After a century of history of cathodic protection (CP) of iron and steel, this paper critically reviews the state of the art in the science and engineering and assesses the fitness of CP as an effective technology to tackle the challenges related to infrastructure corrosion. This paper focuses on CP of iron-based alloys embedded in porous media, such as soil or concrete, as these two major applications of CP technology share many similarities. First, the scientific understanding of CP is reviewed and different competing theories are discussed. There is wide agreement that corrosion protection of steel is achieved thanks to a combination of immediate activation polarization and the beneficial changes in electrolyte chemistry that are gradually occurring at the steel surface when a protection current is flowing toward a steel electrode. A major and well-documented technological advantage of these "chemical effects" is that the protective effect of CP is maintained during temporal loss of protection current, e.g., due to survey work related shut-offs or anodic interference. However, the relationships between these chemical concentration changes in the porous medium and the protection current are complex, and, as this review shows, cannot reliably be described with state-of-the-art approaches. Moreover, in this paper, different hypotheses for the mechanism of corrosion protection in heterogeneous situations (galvanic elements), as they are generally occurring in practice, are discussed. It is revealed that understanding the working mechanism of CP in heterogeneous conditions remains a critical scientific challenge. The longstanding debate concerns the question whether CP results mainly in a reduction of number and size of actively corroding areas, or in a reduction of the corrosion rate at the actively corroding sites. Additionally, the literature addressing the interrelation between microbiologically influenced corrosion and CP is here reviewed, and recent progress as well as limitations of the existing literature are highlighted. In a second part, engineering practice and CP protection criteria are reviewed. It is found that the approaches stipulated in international standard are unreliable. This can be traced back to the assessment criteria being empirical and incapable of adequately taking into account the complexity of the underlying processes. Finally, recommendations for future developments are made. Particular opportunities are seen in embracing the progress made in numerical modeling, such as reactive transport modeling in porous media, and considering the interdependence between the involved processes, namely the interdependence between transport processes, chemical reactions, and electrode kinetics.