Scan on every pull request, rescan your deployed inventory at least daily, and review the results weekly. Pull request scans catch new risk you introduce. Daily rescans catch new advisories on code you already shipped. Scanning only at release leaves a gap you cannot see.
Why two triggers are needed
Risk enters in two ways. You add or change a dependency, which a change time scan catches. Or a vulnerability is published for a package you already use, which no code change triggers. Only a scheduled rescan of your stored inventory finds the second kind.
Cadence by trigger
- Pull request: Stop new risk early, Every change
- Main branch build: Record what shipped, Every merge
- Inventory rescan: Catch new advisories, Daily
- Human review: Decide and assign, Weekly
- Deep review: Trends, policy tuning, Monthly or quarterly
Is daily too often?
The scan itself is cheap when it reuses a stored inventory and only compares against fresh advisory data. The cost is attention. Send alerts only for findings that cross a rule, such as new critical and reachable, so daily scanning does not become daily noise.
What if you scan less often
Weekly scans are not unreasonable for a low risk internal tool. For anything internet facing, a gap of a week means a newly published exploitable flaw can sit unseen for days after exploitation begins. Decide based on exposure, and write the decision down.
Do not forget the places code lives
Production images, long lived branches, and archived services still run. Include them in the rescan set or explicitly retire them.
Setting alert rules
Daily scanning needs a daily filter. A reasonable start is to notify the owning team only when a new finding is critical or high, has a fix, and is reachable or known to be exploited. Everything else lands in the weekly review. After a month, check how many alerts led to action. If most did not, tighten the rule. If incidents were missed, loosen it.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a new advisory surfaces on a project nobody changed.
Where Safeguard fits
Safeguard supports dependency scanning and continuous monitoring of stored inventories. Try the free scan for a first snapshot.
Quick check
Is scanning on every commit necessary?
Scanning on every pull request is enough for new risk. Scanning each commit adds cost with little gain.
Last reviewed: 19 October 2026.
