CISA’s Cyber Hygiene services provide no-cost vulnerability scanning of internet-accessible assets with weekly reports and urgent alerts, and web application scanning with monthly reports, to federal, state, local, tribal and territorial governments and public and private critical infrastructure organizations. Enrollment is by email.
\nCISA’s Cyber Hygiene services page says its vulnerability scanning continuously monitors internet-accessible network assets on public, static IPv4 addresses, with weekly reports of all findings and ad hoc alerts about urgent findings such as potentially risky services and known exploited vulnerabilities. Its web application scanning examines publicly accessible web applications for vulnerabilities and misconfigurations, including those in the OWASP Top Ten, with monthly and on-demand reports.
\nThe page says the services are available at no cost to federal, state, local, tribal and territorial governments and to public and private sector critical infrastructure organizations based in the United States, that services typically begin within three business days after sign-up, and that reports can be expected within two weeks of the scanning start date. Enrollment is by email to vulnerability@cisa.dhs.gov with the subject line Requesting Cyber Hygiene Services.
\nCISA says organizations typically reduce their risk and exposure by 40% within the first 12 months, and recommends also identifying assets that are searchable through online tools and reducing that exposure.
\nUse this for organizations that qualify as government or critical infrastructure. The scanning covers only internet-facing assets, so internal vulnerability management is still needed.
\nDSE recommends that eligible organizations enroll in CISA’s Cyber Hygiene scanning and route its urgent alerts to the people who can patch or close the exposed services. Keep the list of public IP addresses and web applications current with CISA, assign an owner to each finding, and fix known exploited vulnerabilities in the reports first.
\nReview each weekly report for new findings, confirm urgent alerts were resolved within the internal deadline, and update the scope whenever public addresses or web applications change.
\nCISA — Cyber Hygiene Services. Reviewed October 19, 2026.
", "content_text": "CISA’s Cyber Hygiene services provide no-cost vulnerability scanning of internet-accessible assets with weekly reports and urgent alerts, and web application scanning with monthly reports, to federal, state, local, tribal and territorial governments and public and private critical infrastructure organizations. Enrollment is by email.\nSource facts\nCISA’s Cyber Hygiene services page says its vulnerability scanning continuously monitors internet-accessible network assets on public, static IPv4 addresses, with weekly reports of all findings and ad hoc alerts about urgent findings such as potentially risky services and known exploited vulnerabilities. Its web application scanning examines publicly accessible web applications for vulnerabilities and misconfigurations, including those in the OWASP Top Ten, with monthly and on-demand reports.\nThe page says the services are available at no cost to federal, state, local, tribal and territorial governments and to public and private sector critical infrastructure organizations based in the United States, that services typically begin within three business days after sign-up, and that reports can be expected within two weeks of the scanning start date. Enrollment is by email to vulnerability@cisa.dhs.gov with the subject line Requesting Cyber Hygiene Services.\nCISA says organizations typically reduce their risk and exposure by 40% within the first 12 months, and recommends also identifying assets that are searchable through online tools and reducing that exposure.\nApplicability\nUse this for organizations that qualify as government or critical infrastructure. The scanning covers only internet-facing assets, so internal vulnerability management is still needed.\nDSE recommendation\nDSE recommends that eligible organizations enroll in CISA’s Cyber Hygiene scanning and route its urgent alerts to the people who can patch or close the exposed services. Keep the list of public IP addresses and web applications current with CISA, assign an owner to each finding, and fix known exploited vulnerabilities in the reports first.\nVerification\nReview each weekly report for new findings, confirm urgent alerts were resolved within the internal deadline, and update the scope whenever public addresses or web applications change.\nOfficial reference\nCISA — Cyber Hygiene Services. Reviewed October 19, 2026.", "content_markdown": "CISA’s Cyber Hygiene services provide no-cost vulnerability scanning of internet-accessible assets with weekly reports and urgent alerts, and web application scanning with monthly reports, to federal, state, local, tribal and territorial governments and public and private critical infrastructure organizations. Enrollment is by email.\n\n## Source facts\n\nCISA’s [Cyber Hygiene services page](https://www.cisa.gov/cyber-hygiene-services) says its vulnerability scanning continuously monitors internet-accessible network assets on public, static IPv4 addresses, with weekly reports of all findings and ad hoc alerts about urgent findings such as potentially risky services and known exploited vulnerabilities. Its web application scanning examines publicly accessible web applications for vulnerabilities and misconfigurations, including those in the OWASP Top Ten, with monthly and on-demand reports.\n\nThe page says the services are available at no cost to federal, state, local, tribal and territorial governments and to public and private sector critical infrastructure organizations based in the United States, that services typically begin within three business days after sign-up, and that reports can be expected within two weeks of the scanning start date. Enrollment is by email to vulnerability@cisa.dhs.gov with the subject line Requesting Cyber Hygiene Services.