On October 27, 2026, CISA announced ScubaGear v2.0 for Microsoft 365 and ScubaGoggles v1.1.0 for Google Workspace. The updates add automated Power BI assessment and a consolidated baseline to ScubaGear, while ScubaGoggles gains new configuration and visibility tools. CISA’s ScubaGear release record lists v2.0.0 with an October 22, 2026 release date.
The two updates target different cloud suites
| Tool | Cloud suite | Main additions |
| ScubaGear v2.0 | Microsoft 365 | Automated Power BI coverage, a consolidated Security Suite baseline, application-risk scoring and Config UI improvements |
| ScubaGoggles v1.1.0 | Google Workspace | An assured-controls baseline, enhanced Gemini controls, YAML configuration tools and Google Policy API integration |
What ScubaGear v2.0 adds for Microsoft 365
ScubaGear v2.0 uses direct REST API calls across every supported Microsoft 365 product and adds fully automated Power BI coverage. CISA says the API change makes assessments faster and more accurate.
The new Security Suite baseline brings together controls for Defender, Purview, Exchange Online and Teams. ScubaGear also adds application-management policies and severity scores to help administrators prioritize risky applications. Its Config UI includes policy migration, a built-in policy viewer and navigation for baseline documents.
For interactive Power BI assessment, CISA’s documented requirements are a Fabric Administrator or Global Administrator role, a Power BI or Microsoft Fabric license assigned to the account, and at least one prior sign-in to the Power BI portal.
What ScubaGoggles v1.1.0 changes for Google Workspace
ScubaGoggles v1.1.0 adds an assured-controls baseline and enhanced controls focused on Gemini. Its graphical interface lets administrators manage YAML configuration, with built-in validation and export.
The update also integrates Google Policy API for near-real-time configuration visibility. CISA says the design does not rely on administrator log events, which addresses visibility problems such as short log-retention windows and hidden default settings.
The current ScubaGear command
CISA’s current execution guide uses Invoke-SCuBA. To assess all products, the documented command is:
Invoke-SCuBA -ProductNames *
The older RunSCuBA.ps1 script was removed in ScubaGear v0.2.0. Administrators following older instructions can use CISA’s current execution guide for the present command. The interactive Power BI permissions documentation lists the role, license and prior sign-in requirements for that assessment.
