CISA Releases Free Cloud Security Assessment Tools

The cybersecurity agency launched new software to help organizations identify configuration weaknesses in major cloud platforms.

Updated on Oct. 27, 2026 in Cybersecurity

Isometric editorial illustration of a rack-mounted server cabinet, representing cybersecurity tools for identifying cloud configuration risks. — The Cybersecurity and Infrastructure Security Agency has released new, free assessment tools to help U.S. organizations identify and fix cloud configuration vulnerabilities. AI Illustration. Upload story photo >

Live Poll

Do you trust free security tools to adequately identify misconfigurations in your cloud workspace?

CISA has released two free security assessment tools, ScubaGear and ScubaGoggles, designed to identify configuration risks within cloud environments. The utilities are now available to both government agencies and private sector businesses across the United States.

Why it matters

These tools allow organizations to proactively scan their cloud environments for misconfigurations, helping to prevent unauthorized access and potential data breaches. By automating the comparison of settings against security baselines, administrators can more easily identify and remediate vulnerabilities.

CISA released 2 specialized tools, ScubaGear for Microsoft 365 and ScubaGoggles for Google Workspace, to automate cloud configuration audits. These programs compare current settings against predefined security baselines and generate reports for administrator review.

The players

CISA

The Cybersecurity and Infrastructure Security Agency is a United States federal agency tasked with protecting national infrastructure from physical and cyber threats.

The details

The software functions by scanning cloud account settings to detect security gaps that could leave systems exposed to cyber threats. Once the scan is complete, the tools produce detailed reports highlighting specific weaknesses for IT teams to patch.

October 27, 2026: CISA released two free security tools.

The Tech Race

This release marks a shift toward accessible, automated defense for complex cloud ecosystems which were previously governed by static, manual documentation. It positions CISA as a provider of active security infrastructure rather than just advisory guidance in an increasingly automated cyber threat landscape.

IT administrators and business owners can use these tools to perform automated, cost-free security audits of their cloud environments without hiring expensive external consultants. This improves workflow efficiency by providing clear, actionable data on what settings need adjustment to reach baseline security standards.

The takeaway

Organizations should integrate these free tools into their regular security maintenance routines to ensure their cloud configurations remain resilient against evolving threats. Keeping cloud settings aligned with established security baselines remains one of the most effective ways to mitigate unauthorized access risks.