Alternatives to CIS-CAT Lite
A free tool from the Center for Internet Security that checks systems against CIS Benchmarks. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
CIS-CAT Lite
A free tool from the Center for Internet Security that checks systems against CIS Benchmarks.
Replacements
Listings that take over the same core job as CIS-CAT Lite.
OpenSCAP
Open source tools for scanning systems against SCAP security policies and hardening baselines.
OpenSCAP is open source and scans against SCAP policies and community hardening guides, but runs on Linux only and requires familiarity with SCAP profiles.
Lynis
Audit Unix-like systems for hardening opportunities.
Lynis is a free open-source command-line auditor for macOS and Linux that suggests hardening improvements instead of scoring against official CIS Benchmarks, with no registration form.
Microsoft Security Compliance Toolkit
Microsoft tools and security baselines for analyzing, testing and comparing Windows security configurations.
Microsoft Security Compliance Toolkit compares Windows configurations against Microsoft's own security baselines rather than CIS Benchmarks, and is limited to Windows and Microsoft products.
Similar software
Related functionality, not a direct replacement.
kube-bench
Check Kubernetes settings against CIS benchmark tests.
Nessus
Widely used commercial vulnerability scanner.
privacy.sexy
Generates privacy and hardening scripts for Windows, macOS and Linux.
ScubaGear
A CISA PowerShell tool that assesses a Microsoft 365 tenant's configuration against the SCuBA security baselines.
Maester
An open-source PowerShell test framework that checks a Microsoft 365 tenant's security configuration.
Wazuh Agent
Endpoint agent that feeds a Wazuh server with security and compliance data.
