CISA's Cyber Hygiene services are free vulnerability scanning and web application scanning for eligible organizations. Eligible groups include US federal, state, local, tribal and territorial governments and public and private critical infrastructure organizations. You request it by email, and CISA says services typically start within three business days.
What the two services do
Vulnerability Scanning continuously checks internet-accessible assets, specifically public, static IPv4 addresses. You get weekly reports, plus ad-hoc alerts for urgent issues such as risky services and known exploited vulnerabilities.
Web Application Scanning looks at publicly reachable web applications for weaknesses, covering OWASP Top Ten risks. Reports arrive monthly, and on-demand reports are available.
Neither service looks inside your laptops or your cloud tenant configuration. It looks at what the internet can see.
Who is eligible
CISA's page lists US-based federal, state, local, tribal and territorial governments, and public and private sector critical infrastructure organizations. That is a wide net. A city or county office is local government, and a hospital or water utility is critical infrastructure. Schools and libraries are less clear cut, so ask CISA.
A small charity that is not government and not in a critical infrastructure sector may not qualify. Do not assume. Ask. International organizations are told to email CISA's international affairs address to learn what help they qualify for.
How to sign up
Email vulnerability@cisa.dhs.gov with the subject line "Requesting Cyber Hygiene Services." CISA says reports are expected within two weeks of the scanning start date.
Before you write, gather the list of public IP addresses and the web application addresses you want covered. If you do not know your public IP addresses, your internet provider or hosting company can tell you.
What to do with the reports
A report is only useful if someone reads it. Assign one person to review each weekly report, decide which findings matter, and close them out. Start with anything marked as a known exploited vulnerability, and with services that should not face the internet at all, such as remote desktop.
CISA's own ransomware guidance says the same: prioritize internet-facing systems and known exploited vulnerabilities when patching.
If you do not qualify
CISA also keeps a catalog of free cybersecurity services and tools, from CISA and from other public and private organizations. The catalog says it is not comprehensive and does not endorse any product. Its Regional Cybersecurity Advisors are another route for state-based help.
Quick check
Does the scanning cost anything?
CISA states that Cyber Hygiene services are available at no cost.
Will it scan my internal network?
No. The vulnerability service covers internet-accessible assets with public, static IPv4 addresses.
Sources
Last reviewed: 19 October 2026.
