH-500) Certification Training Course with Accumentum.
Enroll in the GitHub Advanced Security (GH-500) Certification Training Course with Accumentum to learn how to find and fix security problems where developers work. You will cover every GH-500 domain, from Secret Protection and push protection to CodeQL, dependency review, security campaigns and administration at scale.
When you finish, you will be ready to sit the GitHub Advanced Security exam and run a stronger security program on GitHub. For upcoming class dates and to save your seat, use the registration page linked below.
Shift security left with GitHub Advanced Security training.
Prepare for the GitHub Advanced Security (GH-500) exam and learn to stop leaked secrets, vulnerable code and risky dependencies before they reach production.