A build time scan reflects what was known on the day of the build. Advisories are published afterwards, against packages you already shipped. To stay informed, keep the SBOM or dependency list from each release and re-check it on a schedule, so a new advisory reaches you without needing a new build.
The snapshot problem
Think of the scan result as a photo. It is accurate when taken and slowly out of date after. The code did not change, but the knowledge about it did. A package that was clean in March may have an advisory in June, and your June build log still says "passed" for March's build.
What continuous re-scanning means
It does not mean rebuilding every day. It means:
- Store a dependency inventory or SBOM for each release you deploy.
- Compare that inventory against vulnerability data on a regular schedule, and whenever a notable advisory appears.
- When a match appears, tell the owning team with the affected version, where it is running, and the fix.
Build time versus continuous
| Aspect | Build time scan | Continuous re-scan |
|---|---|---|
| Trigger | A code change | Time, or new advisory data |
| Input | Fresh resolved tree | Stored inventory of what is deployed |
| Finds | Problems known at build time | Problems published later |
| Needs a rebuild | Yes | No, only to apply the fix |
| Typical owner | Developer | Security or platform team |
What you need to make it work
- An inventory per release. Without the SBOM, you must guess which version is in production. For the difference between SBOMs made at build and at runtime, see runtime SBOM vs build time SBOM.
- A map from release to environment. Which version runs where.
- An owner per service. So an alert goes to a person.
- A severity and reachability filter. So alerts are worth reading.
- A re-scan frequency you can defend. Daily is common for production services, but choose based on your risk and capacity.
Retention
Keep the stored inventories as long as the release can still be running anywhere, and for as long as your own policy or contracts require. Your compliance requirements, not a blog post, set the minimum.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how a stored inventory is matched against new data without a rebuild.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, continuous matching for new findings, zero-day discovery, and reachability analysis to prioritise what you see. You can try a free scan at gold.safeguard.sh/scan.
Quick check
How often should we re-scan deployed software?
Often enough that a serious new advisory reaches the owner within a timeframe you have set. Daily is a common starting point for production services.
Do we need to rebuild to re-scan?
No. You re-check the stored inventory. You rebuild only to ship the fix.
Last reviewed: 19 October 2026.
