Freedom251 › Database Vulnerability Scanners
CIS-CAT Pro Assessor
What CIS-CAT Pro Assessor is
CIS-CAT Pro Assessor scans local and remote systems and reports how their configurations align with CIS Benchmarks. Targets can run in cloud or on-premises environments, and reports connect findings to CIS Controls and their three Implementation Groups. Users can tailor CIS Benchmarks in CIS WorkBench, export the customized benchmarks as automated content, and assess systems against them. The Assessor is agentless and can assess cloud infrastructure. CIS lists 124 benchmarks available in CIS-CAT Assessor.
The tool is available only through CIS SecureSuite membership. End User membership is intended for protecting an organization’s own systems, not for client or commercial use. Membership starts at $2,400 a year for organizations with up to 99 employees, with higher annual tiers based on employee count. CIS-CAT Lite is a free alternative for unlimited scans against select technologies. Windows and Linux download bundles are provided; the Linux bundle without embedded Java also supports macOS. The tool supports Microsoft 365 Commercial Cloud tenant assessments against the CIS Microsoft 365 Foundations Benchmark. The Center for Internet Security, Inc., which makes the product, describes itself as a 501(c)(3) nonprofit.
Who it suits
CIS-CAT Pro Assessor suits organizations that want to assess internal systems against CIS Benchmarks and map results to CIS Controls. It is also relevant to teams that need assessments across local, remote, cloud, or on-premises targets and can use CIS SecureSuite membership for internal organizational purposes.
What it does well
- Assesses local and remote targets in cloud or on-premises environments.
- Reports map results to CIS Controls and three Implementation Groups.
- Benchmark content can be customized through CIS WorkBench.
- Agentless assessments cover cloud infrastructure.
- Windows and Linux bundles are provided; one Linux bundle supports macOS.
What to know first
- Use requires CIS SecureSuite membership.
- End User membership does not permit client or commercial use.
- No automated remediation is provided.
- Microsoft 365 assessment is limited to Commercial Cloud tenants.
Limits
Use is limited to CIS SecureSuite Members, and End User membership resources are for internal organizational use rather than client or commercial use. The v4 guide lists a multi-core processor, 2 GB RAM, 5 GB free disk space, and administrator privileges for local assessments; Microsoft 365 support is limited to Commercial Cloud tenants.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| CIS-CAT Lite | free · unlimited scans · HTML reports · Windows 10, Google Chrome and Ubuntu benchmarks | Free |
| CIS SecureSuite End User Membership (1,000–4,999 employees) | 1-Year Total · 1,000–4,999 employees · internal organizational use · no client or commercial use | $10,900 a year |
| CIS SecureSuite End User Membership (5,000–24,999 employees) | 1-Year Total · 5,000–24,999 employees · internal organizational use · no client or commercial use | $12,800 a year |
| CIS SecureSuite End User Membership (25,000–99,999 employees) | 1-Year Total · 25,000–99,999 employees · internal organizational use · no client or commercial use | $15,200 a year |
| CIS SecureSuite End User Membership (100,000+ employees) | 1-Year Total · 100,000+ employees · internal organizational use · no client or commercial use | $20,000 a year |
| CIS SecureSuite End User Membership (up to 99 employees) | 1-Year Total · Up to 99 employees · internal organizational use · no client or commercial use | $2,400 a year |
| CIS SecureSuite End User (up to 99 employees) | 1-Year Total · up to 99 employees · internal organizational use · no commercial use | $2,400 a year |
| CIS SecureSuite Controls Membership | annual · Controls-focused membership · MSP, consultant and MSSP use | $3,600 a year |
The first 8 of 12 plans, as cisecurity.org lists them, read 15 Oct 2026. The maker's own page has the final word. Every plan
Getting started
- Visit the CIS-CAT Pro Assessor product page.
- Choose a CIS SecureSuite End User membership tier for your organization size.
- Download the Windows or Linux bundle; the Linux bundle without embedded Java also supports macOS.
- Prepare a multi-core host with at least 2 GB RAM and 5 GB free disk space.
- Use administrator privileges for local assessments and restrict access to authorized users.
Verdict
Choose CIS-CAT Pro Assessor if your organization needs agentless CIS Benchmark assessments and CIS Controls mapping for internal systems. Look elsewhere if you need automated remediation or Microsoft 365 assessment beyond Commercial Cloud tenants.
Questions
How much does CIS-CAT Pro Assessor cost?
Access is through CIS SecureSuite membership. End User membership costs $2,400 a year for up to 99 employees, $5,500 a year for 100–499, $7,900 a year for 500–999, $10,900 a year for 1,000–4,999, $12,800 a year for 5,000–24,999, $15,200 a year for 25,000–99,999, and $20,000 a year for 100,000 or more employees.
