How Often Should I Scan?

The time between a vulnerability being discovered and hackers exploiting it is narrower than ever – just 12 days. So it makes sense that organizations are starting to recognize the importance of not leaving long gaps between their scans, and the term “continuous vulnerability scanning” is becoming more popular.

Hackers won’t wait for your next scan

One-off scans can be a simple ‘one-and-done’ scan to prove your security posture to customers, auditors or investors, but more commonly they refer to periodic scans kicked off at semi-regular intervals – the industry standard has traditionally been quarterly.

These periodic scans give you a point-in-time snapshot of your vulnerability status – from SQL injections and XSS to misconfigurations and weak passwords. Great for compliance if they only ask for a quarterly vulnerability scan, but not so good for ongoing oversight of your security posture, or a robust attack surface management program. With a fresh CVE created every 20 minutes, you run the risk of having an outdated view of your security at any given moment.

It’s highly likely that some of the 25,000 CVE vulnerabilities disclosed last year alone will affect you and your business in the gaps between one-off or semi-regular scans. Just look at how often you have to update the software on your laptop… It can take weeks or even months before vulnerabilities are patched too, by which time it may be too late. With the potential damage to your business these vulnerabilities could cause, there’s simply no substitute for continuous scanning in 2023.

Continuous vulnerability scanning provides 24/7 monitoring of your IT environment and automation to reduce the burden on IT teams. This means issues can be found and fixed faster, closing the door on hackers and potential breaches.

The slow pace of compliance

Let’s be honest, a lot of companies start their cyber security journey because someone tells them they have to, whether that’s a customer or industry compliance framework. And a lot of the requirements in this space can take time to evolve, still citing things like an “annual penetration test” or “quarterly vulnerability scan”. These are legacy concepts from years ago when attackers were few on the ground, and these things were seen as ‘nice to have.’

As a result, many organizations still treat vulnerability scanning as a nice-to-have or a compliance box to tick. But there is a world of difference between semi-regular scanning and proper, continuous vulnerability testing and management – and understanding that difference is crucial for improving security rather than just spending money on it.

The simple truth is that new vulnerabilities are disclosed every day, so there’s always the potential for a breach, even more so if you’re often updating cloud services, APIs, and applications. One small change or new vulnerability release is all it takes to leave yourself exposed. It’s no longer about ticking boxes – continuous coverage is now a ‘must have,’ and organizations who are more mature in their cyber security journey realize it.

Continuous attack surface monitoring

It’s not just new vulnerabilities that are important to monitor. Every day, your attack surface changes as you add or remove devices from your network, expose new services to the internet, or update your applications or APIs. As this attack surface changes, new vulnerabilities can be exposed.

To catch new vulnerabilities before they’re exploited, you need to know what’s exposed and where – all the time. Many legacy tools don’t provide the right level of detail or business context to prioritize vulnerabilities; they treat all attack vectors (external, internal, cloud) the same. Effective continuous attack surface monitoring should provide the business context and cover all attack vectors – including cloud integrations and network changes – to be truly effective.

Attack surface management is no longer just a technical consideration either. Boards are increasingly recognizing its importance as part of a robust cyber security program to safeguard operations, while it’s a key requirement for many cyber insurance premiums.

How much is too much?

Continuous scanning doesn’t mean constant scanning, which can produce a barrage of alerts, triggers and false positives that are nearly impossible to keep on top off. This alert fatigue can slow down your systems and applications, and tie your team up in knots prioritizing issues and weeding out false positives.

Intruder is a modern security tool that cleverly gets round this problem by kicking off a vulnerability scan when a network change is detected or a new external IP address or hostname is spun up in your cloud accounts. This means your vulnerability scans won’t overload your team or your systems but will minimize the window of opportunity for hackers.

Modern security tools like Intruder integrate with your cloud providers, so it is easy to see which systems are live and to run security checks when anything changes.

How often do you need to scan for compliance?

This depends on which compliance you’re looking for! While SOC 2 and ISO 27001 give you some wiggle room, HIPAA, PCI DSS and GDPR explicitly state scanning frequency, from quarterly to once a year. But using these standards to determine the right time and frequency for vulnerability scanning might not be right for your business. And doing so will increase your exposure to security risks due to the rapidly changing security landscape.

If you want to actually secure your digital assets and not just tick a box for compliance, you need to go above and beyond the requirements stipulated in these standards – some of which are out of step with today’s security needs. Today’s agile SaaS businesses, online retailers that process high volume transactions or take card payments, and anyone operating in highly-regulated industries like healthcare and financial services, need continuous scanning to ensure they’re properly protected.

Harder, better, faster, stronger

Traditional vulnerability management is broken. With technology in constant flux as you spin up new cloud accounts, make network changes or deploy new technologies, one-off scans are no longer enough to keep up with the pace with the change.

When it comes to closing the cyber security gaps between scans that attackers look to exploit, sooner is better than later, but continuous is best. Continuous scanning reduces the time to find and fix vulnerabilities, delivers rich threat data and remediation advice, and minimizes your risk by prioritizing threats according to the context of your business needs.

About Intruder

Intruder is a cyber security company that helps organizations reduce their attack surface by providing continuous vulnerability scanning and penetration testing services. Intruder’s powerful scanner is designed to promptly identify high-impact flaws, changes in the attack surface, and rapidly scan the infrastructure for emerging threats. Running thousands of checks, which include identifying misconfigurations, missing patches, and web layer issues, Intruder makes enterprise-grade vulnerability scanning easy and accessible to everyone. Intruder’s high-quality reports are perfect to pass on to prospective customers or comply with security regulations, such as ISO 27001 and SOC 2.

Intruder offers a 14-day free trial of its vulnerability assessment platform. Visit their website today to take it for a spin!