CISA ScubaGear 2.0 and ScubaGoggles 1.1.0: faster M365 baseline checks via direct REST/Graph calls, plus new Google Workspace Gemini controls
CISA's Secure Cloud Business Applications (SCuBA) tools got a major bump. ScubaGear v2.0.0 (released Oct 22) moves supported Microsoft 365 product checks to direct REST/Graph API calls (continuing the Entra/SharePoint/Power Platform shift from 1.6/1.8), and adds baselines such as blocking high-risk Entra AI agents, risky-apps CSV/severity scoring, and broader Security Suite groups. ScubaGoggles v1.1.0 adds Google Workspace baseline coverage including enhanced Gemini controls, per CISA's announcement coverage.
Federal civilian agencies already use these against CISA baselines; commercial tenants can run the same open-source assessments to find drift before an audit or incident.
Sources: CISA ScubaGear v2.0.0 release (GitHub, Oct 22) · Help Net Security: CISA updates ScubaGear and ScubaGoggles (Oct 28)