Scan schedules: hourly, daily, weekly or manual?

Once your paths are chosen, the next setting is how often the agent scans them. There are four options: manual, hourly, daily and weekly. None of them is wrong. The right one depends on how quickly files change in your office and how soon you want to hear about a new exposure.

Full scans and incremental scans

The first scan of any path is a full scan. The agent reads every supported file there. After that, scans can be incremental, which means the agent re-reads only the files that have changed since the last time. That is why frequent schedules are not as heavy as they sound: on an ordinary day, only a small share of files change, and only those are read again.

New organizations default to hourly incremental scans. That default suits most offices, and you can change it at any time.

You can also limit scans to certain hours and days. On the Scan schedules page, pick a ready-made schedule such as “Overnight (day-shift office)”, “Daytime (night-shift office)”, “Weekends only” or “Hourly during business hours”, or make your own. One is the account default, and any computer can follow a different one, set one at a time or many at once from Computers. Each computer uses its own clock.

The four options

• Hourly. A new file with sensitive data is picked up soon after it appears. This fits offices where documents arrive all day, such as a front desk saving client emails and forms all day, or a tax office during filing season.
• Daily. A good middle ground. A new exposure shows up by the next day, and scanning can run overnight or at lunch when the machine is quiet.
• Weekly. Enough for low-traffic computers, such as a back-office machine that rarely handles new documents, or a computer used mostly for email and browsing.
• Manual. The agent scans only when you start one. This is handy during setup and for external disks you only occasionally connect.

Matching the schedule to the computer

You do not have to use one schedule for everything. Picture a small accounting office with three kinds of machines. The front-desk PC receives documents constantly, so hourly makes sense. The partners' laptops handle returns and organizers in busy bursts, so daily works. The old office workstation that holds archives rarely changes, so weekly, or even manual, is plenty.

A few questions help you decide:

1. How often does this computer receive or create files from clients?
2. If a sensitive file appeared today, how long would you be comfortable not knowing?
3. Is the computer used heavily during the day, so a scan could be noticed?

Keeping the load low

Scans already slow down while someone is using the computer. If one is still noticeable, choose a quieter schedule. A daily scan set for a time when nobody is working is the gentlest option for older computers. The default scan already skips AppData and caches, which removes a large amount of low-value reading.

How scheduling connects to your process

Scanning more often does not fix anything on its own. The product reports exposed data; moving, encrypting or deleting files is still the job of your team or IT provider. So pick a schedule you can act on. If findings arrive hourly but nobody reviews the dashboard until the end of the month, a weekly schedule with a weekly review habit does the same job with less noise.

A workable routine for many small offices is this:

• Let the first full scan finish (or press Scan now), so you see the baseline.
• Switch busy computers to hourly or daily incremental scans.
• Set a recurring time, such as Monday morning, to check new findings.
• After each clean-up, let the next scan confirm the findings are gone.

Comparing each new report with the first one you saved makes the habit rewarding: you can see the number of exposed files going down. When you are writing a security program, the review routine itself is useful to document, and an attorney or advisor can tell you what your particular rules expect.

One more tip: when you change a schedule, note the date and the reason in your own records. Months later it is easy to forget why one computer scans weekly while another scans hourly, and a short note saves a puzzled conversation.

Knowing when something new shows up

Every scan is compared with the previous scan of the same computer. The dashboard marks findings that were not there last time with a New badge, the overview shows how many are new since the last scan, and the device page shows how many were fixed. By default you are emailed when a scan finds something new, or when findings are fixed, and not after every scan, so an hourly schedule does not fill your inbox. The first scan of a computer is the baseline, so nothing is called new until the second scan. The email carries counts only: no file names and no values. You can change who hears about scans, and when, under Scan settings, Scan emails. The notice is as fresh as your schedule, so an hourly schedule means within about an hour, not instantly.

You can change a schedule whenever the office changes. A new hire, a busy season or a new scanner is a good reason to revisit it.