GitHub Advanced Security (GH-500): What Changed in the July 2026 Skills Outline
In July 2026 Microsoft rewrote the skills outline for Exam GH-500: GitHub Advanced Security. The official study guide change log says the exam changed significantly: objectives were added, removed, moved and reworded. The old outline had five domains with fixed weights (Dependabot at 35% and CodeQL at 25%). The current outline has six skill areas with ranges, new product names (Secret Protection, Supply Chain Security, Code Security), and a new administration domain. This guide compares both outlines from official sources and shows what to study now.
Read more
What Microsoft changed in July 2026
The GH-500 study guide now lists Skills measured as of July 2026. The change log does not print a line-by-line diff, but the current skills-at-a-glance list and the older study guide (archived before the rewrite) make the shift clear. Feature names also moved: secret scanning is now Secret Protection, Dependabot and Dependency Review sit under supply chain security, and Code Scanning with CodeQL is Code Security.
Old outline vs new outline
| Old domain (pre-July 2026) | Old weight | New skill area (July 2026) | New weight |
|---|---|---|---|
| Describe the GHAS security features and functionality | 15% | Describe GitHub Security suites, features, and ecosystem | 15-20% |
| Configure and use secret scanning | 15% | Configure and use Secret Protection (formerly secret scanning) | 15-20% |
| Configure and use Dependabot and Dependency Review | 35% | Configure and use supply chain security (formerly Dependabot/Dependency Review) | 15-20% |
| Configure and use Code Scanning with CodeQL | 25% | Configure and use Code Security (formerly Code Scanning with CodeQL) | 10-15% |
| Describe GitHub Advanced Security best practices, results, and how to take corrective measures | 10% | Security operations: best practices, prioritization, and remediation | 15-20% |
| (not a separate domain) | – | GitHub Security suites administration | 10-15% |
The biggest study shift is weight. Dependabot work is no longer more than a third of the exam, and CodeQL is no longer a quarter. Security operations and suites administration now share a large slice of the score, so org-wide rollout, rulesets, and alert ownership matter more than before.
How to prepare with the new outline
Study every area in the current guide, not an older five-domain cheat sheet. Focus on Push Protection and validity checks under Secret Protection, EPSS-based supply chain alerts and Dependency Review, Code Security workflows (including SARIF), remediation campaigns, and enabling suites at enterprise, organization and repository level. The certification page lists the same six areas.
For timed practice that follows the current skills groups, use our GitHub Advanced Security (GH-500) practice exam. The $1 trial is deducted when you upgrade, and every plan has a 14-day money-back guarantee. If you also track GitHub Copilot, see our GH-300 August 2026 skills outline update.
Facts come from the Microsoft Learn GH-500 study guide (July 2026) and certification page. Old fixed weights are from the pre-rewrite study guide. Always check Microsoft Learn before you book.
One Comment