At GitHub Universe this year, the company made clear that it’s trying to reach two types of developers: Those who have never worked with GitHub before (“the floor”) and those already familiar with their products (“the ceiling”). Their overall strategy? Lower the floor so everyone can develop using GitHub and raise the ceiling for professional developers to do more with agentic development.  

First challenge: GitHub hasn’t exactly been reliable over the past 12 months. To address this, GitHub spent a lot of time talking about fundamental investments it’s made to infrastructure to shore up reliability. That, coupled with updates to primitives (the parts behind GitHub), should enable the company to handle the onslaught of traffic.  

However, GitHub Universe wasn’t all about keeping the lights on. It was about broadening the impact GitHub has beyond its core audience. 

GitHub’s Goal Is To Become The Glue That Binds Non-Developers To Development 

One of the key arguments GitHub made at the event is that everything is moving towards being source controlled, including non-code data sources and business community applications. To enable this, the GitHub harness, application, and underlying SDK has become a common connectivity point between all Microsoft applications and third-party software.  This leans into GitHub itself becoming an agentic workspace that is a hub of agentic action and source control. 

Going further, letting anyone run end-to-end agentic development workflows is now a focus. This includes generating prototypes, creating videos of working mockups, getting feedback, and reacting to said feedback automatically to create new versions. When a version is selected to move to production, the entire process of coding, testing, vulnerability scanning, and deployment via GitHub Actions is automated. 

How do you prove all of this was done correctly? PPD Kit, done in concert between GitHub and Microsoft Research, focuses on proof-driven development: using formal and empirical verification to vet that what was built matches the intent of what the team was trying to do. This go beyond the mere “It met the specification”. 

The new SDLC this enables: plan, build, verify, and observe. The goal: Let anyone create software using GitHub – even non-traditional developers. This also means creating from any surface: agents, GUI, the command line, and mobile. 

Security Was Elevated Across All Conversations At The Conference 

Security was a topic that resonated across Universe and not contained to concerns of the security team. This was thanks in part to Mythos and consistent attacks on developers and the software supply chain. GitHub’s security announcements expanded vulnerability detection, remediation, and supply chain protection. GitHub is also making an effort to provide more security capabilities to enterprise customers without necessarily having to buy a security add-on. These features are focused more on finding vulnerabilities earlier in developer workflows than competing with an established security program.  

When it comes to the agentic SDLC, GitHub is pushing a validation layer that executes automatically and help identify vulnerabilities in both first and third-party code. Notably missing from GitHub’s agentic SDLC, however, is security considerations in the plan and build stage. If they were to focus on this, GitHub is in a unique position to help organizations ensure the applications and agents that are designed and built on their system start with secure design best practices.  

Security canvas, in public preview, lets developers review local changes and ask Copilot to explain and fix findings with a Copilot plan. AI Scan for repositories, in public preview, adds on-demand vulnerability scanning across languages. AI Scan for pull requests covers selected languages and frameworks that CodeQL does not. Both require GitHub Code Security or GitHub Advanced Security with AI-credit usage billed separately. AI-powered push protection, in public preview, blocks unstructured secrets such as passwords. It requires GitHub Secret Protection or GitHub Advanced Security, plus AI credits.  

For software supply chain security, GitHub announced package firewall and Dependabot reachability analysis. Both are in public preview. Package firewall blocks risky npm packages before installation. Reachability analysis identifies call paths to vulnerable dependency functions and is a fundamental strategy pivot from GitHub’s previous stance that any found vulnerability should automatically be fixed regardless of the impact on the business – an approach that does not scale for enterprises that have hundreds of vulnerabilities in application backlogs. Both features are available to GitHub Enterprise Cloud customers without an additional security license and are free during public preview. For enterprises that currently do not have a dependency firewall, experiment with GitHub’s but also shop around as other solutions cover more package managers and dependency types such as risky AI models. 

The Next Chapter Of GitHub 

GitHub serves an enormous number of professional developers, but in a world of omnipresent agentic development it’s important to focus beyond traditional personas. The company has made strong inroads with security professionals over the last several years and now seeks to reach people who’ve never used a source code repository before. 

Forrester has a full team of analysts covering agentic software development. Schedule a guidance session with us to discuss GitHub’s evolution if you’re a client or leverage our Forrester AI for instant insight. 

Share