docs/content/code-security/adopting-github-advanced-security-at-scale/phase-3-pilot-programs.md

title, intro, versions, topics, shortTitle

title	intro	versions	topics	shortTitle
Phase 3: Pilot programs	You may benefit from beginning with a few high-impact projects and teams with which to pilot an initial rollout. This will allow an initial group within your company to get familiar with GHAS, learn how to enable and configure GHAS, and build a solid foundation on GHAS before rolling out to the remainder of your company.	ghes ghec * *	Code Security Secret Protection	3. Pilot programs

Tip

This article is part of a series on adopting {% data variables.product.prodname_GHAS %} at scale. For the previous article in this series, see AUTOTITLE.

About pilot programs

We recommend you identify a few high-impact projects or teams to use in a pilot rollout of GHAS. This allows an initial group within your company to get familiar with GHAS and builds a solid foundation for GHAS before you roll it out to the remainder of your company.

The steps in this phase will help you enable GHAS on your enterprise, begin using its features, and review your results. If you’re working with {% data variables.product.prodname_professional_services %}, they can provide additional assistance through this process through onboarding sessions, GHAS workshops, and troubleshooting as needed.

Before you start your pilot projects, we recommend that you schedule some meetings for your teams, such as an initial meeting, midpoint review, and a wrap-up session when the pilot is complete. These meetings will help you all make adjustments as needed and ensure your teams are prepared and supported to complete the pilot successfully.

{% ifversion ghes %}

If you haven't already enabled GHAS for your {% data variables.product.prodname_ghe_server %} instance, see AUTOTITLE.

{% endif %}

{% ifversion security-configurations %}

Piloting all {% data variables.product.prodname_GHAS %} features

{% data reusables.security-configurations.enable-security-features-with-gh-config %}

{% endif %}

Piloting {% data variables.product.prodname_code_scanning %}

{% ifversion ghes %}

To enable {% data variables.product.prodname_code_scanning %} on your {% data variables.product.prodname_ghe_server %} instance, see AUTOTITLE.

{% endif %}

You can quickly configure default setup for {% data variables.product.prodname_code_scanning %} across multiple repositories in an organization using security overview. For more information, see AUTOTITLE.

You can also choose to enable {% data variables.product.prodname_code_scanning %} for all repositories in an organization, but we recommend configuring {% data variables.product.prodname_code_scanning %} on a subset of high-impact repositories for your pilot program.

{% data reusables.advanced-security.enable-default-setup-first %}

If your company wants to use other third-party code analysis tools with {% data variables.product.prodname_dotcom %} {% data variables.product.prodname_code_scanning %}, you can use actions to run those tools within {% data variables.product.prodname_dotcom %}. Alternatively, you can upload results, which are generated by third-party tools as SARIF files, to {% data variables.product.prodname_code_scanning %}. For more information, see AUTOTITLE.

Piloting {% data variables.product.prodname_secret_scanning %}

{% data variables.product.prodname_dotcom %} scans repositories for known types of secrets, to prevent fraudulent use of secrets that were committed accidentally.

{% ifversion ghes %}

To enable secret scanning for your {% data variables.product.prodname_ghe_server %} instance, see AUTOTITLE.

{% endif %}

{% ifversion security-configurations %}

{% ifversion security-configurations-cloud %}

You need to enable {% data variables.product.prodname_secret_scanning %} and push protection for each pilot project. You can do this with the {% data variables.product.prodname_github_security_configuration %}, or you can create a {% data variables.product.prodname_custom_security_configuration %}. For more information, see AUTOTITLE and AUTOTITLE.

{% elsif security-configurations-ghes-only %}

You need to enable {% data variables.product.prodname_secret_scanning %} and push protection for each pilot project. You can do this with a {% data variables.product.prodname_security_configuration %}. For more information, see AUTOTITLE.

{% endif %}

{% else %}

You need to enable {% data variables.product.prodname_secret_scanning %} for each pilot project, either by enabling the feature for each repository or for all repositories in any organizations taking part in the project. For more information, see AUTOTITLE or AUTOTITLE.

Next, enable push protection for each pilot project.

{% endif %}

If you plan to configure a link to a resource in the message that's displayed when a developer attempts to push a blocked secret, now would be a good time to test and start to refine the guidance that you plan to make available.

Start to review activity using the push protection metrics page in security overview. For more information, see AUTOTITLE.

If you have collated any custom patterns specific to your enterprise, especially any related to the projects piloting {% data variables.product.prodname_secret_scanning %}, you can configure those. For more information, see AUTOTITLE.

To learn how to view and close alerts for secrets checked into your repository, see AUTOTITLE.

Tip

For the next article in this series, see AUTOTITLE.