How often should a small business scan for vulnerabilities?
For systems that face the internet, scan at least monthly, scan weekly if you can and scan again after any change. A scan describes one moment, and your exposure keeps changing after it. The more often you look, the sooner you find what changed.
Why a single scan ages quickly
- New weaknesses are published all the time. Software that was clean last month can match a newly published vulnerability today without anyone touching it.
- Your systems change. A new subdomain, a marketing page hosted by a vendor, a firewall rule changed for a quick fix, a certificate nearing its end date. Each is a small change, and each can open something.
- Attackers do not wait. Automated tools scan the internet continuously, so a new exposure can be noticed by others long before your next scheduled check.
What should trigger a scan outside the schedule
- a new website, subdomain or vendor-hosted page;
- changes to your firewall, router, DNS or email setup;
- moving to a new hosting provider or cloud account;
- a public announcement of a serious flaw in software you run;
- after fixing a finding, to confirm that it is really gone.
A sensible rhythm
- Minimum for most businesses: monthly.
- Many changes, or customer-facing applications: weekly.
- Cheap, passive checks such as email and DNS records: as often as you like, since they do not touch your systems.
- If a standard or contract applies to you, follow it and treat it as a floor. For example, the payment card industry standard asks for external scans at least every three months and after significant changes, using an approved scanning vendor. If you take card payments, check what applies to you.
Scan responsibly
Active checks, such as port scans, send real traffic to your servers. Only scan systems you are authorized to scan, and choose a provider that refuses to run active checks on anything you have not authorized. Check your hosting or cloud provider's rules about scanning, since some ask for notice. Where it matters, schedule scans for quieter hours.
Watch the trend, not just the number
A score or a list of findings on one day says little. What helps is the direction: whether new problems appear, how long they stay open and how quickly they get fixed. That record is also what an insurer or an auditor is most likely to ask about, so keep the history.
How Frontage handles it
You choose the day and time for each scheduled scan, and Frontage compares every scan with the last one so you review only what changed. It can email you when a new finding meets the severity you choose, and you can run a fresh check on demand after a fix.