Training course · GitHub Copilot · Security & DevSecOps

GitHub Copilot for Security and DevSecOps Teams

Use GitHub Copilot professionally: completions, chat, agent mode, the coding agent for issues and PRs, code review and enterprise policies.

Duration
2 days (14 hrs)
Format
Online or on-site
Language
German or English
Participants
open dates or exclusive for your team
Certificate
Certificate of attendance

Overview

This course connects GitHub Copilot with the everyday processes of Security & DevSecOps. Participants work on realistic scenarios and leave with prompts, workflows and checklists they can use straight away.

GitHub Copilot has grown from simple code completion into a broad AI platform that supports the entire development lifecycle. In the editor you work with inline suggestions, next edit suggestions and Copilot Chat; in agent mode Copilot handles tasks across multiple files and runs commands. On GitHub itself, the coding agent picks up assigned issues and delivers pull requests. In this two-day course you will learn how to use each of these building blocks deliberately and fit them cleanly into your existing development process.

Beyond hands-on editor work, the course covers control and quality. Custom instructions and prompt files give Copilot the project knowledge it needs, MCP adds further tools, and Copilot code review complements human reviewers. For those responsible for teams and organisations, we look at policies at organisation and enterprise level, content exclusions, model availability and usage reporting. Together, these lay the groundwork for a secure, transparent and genuinely effective Copilot rollout across the entire company.

AI coding assistants and agents affect application security from two directions. They speed up threat modelling, code review and detection engineering, yet they also produce new code faster than traditional security gates can absorb. Security and DevSecOps teams therefore use AI to triage SAST findings, propose fixes for vulnerabilities, harden CI/CD pipelines and scan infrastructure as code for misconfigurations. What matters is a controlled setup: agents running with least privilege, no secrets in the prompt context, every change traceable through a pull request and human sign-off on security-critical decisions. In this course you learn to use AI as a force multiplier for your security programme while keeping the new risks of generated code, prompt injection and insecure tool integrations firmly under control.

The course is delivered live – either online in a virtual classroom or on-site in our training rooms in Munich, Salzburg, Berlin, Augsburg, Hanover, Bremen, Stuttgart and Kaiserslautern. We can also run it exclusively for your team.

Who is this course for?

  • Application security engineers and security champions in development teams
  • DevSecOps and platform engineers responsible for CI/CD pipelines
  • Penetration testers and red team members
  • SOC analysts and detection engineers
  • Developers accountable for secure software supply chains

Typical challenges we address

  • A flood of SAST, DAST and SCA findings with a high share of false positives
  • Security review becomes a bottleneck as AI-assisted teams ship far more code
  • Misconfigurations in Terraform, Kubernetes manifests and cloud policies go unnoticed
  • New attack surfaces from LLM integrations, prompt injection and over-privileged agents

What you will be able to do

  • You use Copilot completions, chat and agent mode purposefully for your everyday development tasks.
  • You capture project knowledge in custom instructions and prompt files to improve output quality.
  • You delegate suitable issues to the coding agent and review its pull requests properly.
  • You integrate Copilot code review sensibly into your existing review process.
  • Use AI agents for triage, review and fix generation without giving up control over security-critical changes.
  • Integrate AI-assisted checks into CI/CD pipelines alongside your existing SAST, SCA and IaC scanners.
  • Assess and mitigate the specific risks of AI-generated code, prompt injection and agent tool access.

Course outline

Day 1

Module 1 Copilot in the editor: completions and chat
  • Accepting, rejecting and steering inline and next edit suggestions efficiently
  • Using Copilot Chat for explanations, debugging and test generation
  • Setting context precisely with files, selections, workspace and chat variables
  • Model selection and differences between VS Code, Visual Studio and JetBrains IDEs
Module 2 Agent mode and extensions
  • Planning multi-step tasks in agent mode and executing them under control
  • Feeding terminal commands, test runs and error output into the agent loop
  • Connecting MCP servers for additional tools and data sources
  • Reviewing changes, accepting them partially or rolling them back
Module 3 Project knowledge through custom instructions
  • Writing repository-wide instructions on architecture, style and testing
  • Creating path-specific instructions and reusable prompt files
  • Combining personal and organisation-wide guidance sensibly
  • Refining instructions continuously based on output quality
Module 4 Coding agent and code review on GitHub
  • Writing issues the coding agent can implement reliably
  • Reviewing, commenting on and iterating over the agent’s pull requests
  • Using Copilot code review as an additional check in the PR process
  • Configuring the agent’s development environment with setup steps and Actions

Day 2

Module 5 Administration, policies and security
  • Licence assignment and policies at organisation and enterprise level
  • Content exclusions, model availability and public code filters
  • Using audit logs and usage metrics to steer adoption
  • Clarifying security risks, secrets and accountability for AI-generated code
Module 6 Practice lab: Security & DevSecOps
  • Faster threat modelling
  • SAST finding triage
  • Secure code review
  • Hardening IaC and containers
  • Detection engineering
  • Securing the supply chain
Module 7 Data protection, quality & transfer to daily work
  • Source code, vulnerability data and logs are highly sensitive: you learn which data may be shared with AI services, how to keep secrets out of the context and how AI use aligns with NIS2, the Cyber Resilience Act, the GDPR and the EU AI Act.
  • Ground rules for safe AI use in your team
  • Checking results: facts, sources, tests and the four-eyes principle
  • Personal action plan for the next 30 days
  • Open questions, outlook and resources for further learning

Practical scenarios from your field

Faster threat modelling

Derive STRIDE-based threat analyses from architecture descriptions and data flow diagrams, identify trust boundaries and turn countermeasures into testable requirements ready for the backlog. The model is updated rather than rebuilt when the architecture changes.

