Factory vs GitHub Copilot (2026)

Upgraded from P: invocation spans app, CLI, headless exec, cloud computers, mobile, Slack, and ticket systems as first class entry points, plus automations and CI. Ticket driven entry is the vendor's distinctive claim and it is a genuine trigger surface, not just an integration.

Upgraded from P: a Knowledge layer indexing repo, docs and ticket history, plus wikis exposed through the API and AGENTS.md configuration, is grounding on the customer's own material across several sources rather than repository search alone.

Upgraded from P: cloud session sync across desktop, web and mobile plus a persistent Knowledge layer and wikis is durable cross session and cross surface state, not just context within a run.

Upgraded from P: custom agents are a first class enterprise managed object with their own permissions, and Agent HQ orchestrates third party agents alongside Copilot's own. Sessions persist and are resumable, and the CLI documents memory across sessions.

Held at F on the documented enterprise surface, but confidence lowered to medium: the security and identity documentation was reached only through the docs navigation and the DeepWiki mirror rather than a first party security or trust page, and no attestation page was retrieved directly on either pass. SOC 2 Type II is reported consistently by third parties. Worth a dedicated fetch of a trust page next pass.

Downgraded from F. Analytics and telemetry are documented as an enterprise capability and the API exposes analytics, but that is fleet level usage reporting rather than a per action execution trace reconstructing why a droid acted. Same reading applied across this lane; cursor held at F because it documents an AI code tracking API and audit log as distinct products, which was not retrievable here.

Held at F, and the limit is worth stating: GitHub is explicit that the audit log does not include client session data, so prompts sent locally are not captured and a custom hook is needed to log CLI events. What is retained is agent session and administrative activity, which is the axis, but this is not a full reasoning trace. Same standard applied as cursor, which also held at F on a documented audit surface rather than live progress.

On premises deployment is documented as an enterprise option alongside cloud Droid Computers and fully local CLI execution, which is genuine deployment choice. Contrast cursor, reviewed immediately before this, which explicitly offers no on premises path.

Model independence is a named platform capability with BYOK documented, so the customer both selects the model and can bring their own provider credentials; enterprise model policies and gateways let an organisation constrain that centrally.

Downgraded from F per the lane wide axis rule. QA automation and automated code review are droids acting on the customer's code, and the Agent Readiness framework assesses the customer's codebase, not agent behaviour. No harness for evaluating or regression testing the agents themselves is documented. Consistent with coderabbit, kiro, jetbrains-ai, google-antigravity, Claude Code and cursor.

Downgraded from F per the lane wide axis rule, now applied to seven vendors here. Agentic code review, self diff review, test running and security scanning all verify the customer's code and the agent's own output. Usage and code generation dashboards measure adoption and volume, not agent correctness. No harness for evaluating or regression testing agent behaviour is documented.

Downgraded from F, same correction as cursor from this batch. The May basis had no URL and no content. Third party reporting says the Desktop app grants supervised access to a developer's browser, which would meet the axis, but no first party page documenting a browser tool was retrieved across two passes, and third party sources cannot establish a capability. Graded as not documented; this is the most likely cell to move back if a Desktop app docs page turns up.

Confirmed at N on re retrieval rather than left on an unevidenced basis. The cloud agent runs in an ephemeral GitHub Actions environment reachable by network under firewall allowlist controls, and screenshot to code reads an uploaded image, but neither is the agent driving a browser or operating software through a human interface. Contrast cline and Claude Code in this lane, both of which document a browser tool.