Use a free government service for your internet-facing systems, a code and dependency scanner for the software you build or run, and scripts only for narrow, stable checks. They answer different questions, so most small public sector teams end up with a mix. This guide helps you pick the first step.
What the free CISA services cover
CISA's Cyber Hygiene page describes no-cost services that look at assets exposed to the internet. Vulnerability Scanning monitors internet-accessible network assets, specifically public, static IPv4 addresses, with weekly reports and ad hoc alerts about urgent findings such as known exploited vulnerabilities. Web Application Scanning looks at publicly accessible web applications for vulnerabilities and misconfigurations. CISA also keeps a curated list of no-cost services and tools from public and private organizations, aimed at critical infrastructure partners and state, local, tribal and territorial governments.
Check CISA's pages for current eligibility and enrollment, since programs change.
What those services do not look at
An outside scan sees what the internet sees. It does not read your source code, your dependency lists, your container build files or what runs inside a private network. If your district or agency builds or customizes software, that gap is real.
The three options
| Option | Best for | Limits |
|---|---|---|
| Free government scanning | Public facing hosts and web apps | Outside view only, no code or dependency view |
| Bought code and dependency tool | Software you build or customize, supply chain visibility | Needs review, budget and an owner |
| Scripts you write | Narrow checks such as one config or one file pattern | Maintenance falls on you, easy to let rot |
How to choose
- List what you run. Public sites, internal apps, custom code, vendor software.
- Mark what you build. Only custom code and its dependencies need a code scanner.
- Start free for the outside view. It costs staff time but no license.
- Add a code tool when you have owned software. Pilot on one project.
- Write scripts only for gaps. Keep them in version control with an owner and a review date.
Warning signs for scripts
- Only one person understands them.
- They check for last year's problem.
- Nobody reviews the output.
- They need credentials stored in plain files.
If two or more apply, retire the script or replace it with a maintained tool.
When to combine
An agency with one public website, a few vendor products and no custom code may need only the free external scan plus a patching routine. A district with a student portal built in house needs both views. A university lab shipping research software needs a code view first.
Questions to ask before buying
- What will it scan, and what stays out of scope?
- Where does code or metadata go during a scan?
- Who reviews findings each week?
- What will we stop doing because of it?
See what usage data a tool collects and steps in a purchase.
Quick check
Does a free external scan replace a code scanner?
No. It sees internet-facing assets, not source code or dependencies.
When are scripts enough?
For narrow, stable checks with a named owner and a review date.
Sources
Last reviewed: 19 October 2026.