SAST finding triage

Match static analysis results against real code context, assess reachability and exploitability, dismiss false positives with a documented rationale and prepare minimal fixes for genuine vulnerabilities as pull requests.

Secure code review

Have pull requests checked specifically for injection flaws, broken authorisation, insecure deserialisation and cryptographic mistakes, with references to OWASP categories and a clear explanation for every finding.

Hardening IaC and containers

Analyse Terraform modules, Helm charts and Dockerfiles for over-privileged roles, exposed ports, missing encryption and unsafe base images, then generate hardened versions backed by policy-as-code rules.

Detection engineering

Draft Sigma rules, YARA signatures and SIEM queries from threat descriptions, validate them against test data and enrich documentation with the relevant MITRE ATT&CK techniques.

Securing the supply chain

Evaluate SBOMs, prioritise vulnerable dependencies, analyse upgrade paths including breaking changes and add pipeline steps for signing, provenance attestation and dependency pinning. Each update pull request explains the risk.

Possible hands-on projects

Finding triage bot

A script that ingests SARIF output from the pipeline, deduplicates findings, enriches them with code context and opens prioritised tickets with a suggested fix.

Secret scanning hook

A pre-commit hook with custom patterns for internal token formats, allowlist management and clear guidance on how to rotate a leaked secret.

Threat model generator

A small web app that turns a system description into a structured threat model with data flows, risks and mitigations, exportable as a document.

Prerequisites

You develop software regularly, work with Git and GitHub issues and pull requests, and use a modern IDE. You have hands-on experience in software development or operations and a working knowledge of application security, such as the OWASP Top 10 and CI/CD pipelines.

Technical requirements

Your own laptop with VS Code or a JetBrains IDE, the Copilot extension installed and a GitHub account with an active Copilot licence; the coding agent requires a suitable plan.

Data protection & compliance

Source code, vulnerability data and logs are highly sensitive: you learn which data may be shared with AI services, how to keep secrets out of the context and how AI use aligns with NIS2, the Cyber Resilience Act, the GDPR and the EU AI Act.

Suggested dates

All dates are suggestions – your preferred date is always possible.

  • Mon, 23 November 2026 – Tue, 24 November 2026 Online Request
  • Mon, 30 November 2026 – Tue, 1 December 2026 Augsburg Request
  • Mon, 14 December 2026 – Tue, 15 December 2026 Online Request
  • Thu, 14 January 2027 – Fri, 15 January 2027 Online Request
  • Thu, 28 January 2027 – Fri, 29 January 2027 Kaiserslautern Request
  • Thu, 4 February 2027 – Fri, 5 February 2027 Online Request

Frequently asked questions

What is the difference between agent mode and the coding agent?

Agent mode runs inside your IDE: you work interactively with Copilot, see every step and approve commands. The coding agent, by contrast, works autonomously on GitHub once you assign it an issue, uses its own execution environment and opens a pull request that you then review just as you would a contribution from a colleague.

How can we make sure Copilot complies with our company policies?

At organisation and enterprise level you can enable or block specific features, models and extensions. Content exclusions keep sensitive files out of the context, and audit logs make usage traceable. During the course we show how to align these controls with data protection, information security requirements and your internal coding standards.

Is the course worthwhile if we already use Copilot?

Yes, especially then. Many teams rely on completions alone and barely touch chat, agent mode, custom instructions or the coding agent. The course shows how to use these features in a structured way, improve results with project knowledge and avoid common pitfalls. Experienced users benefit most from the sections on review and governance.

Is AI-generated code a security risk?

AI assistants sometimes reproduce insecure patterns, outdated libraries or even non-existent package names. The risk is manageable when generated code passes the same gates as hand-written code: peer review, SAST, dependency scanning and tests. In the course you set up exactly these guardrails while using AI yourself to find and fix vulnerabilities faster.

Should an AI agent be allowed to apply security fixes on its own?

We recommend a tiered model: the agent analyses, proposes fixes and opens pull requests, while humans approve the merge. For low-risk routine work such as dependency updates with passing tests, more automation can make sense. You learn to design permissions, sandboxing and audit trails so every decision remains traceable.

How much does “GitHub Copilot for Security and DevSecOps Teams” cost?

The course costs a flat €949 plus VAT per participant – whether online or on-site. This includes 2 training day(s) with a live trainer, course materials, a lab environment and a certificate of attendance.

Can I suggest my own date?

Yes. Our suggested dates are just a guide. In the request form you can always describe your preferred date or period in free text – we check availability and confirm within one working day.

Is the course online or on-site?

Both are possible: live online in a virtual classroom or on-site in Munich, Salzburg, Berlin, Augsburg, Hanover, Bremen, Stuttgart or Kaiserslautern. We can also run the course exclusively for your team.

More courses for Security and DevSecOps Teams

More GitHub Copilot courses

All 32 GitHub Copilot courses

GitHub Copilot · MunichGitHub Copilot · SalzburgGitHub Copilot · BerlinGitHub Copilot · AugsburgGitHub Copilot · HanoverGitHub Copilot · BremenGitHub Copilot · StuttgartGitHub Copilot · KaiserslauternGitHub Copilot · Online