- Home
- Database Vulnerability Scanners
- CIS-CAT Pro Assessor
CIS-CAT Pro Assessor
East Greenbush, New York, United States
What it is
CIS-CAT Pro Assessor scans local or remote systems and reports compliance with CIS Benchmarks. Targets can run on premises or in cloud environments, while reports connect findings to CIS Controls and their three Implementation Groups. Teams can tailor benchmarks in CIS WorkBench, export the customized content, and assess systems against it. The Assessor supports agentless assessments, configuration-drift checks, cloud infrastructure, and Microsoft 365 Commercial Cloud tenants against the CIS Microsoft 365 Foundations Benchmark. Windows and Linux download bundles are available; the Linux bundle without embedded Java also supports macOS. Use requires CIS SecureSuite membership, with End User membership limited to internal organizational use. Listed annual membership plans range from $2,400 to $20,000 a year by employee count. CIS-CAT Lite is a free alternative for unlimited scans against select technologies. Local assessments require administrator privileges, a multi-core processor, at least 2 GB RAM, and 5 GB free disk space.
For and against
For
- Maps results to CIS Controls and Implementation Groups
- Supports local and remote cloud or on-premises targets
- Customizable benchmarks through CIS WorkBench
- Agentless assessment and configuration-drift checks
- Windows, Linux, and macOS bundle support
Against
- Requires CIS SecureSuite membership
- No free plan or free trial
- Microsoft 365 support excludes other cloud environments
- Automated remediation is not provided
The verdict
CIS-CAT Pro Assessor provides benchmark-based assessments, customization, and control mapping for member organizations. Its membership requirement and annual cost make it intended for internal security programs rather than casual use.
Who it suits
It suits organizations assessing internal systems against CIS guidance across Windows, Linux, macOS, cloud, or supported Microsoft 365 environments. End User membership is for internal organizational use, not client or commercial work.
Plans and prices
CIS-CAT Lite
unlimited scans · HTML reports · Windows 10, Google Chrome and Ubuntu benchmarks
Read 15 Oct 2026 · cisecurity.org
CIS SecureSuite End User (up to 99 employees)
up to 99 employees · internal organizational use · no commercial use
Read 15 Oct 2026 · cisecurity.org
CIS SecureSuite Controls Membership
Controls-focused membership · MSP, consultant and MSSP use
Read 15 Oct 2026 · cisecurity.org
CIS SecureSuite End User (100–499 employees)
100–499 employees · internal organizational use · no commercial use
Read 15 Oct 2026 · cisecurity.org
CIS SecureSuite End User (500–999 employees)
500–999 employees · internal organizational use · no commercial use
Read 15 Oct 2026 · cisecurity.org
CIS SecureSuite End User Membership (up to 99 employees)
Up to 99 employees · internal organizational use · no client or commercial use
Read 2 Oct 2026 · cisecurity.org
CIS SecureSuite End User Membership (100–499 employees)
100–499 employees · internal organizational use · no client or commercial use
Read 2 Oct 2026 · cisecurity.org
CIS SecureSuite End User Membership (500–999 employees)
500–999 employees · internal organizational use · no client or commercial use
Read 2 Oct 2026 · cisecurity.org
CIS SecureSuite End User Membership (1,000–4,999 employees)
1,000–4,999 employees · internal organizational use · no client or commercial use
Read 2 Oct 2026 · cisecurity.org
On the record
- Alternative assessment
- CIS-CAT Lite is a free assessment tool with unlimited scans against select technologies.cisecurity.org · read 2 Oct 2026
- API
- CIS publishes a SecureSuite Member API with token-authenticated endpoints to list bundles and download the latest or a specified assessor ZIP.ssapi.docs.cisecurity.org · read 15 Oct 2026
- API example
- The API documentation shows GET endpoints for listing available CIS-CAT bundles and downloading versions by operating system, Java and GUI options.ssapi.docs.cisecurity.org · read 15 Oct 2026
- Benchmark coverage
- The assessor uses automated content based on more than 100 globally recognized CIS Benchmarks.ciscat-assessor.docs.cisecurity.org · read 15 Oct 2026
- Benchmark customization
- Users can tailor CIS Benchmarks in CIS WorkBench, export them as automated content, and assess against them.cisecurity.org · read 2 Oct 2026
- Change: October 2026
- Version 4.67.0 was released on October 5, 2026 with new benchmark coverage and a Kubernetes probe security hardening change.ciscat-assessor.docs.cisecurity.org · read 15 Oct 2026
- CIS Controls mapping
- Reports map assessment findings to the CIS Critical Security Controls and their Implementation Groups.ciscat-assessor.docs.cisecurity.org · read 15 Oct 2026
- Command line
- The product provides a command-line interface alongside the graphical interface.github.com · read 15 Oct 2026
- Company founding
- CIS was founded in 2000.linkedin.com · read 15 Oct 2026
- Company headquarters
- CIS lists its headquarters in East Greenbush, New York.linkedin.com · read 15 Oct 2026
- Company legal name
- Crunchbase lists the legal name as Center for Internet Security, Inc.crunchbase.com · read 15 Oct 2026
- Company size
- LinkedIn lists CIS in the 501–1,000 employee range.linkedin.com · read 15 Oct 2026
- Company type
- CIS is described as a U.S. 501(c)(3) nonprofit organization.crunchbase.com · read 15 Oct 2026
- Configuration comparison
- The tool automatically compares target settings with the recommended settings in the selected CIS Benchmark.ciscat-assessor.docs.cisecurity.org · read 15 Oct 2026
- Custom benchmarks
- Members can customize CIS Benchmarks in CIS WorkBench and export the resulting content for automated assessments.cisecurity.org · read 15 Oct 2026
- Dashboard integration
- The assessor integrates with CIS-CAT Pro Dashboard and the CIS SecureSuite Platform for historical compliance views and dynamic reporting.ciscat-assessor.docs.cisecurity.org · read 15 Oct 2026
- G2 review volume
- G2 lists 28 reviews for Center for Internet Security products, including CIS benchmark products and CIS-CAT-related feedback.g2.com · read 15 Oct 2026
- GUI availability
- The graphical interface is available on Windows and Mac, and it must run from a local drive.ciscat-assessor.docs.cisecurity.org · read 15 Oct 2026
