"Real time" in a security product has no fixed meaning. It might describe how fast an event is seen, how fast data is ingested, how fast a rescan runs or how fast an alert reaches you. Ask which step it refers to, what the typical and worst delay is, and how the vendor measures it.
A pipeline, not a single speed
From a new vulnerability or malicious release to a notification in your inbox, several steps occur, each with its own delay:
- The source publishes the advisory or package.
- The vendor ingests and normalises it.
- The vendor matches it against your inventory.
- The product decides whether it matters to you.
- A notification is sent and you see it.
A vendor can truthfully call step 2 "real time" while step 3 waits for a nightly job. The claim and your experience can then differ by a day.
Questions that pin it down
| Question | What a clear answer looks like |
|---|---|
| Which step is real time? | A named step with a stated typical delay |
| What is the worst case? | A figure, plus what causes it |
| Is matching event driven or scheduled? | Event driven, or a stated interval |
| How is delay measured? | From source publication to your alert |
| What happens during an outage? | Backlog is processed, with a notice |
Avoid accepting "seconds" without a start and end point.
Measure it yourself
You can time the pipeline on public events without any special access.
- Choose a recent public advisory that affects a package in your test repository.
- Note when the advisory was published, using the source's own timestamp.
- Note when each tool under test first showed it for your repository.
- Repeat for three or four advisories over a week, ideally on different days.
- Compare the median and the longest delay, not the best case.
Include a weekend event if you can. Delays often grow outside working hours.
Also ask about delivery
An alert that arrives in a dashboard nobody opens is not real time for you. Check the channels: email, chat, ticketing and webhook. Test each one with a real alert and note how long it takes to arrive. Check whether you can set thresholds so urgent items interrupt people and others wait for a digest.
Try it yourself
Click through it at your own pace, or open it full screen.
Notice how the timeline separates when something is published, when it is matched to your software and when you are told.
Where Safeguard fits
Safeguard offers zero-day discovery and continuous monitoring of your inventory. As with any vendor, time it against public advisories on your own repository rather than relying on a label. A free scan is available at gold.safeguard.sh/scan.
Quick check
Is a few minutes of delay acceptable?
It depends on your risk and process. What matters is that you know the number and it fits how fast you can act.
Can a daily scan still be useful?
Yes, for steady state hygiene. For fast moving exploitation, ask about event driven matching as well.
Last reviewed: 19 October 2026.
