When a security tool fails silently, nothing alerts, so the dashboard shows calm instead of a problem. The cure is a heartbeat: each tool proves it ran, and a separate check raises an alert when the proof is missing. Alert on absence, not only on findings.
The problem with quiet
A vulnerability scanner that stops running reports zero new findings. A log shipper that crashes sends zero suspicious events. An agent that loses its credentials posts nothing. In every case the output looks like good news.
This is a cousin of failing open. The tool does not grant access, but it quietly removes your ability to know. A clean report only means something if you know the scan actually ran against everything it should have. See a clean scan does not mean your software is safe.
Three kinds of heartbeat
Liveness. Did the job run at all? Each scheduled scan, backup or collector writes a timestamp or pings a monitor when it finishes. If no ping arrives within the expected window plus a margin, alert.
Coverage. Did it look at everything? Compare the count of repositories, hosts or images scanned with the count that exist in your inventory. A drop is a signal.
Volume. Is the data flow within its normal range? A log source that usually sends thousands of events an hour and now sends none is suspicious, even if the process looks alive. Set a floor, not just a ceiling.
Make the watcher independent
The check must not depend on the thing it watches. If the alert for a dead log pipeline is itself delivered through that pipeline, it will never fire. Use a separate path: a different monitor, a different notification channel, ideally a different failure domain.
Also watch the watcher. A single dead man's switch that pages a person once a day when it stops is simple and hard to break.
Practical setup
- List your security jobs and agents: scanners, collectors, backup jobs, policy engines.
- For each, write the expected interval and who owns it.
- Emit a success signal at the end of each run, not the start.
- Alert when the signal is late, with a short runbook.
- Add a monthly test: stop one tool on purpose and confirm the alert reaches a human.
Step 5 is a small chaos experiment, one of the five first security chaos experiments.
Where Safeguard fits
Safeguard offers continuous monitoring and asset discovery, which help you compare what exists against what is being scanned. You still need your own liveness checks for the jobs and pipelines you run yourself.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how monitoring reports on what changed between scans, and think about which signal would tell you a scan did not run.
Quick check
How late is too late for a heartbeat?
Set the alert at the expected interval plus a margin for normal variation. For a daily job, a few hours of grace is typical.
Is zero findings ever a warning sign?
It can be. If a source that usually reports something goes to zero, check that it ran before you celebrate.
Last reviewed: 19 October 2026.
