# Running the secret risk assessment for your organization Determine your organization's exposure to leaked secrets by generating a secret risk assessment report. ## Generating an initial secret risk assessment 1. On GitHub, navigate to the main page of the organization. 2. Under your organization name, click the ** Security and quality** tab. 3. In the sidebar, under "Security", click ** Assessments**. 4. To generate the secret risk assessment, click **Scan your organization**. > \[!NOTE] > If you haven't previously run a security risk assessment, this will also initiate a **code security risk assessment**. If you're an organization owner and you've opted in for email notifications, GitHub will send you an email to let you know when the report is ready to view. ## Rerunning the secret risk assessment > \[!NOTE] > You can only generate a secret risk assessment report once every 90 days. 1. On GitHub, navigate to the main page of the organization. 2. Under your organization name, click the ** Security and quality** tab. 3. In the sidebar, under "Security", click ** Assessments**. 4. Towards the top right side of the existing report, click **Rerun scan**. If you're an organization owner and you've opted in for email notifications, GitHub will send you an email to let you know when the report is ready to view. ## Next steps Now that you've generated a secret risk assessment report for your organization, learn how to interpret the results. See [Interpreting secret risk assessment results](/en/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/interpreting-secret-risk-assessment-results).