Safeguard rescans most asset types on a default schedule tied to events (a push, a publish, a feed update) plus periodic checks, and you can tune the interval under Policies, then Scan Policies, in the web app. The mobile app is in early access beta; this post does not claim you can edit schedules from it.
What is the mobile app's status?
The Safeguard mobile app for iOS and Android is early access, in beta. We have not confirmed that scan schedules can be created or changed from the phone, so this post stays with what the documentation does describe: where schedules live and how they behave. If your team uses the beta, check inside the app for what it offers today.
What are the default schedules?
Safeguard's Continuous Scanning page lists default rescan triggers:
- Source repositories: every push, plus an hourly pull for missed hooks.
- Container images: on push, and every 4 hours for running images.
- Packaged artifacts: on publish, and on vulnerability feed updates.
- AI models: on publish, plus weekly re-validation.
- SBOMs, yours and vendors: on upload, plus hourly feed-driven rescoring.
- Kubernetes workloads: on admission, plus every 15 minutes of runtime reconciliation.
- Vendors: on SBOM upload, and on SLA expiry, which is configurable.
The page says most teams should leave the defaults on.
How fast do new advisories reach findings?
The same page gives median times from trigger to scored findings: a new CVE in NVD in under 2 minutes, a CISA KEV addition in under 60 seconds, an EPSS change above 0.1 in under 5 minutes. Treat these as the vendor's stated medians, not guarantees for your account.
How do you change the frequency?
Under Policies, then Scan Policies:
- For sensitive production assets, set
scan.interval: 5mon the asset labelcriticality:sensitive. - For development and sandbox assets, set
scan.interval: 24h. - For vendors, set SLA-driven rescans in the Third Party Risk Manager.
Choose intervals by consequence. A five minute interval costs more compute and produces more alerts than a daily one, so apply it where a delay in noticing would hurt.
How do you get alerts to the right place?
Alerts route by owner, severity band, exploitation status (KEV, EPSS above 0.7, or a public proof of concept) and environment. Routes are set under Settings, then Notifications. The page lists Slack, Teams, Discord, Jira, Linear, Azure Boards, email digests, PagerDuty, OpsGenie and generic webhooks as destinations.
Routing is where a scan schedule becomes useful. A fast schedule with every alert going to one inbox just makes the inbox louder.
What about air-gapped environments?
The docs say signed vulnerability snapshots ship on a schedule you choose: hourly, daily or weekly.
What are the limits?
The Continuous Scanning page says the /v1 REST endpoints, including its webhook example, are not yet available and return 404. Check the API Reference for what is supported now. Also, this page describes platform behavior; do not assume every control shown there is available on every client.
What to do
- Open the Continuous Scanning docs and note which defaults apply to your asset types.
- Leave defaults on unless you have a reason.
- Label your sensitive production assets and set a tighter interval for them only.
- Set daily intervals on sandbox assets.
- Configure alert routes by owner and severity before shortening any interval.
- If you use the mobile beta, check what it exposes today and report gaps through your usual support channel.
Quick check
Can I set scan schedules in the mobile app?
We have not confirmed this. The mobile app is early access beta. The documented place to tune schedules is Policies, then Scan Policies, in the web app.
Should I scan everything every five minutes?
No. Reserve short intervals for sensitive production assets. The defaults already rescan on pushes and feed updates.
Sources
Last reviewed: 18 October 2026.