Is there a free plan or trial?
There is no free plan or free trial for CIS-CAT Pro Assessor. CIS-CAT Lite is a free assessment tool with unlimited scans against select technologies.
Which platforms are supported?
The listed platforms are API, Linux, macOS, self-hosted, and Windows. CIS provides Windows and Linux download bundles; the Linux bundle without embedded Java also supports macOS.
Can it assess Microsoft 365?
It supports Microsoft 365 Commercial Cloud tenants against the CIS Microsoft 365 Foundations Benchmark. Other Microsoft 365 cloud environments are not supported for this assessment.
Who makes CIS-CAT Pro Assessor?
The maker is the Center for Internet Security, Inc., which describes itself as a 501(c)(3) nonprofit organization.
Facts from CIS-CAT Pro Assessor's own pages
- Alternative assessment
- CIS-CAT Lite is a free assessment tool with unlimited scans against select technologies. · cisecurity.org, 2 Oct 2026
- API
- CIS publishes a SecureSuite Member API with token-authenticated endpoints to list bundles and download the latest or a specified assessor ZIP. · ssapi.docs.cisecurity.org, 15 Oct 2026
- API example
- The API documentation shows GET endpoints for listing available CIS-CAT bundles and downloading versions by operating system, Java and GUI options. · ssapi.docs.cisecurity.org, 15 Oct 2026
- Benchmark coverage
- The assessor uses automated content based on more than 100 globally recognized CIS Benchmarks. · ciscat-assessor.docs.cisecurity.org, 15 Oct 2026
- Benchmark customization
- Users can tailor CIS Benchmarks in CIS WorkBench, export them as automated content, and assess against them. · cisecurity.org, 2 Oct 2026
- Change: October 2026
- Version 4.67.0 was released on October 5, 2026 with new benchmark coverage and a Kubernetes probe security hardening change. · ciscat-assessor.docs.cisecurity.org, 15 Oct 2026
- CIS Controls mapping
- Reports map assessment findings to the CIS Critical Security Controls and their Implementation Groups. · ciscat-assessor.docs.cisecurity.org, 15 Oct 2026
- Command line
- The product provides a command-line interface alongside the graphical interface. · github.com, 15 Oct 2026
- Company founding
- CIS was founded in 2000. · linkedin.com, 15 Oct 2026
- Company headquarters
- CIS lists its headquarters in East Greenbush, New York. · linkedin.com, 15 Oct 2026
- Company legal name
- Crunchbase lists the legal name as Center for Internet Security, Inc. · crunchbase.com, 15 Oct 2026
- Company size
- LinkedIn lists CIS in the 501–1,000 employee range. · linkedin.com, 15 Oct 2026
- Company type
- CIS is described as a U.S. 501(c)(3) nonprofit organization. · crunchbase.com, 15 Oct 2026
- Configuration comparison
- The tool automatically compares target settings with the recommended settings in the selected CIS Benchmark. · ciscat-assessor.docs.cisecurity.org, 15 Oct 2026
- Custom benchmarks
- Members can customize CIS Benchmarks in CIS WorkBench and export the resulting content for automated assessments. · cisecurity.org, 15 Oct 2026
- Dashboard integration
- The assessor integrates with CIS-CAT Pro Dashboard and the CIS SecureSuite Platform for historical compliance views and dynamic reporting. · ciscat-assessor.docs.cisecurity.org, 15 Oct 2026
- Founded
- 2000 · cisecurity.org, 28 Sept 2026
- G2 review volume
- G2 lists 28 reviews for Center for Internet Security products, including CIS benchmark products and CIS-CAT-related feedback. · g2.com, 15 Oct 2026
- GUI availability
- The graphical interface is available on Windows and Mac, and it must run from a local drive. · ciscat-assessor.docs.cisecurity.org, 15 Oct 2026
- Headquarters
- East Greenbush, New York, United States · cisecurity.org, 28 Sept 2026
- Independent review
- NutterTools describes CIS-CAT Pro as a desktop assessment application for measuring systems against CIS Benchmarks and producing compliance evidence. · best-tools-for.nuttertools.dev, 15 Oct 2026
- Intended audience
- End User membership is for organizations securing their internal systems and does not permit client or commercial use of membership resources. · cisecurity.org, 2 Oct 2026
- License access
- Full Pro functionality and content require a CIS SecureSuite license, while an invalid or absent license limits the installation to CIS-CAT Lite behavior. · ciscat-assessor.docs.cisecurity.org, 15 Oct 2026
- License model
- The assessor is distributed as a proprietary member download; the official pages describe embedded third-party open-source and commercial components but do not publish the assessor source under an open-source license. · ciscat-assessor.docs.cisecurity.org, 15 Oct 2026