CISA's Cyber Hygiene services are no-cost, and they focus on internet-facing systems, checking for weak configurations and known vulnerabilities. CISA's page says its work is aimed at critical infrastructure partners and state, local, tribal and territorial governments. To enrol, you email CISA. Eligibility is for CISA to decide.
What the page says
CISA lists Cyber Hygiene among its no-cost, in-house offerings, and among its "Top 3 Services". The page says the service looks at internet-facing systems for weak configurations and known vulnerabilities, and gives an email address for enrolment, vulnerability@cisa.dhs.gov. It also says all organisations should take certain foundational measures before asking for other CISA services.
The page does not use the term attack surface. Because the scan covers internet-facing systems, in practice it covers the outside-visible part of your environment.
Who it is aimed at
According to CISA's page, the work is aimed at critical infrastructure partners and at state, local, tribal and territorial governments. Check the current page for eligibility details, since services and criteria change, and do not assume a private company outside those groups qualifies.
What it can and cannot do for you
It can give you an outside view of weak configurations and known vulnerabilities on the addresses you give it. That is useful as a second opinion next to your own scanning.
It cannot replace internal inventory. It looks at what you tell it to look at, so addresses you forgot are not on the list. It does not review SaaS settings, identity configuration or application logic.
If you are not eligible
You still have routes to an outside view:
- Run your own external discovery, using DNS and certificate transparency logs
- Use commercial scanning services
- Commission a penetration test for the highest risk systems
- Read CISA's public guidance and baselines, such as those for cloud business applications
How to get the most from a free service
- Give a complete list of your address ranges and domains, after checking it against cloud accounts and DNS.
- Assign someone to read the reports and open tickets.
- Track time from finding to fix.
- Rescan after fixes to confirm.
Questions to ask yourself before you apply
- Do we have a current list of public addresses and domains?
- Who will act on the findings?
- Is there a process for emergency fixes on exposed systems?
If the answers are no, fix those first. A scan without owners produces a report that sits.
Keep a note of what the scan found and when, so you can show trend over time. That record also helps in customer security questionnaires, where you can truthfully describe your external scanning cadence.
Where Safeguard fits
Safeguard does not offer external scanning of your infrastructure. For code and dependencies it provides scanning, reachability analysis and policies, and a free scan at gold.safeguard.sh/scan.
Quick check
Is this a replacement for a penetration test?
No. It checks internet-facing systems for weak configurations and known vulnerabilities. A penetration test goes deeper into how flaws combine.
Sources
Last reviewed: 19 October 2026.
