Free vulnerability scanning for your business

Share This Page

You know the importance of strong cybersecurity, but have you heard about free vulnerability testing? As part of its mission to protect the nation’s cyber infrastructure, the Department of Homeland Security’s Cyber-Infrastructure Security Agency (CISA) offers free vulnerability scanning to government, critical infrastructure, and private businesses.

What does this mean for you? You may be eligible for no-cost vulnerability scanning that will continuously check your internet-facing assets. The testing checks for known vulnerabilities and weak configuration, then recommends ways to improve your security. Using commercial vulnerability scanners, each host is evaluated against a library of vulnerabilities.

How does it work? To get started, contact CISA at NCATS_INFO@hq.dhs.gov. Next, they’ll send you documents to return and sign, confirm a scanning schedule, and send you a pre-scan notification. After CISA processes your request, they’ll start scanning for vulnerabilities within 72 hours. Once it’s set up, the service is automated and requires very little direct interaction. Within two weeks, you’ll start getting weekly summary reports, with vulnerability mitigation recommendations.

Still not sure it’s right for your business? CISA has created a Cyber Hygiene Sample Report so you can see what to expect. The report identifies the number of vulnerable hosts and ranks vulnerabilities by severity (critical, high, medium, low) to help you prioritize remediation efforts. When you get the report, it’s up to you to take the steps to address any issues it identified. The report also shows changes since your previous report, including a list of vulnerabilities that you’ve mitigated.

Worried about who else is going to find out about your company’s vulnerabilities? Your password-protected Cyber Hygiene Report gets delivered to a single address within your company. CISA says that they will not share information that’s attributable to a specific company, without your company’s written consent. They use anonymized data to develop reports for trending and analysis.

These vulnerability scans offer one more tool in your company’s cybersecurity toolbox. For more tips and tools, check out the FTC’s Cybersecurity for Small Business and Start with Security materials.

Add new comment

Comment Policy

Privacy Act Statement

It is your choice whether to submit a comment. If you do, you must create a user name, or we will not post your comment. The Federal Trade Commission Act authorizes this information collection for purposes of managing online comments. Comments and user names are part of the Federal Trade Commission’s (FTC) public records system (PDF), and user names also are part of the FTC’s computer user records system (PDF). We may routinely use these records as described in the FTC’s Privacy Act system notices. For more information on how the FTC handles information that we collect, please read our privacy policy.