Scheduled scans¶
A scheduled scan is a saved scan definition that the platform runs for you on a recurring cadence. Use it for anything you need to prove happened repeatedly: weekly external exposure checks, nightly compliance evidence collection for CMMC, FedRAMP, TX-RAMP or SOC 2, or a monthly discovery sweep of a network range.
Schedules are managed in the dashboard under Security Operations → Scans → Schedules, or from the Create Scan wizard by turning on scheduling before you launch.
Recurrence options¶
| Recurrence | When it runs |
|---|---|
| Hourly | At the top of every hour |
| Daily | Every day at the hour and minute you choose |
| Weekly | On the weekday you choose, at the hour and minute you choose |
| Monthly | On the day of month you choose (1 to 28), at the hour and minute you choose |
| Continuous | Every 5 minutes. Intended for short scans; a run still in progress when the next is due will overlap it |
| Custom cron | A standard 5-field cron expression (minute hour day-of-month month day-of-week), for example 0 2 * * 1-5 for 02:00 on weekdays |
All times are UTC
Hours, minutes and cron expressions are evaluated in UTC, not in your browser's
time zone. A daily schedule set to hour 2 runs at 02:00 UTC.
Invalid cron expressions are rejected when you save, with the parser's reason shown in the form.
What happens when a schedule is due¶
The platform checks for due schedules once a minute. When one is due it creates a normal scan task with the schedule's scan type, target, options and scanner group, so the run appears in your scan list exactly like a scan you launched by hand, and then advances the schedule to its next occurrence.
Each run records who created the schedule as the scan's creator, and the scan's detail page shows a via schedule badge so you can tell scheduled runs from manual ones.
The Schedules page shows each schedule's Next run (the real next occurrence) and Last run. The last-run timestamp links to the scan it produced.
Missed runs and catch-up¶
If the platform was unavailable when a run was due, the schedule catches up in a bounded way:
- A run that was due within the last interval of the schedule (for example, within the last 24 hours for a daily schedule) is fired as soon as the platform is back. The scan is marked late on its detail page so auditors can see it ran off-cadence.
- A run that was due longer ago than one interval is skipped, and the schedule resumes at its next real occurrence. This prevents a burst of stale scans after a long outage.
Runs fired within two minutes of their due time are not marked late.
Disabled schedules¶
You can turn a schedule off with the Enabled switch without deleting it. A disabled schedule keeps its definition and history and does not run.
The platform also disables a schedule itself, rather than retrying it every minute, if its stored cron expression can no longer be evaluated. Edit the schedule to correct the expression and re-enable it.
Compliance cadence¶
For frameworks that require evidence across a period rather than at a point in time, run the compliance scan on a cadence shorter than the audit-log retention of the systems being assessed, so that no part of the period falls outside a captured window. The right cadence depends on that retention and on the controls in scope: for example, where a directory retains sign-in and audit events for 30 days, a weekly schedule captures each window with margin, while a system retaining 90 days can be sampled less often. Your auditor's sampling expectations govern. See Evidence automation.