DHS Giving Firms Free Penetration Tests
Summary: The Department of Homeland Security has been running a little-known program called NCATS that offers free penetration testing and vulnerability scanning to private companies, mostly banks and energy firms, with 53 private sector partners supported in Fiscal Year 2015. DHS's FY 2014 report on the program found that manual testing was needed to identify 67 percent of RVA vulnerability findings, that more than 50 percent of 344 vulnerabilities found earned a high or critical severity rating, and that RVA phishing emails produced a 25 percent click rate.
What you should know: A 25 percent phishing click rate and 13 percent critical-severity findings across 344 vulnerabilities describe the baseline at critical infrastructure firms that accepted free government testing, and SANS's Alan Paller warns the service can hand leadership a 'get out of jail free card' to spend less on security afterward.
Read the original at Krebs on Security ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026