For an estate of around three hundred devices, weekly external scanning and monthly authenticated internal scanning is a sensible baseline, with servers scanned weekly and anything internet-facing checked more often than that. The right cadence is the one your team can act on. Scanning faster than you can remediate produces a longer list, not a safer network, which is the point NIST makes throughout its enterprise patch management planning guidance in SP 800-40.
Different assets, different clocks
Split the estate before setting a frequency. Internet-facing systems change without warning and are scanned by attackers continuously, so weekly is the minimum and daily is reasonable given how little it costs. Servers carry the software that matters and sit still, so weekly authenticated scanning fits the patch cycle. Workstations move around and are best covered by agents that report whenever the machine is on. Network devices, printers and cameras deserve a monthly pass, mostly because nobody patches them otherwise and they accumulate findings quietly for years.
Fitting the schedule to your patch cycle
Line the scan up with the work rather than the calendar. If your estate is largely Microsoft, updates arrive on the second Tuesday of the month, so a scan the following week shows what deployment actually achieved rather than what the console claims. Run a second pass at the end of the month to catch machines that were off, which in a hybrid workforce is a meaningful number. Keep one scan configuration stable over time, because changing the template changes the numbers and destroys your ability to see a trend.
“The cadence question is usually the wrong one. I ask clients how long it takes them to fix a high severity finding once they know about it, and if the honest answer is six weeks, scanning weekly just gives them six copies of the same report. Fix the remediation route first, then increase the frequency, because the second one only helps once the first one works.”
William Fieldhouse, Director, Aardwolf Security Ltd
Watching coverage, not just findings
Track the number of hosts scanned against the number you believe you own, every single time. Coverage drops are the failure mode that matters, and they are invisible if you only read the findings summary. Watch the credentialed check status, the agent check-in dates and the count of hosts discovered but not scanned. A new subnet added by the network team, a firewall rule blocking the scanner, or an agent that stopped reporting after an upgrade all show up here first. Managed vulnerability scanning services normally include this reconciliation, and it is worth confirming that when you buy.
Where testing fits alongside scanning
Scanning tells you what is missing, and testing tells you what that means. A quarterly scan review with your own team, an annual penetration test of the systems that matter most, and a retest after significant change is a proportionate programme for an estate this size. If you are building the plan for the first time, ask us for a penetration testing quote covering your externally facing systems, then use the findings to decide whether the scanning schedule is aimed at the right places.
Frequently asked questions about scanning frequency
These questions come up whenever a scanning programme is reviewed.
Is continuous scanning better than scheduled?
For external assets, yes, because exposure changes unpredictably. Internally it mainly increases noise unless your remediation is fast enough to consume the extra data.
How long does a scan of 300 devices take?
An unauthenticated sweep runs in a few hours. Authenticated scanning takes longer, often overnight, because it reads a great deal from each host. Neither should need a maintenance window on hardware bought in the past few years.
