# CISA offers no-cost vulnerability and web application scanning to governments and critical infrastructure organizations > CISA’s Cyber Hygiene services provide no-cost vulnerability scanning of internet-accessible assets with weekly reports and urgent alerts, and web application scanning with monthly reports, to federal, state, local, tribal and territorial governments and public and private critical infrastructure organizations. Enrollment is by email. - Canonical URL: https://update.dsesecurity.com/updates/cisa-cyber-hygiene-no-cost-vulnerability-web-application-scanning-enroll/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-19T00:27:45+00:00 - Modified: 2026-10-19T01:55:06+00:00 - Last reviewed by DSE: 2026-10-19 - Resource type: Guide - DSE priority: Advisory - Topics: Cybersecurity, Networks & Infrastructure - Reading time: 2 minutes ## What you need to know CISA’s Cyber Hygiene services provide no-cost vulnerability scanning of internet-accessible assets with weekly reports and urgent alerts, and web application scanning with monthly reports, to federal, state, local, tribal and territorial governments and public and private critical infrastructure organizations. Enrollment is by email. ## Potentially affected Cities, townships, school districts, utilities, health care and other critical infrastructure organizations, and the IT providers who manage their internet-facing systems. ## DSE recommendation DSE recommends that eligible organizations enroll in CISA’s Cyber Hygiene scanning and route its urgent alerts to the people who can patch or close the exposed services. ## Article CISA’s Cyber Hygiene services provide no-cost vulnerability scanning of internet-accessible assets with weekly reports and urgent alerts, and web application scanning with monthly reports, to federal, state, local, tribal and territorial governments and public and private critical infrastructure organizations. Enrollment is by email. ## Source facts CISA’s [Cyber Hygiene services page](https://www.cisa.gov/cyber-hygiene-services) says its vulnerability scanning continuously monitors internet-accessible network assets on public, static IPv4 addresses, with weekly reports of all findings and ad hoc alerts about urgent findings such as potentially risky services and known exploited vulnerabilities. Its web application scanning examines publicly accessible web applications for vulnerabilities and misconfigurations, including those in the OWASP Top Ten, with monthly and on-demand reports. The page says the services are available at no cost to federal, state, local, tribal and territorial governments and to public and private sector critical infrastructure organizations based in the United States, that services typically begin within three business days after sign-up, and that reports can be expected within two weeks of the scanning start date. Enrollment is by email to vulnerability@cisa.dhs.gov with the subject line Requesting Cyber Hygiene Services. CISA says organizations typically reduce their risk and exposure by 40% within the first 12 months, and recommends also identifying assets that are searchable through online tools and reducing that exposure. ## Applicability Use this for organizations that qualify as government or critical infrastructure. The scanning covers only internet-facing assets, so internal vulnerability management is still needed. ## DSE recommendation DSE recommends that eligible organizations enroll in CISA’s Cyber Hygiene scanning and route its urgent alerts to the people who can patch or close the exposed services. Keep the list of public IP addresses and web applications current with CISA, assign an owner to each finding, and fix known exploited vulnerabilities in the reports first. ## Verification Review each weekly report for new findings, confirm urgent alerts were resolved within the internal deadline, and update the scope whenever public addresses or web applications change. ## Official reference [CISA — Cyber Hygiene Services](https://www.cisa.gov/cyber-hygiene-services). Reviewed October 19, 2026. ## Primary reference - Name: CISA — Cyber Hygiene Services - Authority: Cybersecurity and Infrastructure Security Agency - URL: https://www.cisa.gov/cyber-hygiene-services - Source publication date: Not stated by the source ## Citation and use Preferred citation: “CISA offers no-cost vulnerability and web application scanning to governments and critical infrastructure organizations,” DSE Security, https://update.dsesecurity.com/updates/cisa-cyber-hygiene-no-cost-vulnerability-web-application-scanning-enroll/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.