\n\nCISA says organizations typically reduce their risk and exposure by 40% within the first 12 months, and recommends also identifying assets that are searchable through online tools and reducing that exposure.\n\n## Applicability\n\nUse this for organizations that qualify as government or critical infrastructure. The scanning covers only internet-facing assets, so internal vulnerability management is still needed.\n\n## DSE recommendation\n\nDSE recommends that eligible organizations enroll in CISA’s Cyber Hygiene scanning and route its urgent alerts to the people who can patch or close the exposed services. Keep the list of public IP addresses and web applications current with CISA, assign an owner to each finding, and fix known exploited vulnerabilities in the reports first.\n\n## Verification\n\nReview each weekly report for new findings, confirm urgent alerts were resolved within the internal deadline, and update the scope whenever public addresses or web applications change.\n\n## Official reference\n\n[CISA — Cyber Hygiene Services](https://www.cisa.gov/cyber-hygiene-services). Reviewed October 19, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/cisa-cyber-hygiene-no-cost-vulnerability-web-application-scanning-enroll/", "url": "https://update.dsesecurity.com/updates/cisa-cyber-hygiene-no-cost-vulnerability-web-application-scanning-enroll/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-19" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/cisa-cyber-hygiene-no-cost-vulnerability-web-application-scanning-enroll/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "CISA offers no-cost vulnerability and web application scanning to governments and critical infrastructure organizations", "item": "https://update.dsesecurity.com/updates/cisa-cyber-hygiene-no-cost-vulnerability-web-application-scanning-enroll/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/cisa-cyber-hygiene-no-cost-vulnerability-web-application-scanning-enroll/#article", "identifier": "https://update.dsesecurity.com/updates/cisa-cyber-hygiene-no-cost-vulnerability-web-application-scanning-enroll/", "url": "https://update.dsesecurity.com/updates/cisa-cyber-hygiene-no-cost-vulnerability-web-application-scanning-enroll/", "headline": "CISA offers no-cost vulnerability and web application scanning to governments and critical infrastructure organizations", "description": "CISA’s Cyber Hygiene services provide no-cost vulnerability scanning of internet-accessible assets with weekly reports and urgent alerts, and web…", "abstract": "CISA’s Cyber Hygiene services provide no-cost vulnerability scanning of internet-accessible assets with weekly reports and urgent alerts, and web application scanning with monthly reports, to federal, state, local, tribal and territorial governments and public and private critical infrastructure organizations. Enrollment is by email.", "articleBody": "CISA’s Cyber Hygiene services provide no-cost vulnerability scanning of internet-accessible assets with weekly reports and urgent alerts, and web application scanning with monthly reports, to federal, state, local, tribal and territorial governments and public and private critical infrastructure organizations. Enrollment is by email.\nSource facts\nCISA’s Cyber Hygiene services page says its vulnerability scanning continuously monitors internet-accessible network assets on public, static IPv4 addresses, with weekly reports of all findings and ad hoc alerts about urgent findings such as potentially risky services and known exploited vulnerabilities. Its web application scanning examines publicly accessible web applications for vulnerabilities and misconfigurations, including those in the OWASP Top Ten, with monthly and on-demand reports.\nThe page says the services are available at no cost to federal, state, local, tribal and territorial governments and to public and private sector critical infrastructure organizations based in the United States, that services typically begin within three business days after sign-up, and that reports can be expected within two weeks of the scanning start date. Enrollment is by email to vulnerability@cisa.dhs.gov with the subject line Requesting Cyber Hygiene Services.\nCISA says organizations typically reduce their risk and exposure by 40% within the first 12 months, and recommends also identifying assets that are searchable through online tools and reducing that exposure.\nApplicability\nUse this for organizations that qualify as government or critical infrastructure. The scanning covers only internet-facing assets, so internal vulnerability management is still needed.\nDSE recommendation\nDSE recommends that eligible organizations enroll in CISA’s Cyber Hygiene scanning and route its urgent alerts to the people who can patch or close the exposed services. Keep the list of public IP addresses and web applications current with CISA, assign an owner to each finding, and fix known exploited vulnerabilities in the reports first.\nVerification\nReview each weekly report for new findings, confirm urgent alerts were resolved within the internal deadline, and update the scope whenever public addresses or web applications change.\nOfficial reference\nCISA — Cyber Hygiene Services. Reviewed October 19, 2026.", "datePublished": "2026-10-19T00:27:45+00:00", "dateModified": "2026-10-19T01:55:06+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/cisa-cyber-hygiene-no-cost-vulnerability-web-application-scanning-enroll/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/cisa-cyber-hygiene-no-cost-vulnerability-web-application-scanning-enroll/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "CISA offers no-cost vulnerability and web application scanning to governments and critical infrastructure organizations" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 334, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "CISA — Cyber Hygiene Services", "url": "https://www.cisa.gov/cyber-hygiene-services" } } ] } }