Each open source scanner is just as current as the database it last downloaded, and each updates differently. Check when your scanner last refreshed its data, and alert when it is stale. A clean result from an old database is not a clean bill of health.
Three examples of how data arrives
Trivy. Its vulnerability database is fetched automatically as needed, by default from a public registry mirror with a fallback. The documentation lists options to use alternative registries, skip the update, or download the database just, which are the controls you use in air gapped or cached setups.
OWASP Dependency-Check. It uses the NVD API. The README recommends an API key and warns that updates are extremely slow without one. A version upgrade can trigger a full data download on the next run.
Dependabot. Alerts follow the GitHub Advisory Database, and just reviewed advisories raise alerts. GitHub's documentation notes that new vulnerabilities can take time to appear and trigger alerts.
What can go wrong
- A cached database that is never refreshed in CI.
- A rate limit that makes the update step fail while the scan step still runs on old data.
- Air gapped mirrors that nobody updates.
- Advisory records that exist upstream but not yet in the source your tool reads.
How to check freshness
- Log the database timestamp or version in every scan output.
- Fail or warn when it is older than your threshold, such as a few days.
- Run a known vulnerable test project weekly and confirm it is flagged.
- Compare two scanners on the same project once a quarter and investigate differences.
Pair data with exploit signals
Freshness is half the job. CISA's Known Exploited Vulnerabilities catalog is available as JSON and CSV feeds, and FIRST publishes EPSS scores daily. Adding both to a script stack is possible, and it is another feed to keep alive.
Safeguard covers this ground with SBOM and dependency scanning, reachability analysis, policies and gates, and compliance evidence automation. Autonomous fix PRs are off by default, with every category set to Manual. You can try a free scan at gold.safeguard.sh/scan.
A simple freshness dashboard
You do not need a full tool. Write each scan's finish time and database version to a small table, one row per repository. A query that lists repositories whose last successful scan is older than your threshold becomes your freshness report. Send it weekly to the scanner owner. If a repository is missing from the table entirely, that is a coverage gap rather than a freshness gap, and it deserves its own line in the report.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how a new advisory reaches an existing inventory without a rescan, and compare that with a scheduled job.
Quick check
How often should a scanner database update?
At least daily for active projects, and your pipeline should record the database version in every result.
Can a scanner be accurate with an old database?
It can just report what it knew at the last update, so stale data hides new issues.
Sources
- Trivy vulnerability database configuration
- OWASP Dependency-Check README
- GitHub docs: about Dependabot alerts
- CISA Known Exploited Vulnerabilities catalog
- FIRST EPSS
Last reviewed: 19 October 2026.
