Skip to content
NewA calmer, faster ZeroHour
StoryToolsinfo

CISA updates ScubaGear and ScubaGoggles cloud configuration checkers

3 sources · 3 articlesFirst reported Updated ()1
What's new

October 28, 2026: Help Net Security reports ScubaGear 2.0 uses direct REST API calls and ScubaGoggles 1.1.0 adds an assured baseline and Gemini controls.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CISA released ScubaGear 2.0 and ScubaGoggles 1.1.0, which still only report Microsoft 365 and Google Workspace configuration gaps.

CISA published ScubaGear v2.0 and ScubaGoggles v1.1.0, open-source tools from the Secure Cloud Business Applications project that compare Microsoft 365 and Google Workspace settings with CISA baselines. The agency calls ScubaGear 2.0 its most comprehensive update since the 2022 launch and says direct Microsoft 365 REST API calls make assessments faster and more accurate. ScubaGoggles 1.1.0 adds an assured controls baseline and enhanced Gemini controls. Both tools report gaps and do not change tenant settings; administrators must review and apply changes. ScubaGoggles remains labeled alpha, and CISA warns its results may be incorrect and should be verified.

Key facts
  • ScubaGear 2.0 covers Entra ID, Defender for Office 365, Exchange, OneDrive, Power BI, Power Platform, SharePoint, and Teams.
  • ScubaGear checks policies with Rego and exports HTML, JSON, and CSV.
  • ScubaGoggles 1.1.0 covers Gmail, Calendar, Chat, Classroom, Drive and Docs, Meet, Sites, and Groups.
  • In 2024, CISA reported more than 30,000 ScubaGear downloads since October 2022.
  • Baselines map to NIST SP 800-53 and MITRE ATT&CK; YAML can record accepted deviations.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • Cyber Security NewsTools introduced in 2023; ScubaGear installs from the PowerShell Gallery.
  • GBHackersSCuBA followed SaaS visibility gaps; baselines map to NIST and ATT&CK.
  • Help Net SecurityVersion numbers, REST API speed claim, Gemini controls, and download count.
Vendors
MicrosoftGoogle
Products
ScubaGearScubaGogglesMicrosoft 365Google Workspace
Organizations
CISA
Countries
United States
AI models
Gemini

Coverage

oldest first · one row per article · UTC
  1. · 3d ago Cyber Security NewsFirst report

    CISA’s ScubaGear and ScubaGoggles check cloud security settings

    The existing SCuBA tools report configuration gaps in Microsoft 365 and Google Workspace but do not change tenant settings.

  2. · 2d ago GBHackers

    CISA offers free ScubaGear and ScubaGoggles cloud configuration assessment tools

    ScubaGear checks Microsoft 365 with PowerShell and Rego; alpha ScubaGoggles may misreport Google Workspace settings.

  3. · 2d ago Help Net Security

    CISA releases ScubaGear 2.0 and ScubaGoggles 1.1.0

    ScubaGear now calls Microsoft 365 REST APIs directly, and ScubaGoggles adds an assured baseline plus Gemini controls.