Recurring Scans & Monitoring
Set up automated scans so you're notified when your attack surface changes, not weeks after.
A one-time scan tells you where you stand today. Recurring scans tell you when something changes. When a new subdomain appears, a port opens unexpectedly, or a certificate is about to expire, you hear about it right away instead of finding out during an incident.
Setting up a schedule
Open your domain, go to the Recurring Scans tab, and click + Create Recurring Scan. Select the modules you want to run, set the execution order if there are dependencies (e.g. run Subdomains before Ports), and pick a frequency: daily, weekly, or a custom interval.
Save the schedule and it runs automatically from that point on.
How alerts work
Each time a recurring scan completes, RiskShelter compares the results to the previous baseline. You only get notified about what's new:
- A subdomain that wasn't there before
- A port that was closed and is now open
- A Critical or High CVE that wasn't in the last scan
- A certificate that's now within 30 days of expiring
This keeps notifications meaningful so you're not getting alerts about things you already know about.
Scan history
The Recurring Scans tab also shows a log of every past run: when it started, how long it took, whether it completed or failed, and a summary of new findings compared to the previous scan. You can click into any historical run to see its full snapshot.