Stop Testing Once a Year: Continuous Security with Scheduled Scans

Point-in-Time Assessment Is a Lie

Here's the uncomfortable math of traditional security assessment: you test once a quarter, or once a year, and the report describes your attack surface at that moment. Then the developers ship a new API without a security review. Someone stands up a staging environment on a domain that resolves publicly. A third-party service starts exposing an endpoint you forgot existed.

All of that happens in the weeks after the report was written. By the time the next test rolls around, the report is a historical document about a perimeter that no longer exists.

This is why the security industry is moving from point-in-time assessments to continuous monitoring — and why XnoleX ships scheduled scans as a first-class feature.

The Machine Can Do the Testing Part

The insight behind scheduled scanning is simple: the part of a pentest that's automated — reconnaissance, host discovery, HTTP probing, vulnerability template matching — doesn't need a human in the loop every time. It needs to run on a schedule, at scale, and report what changed.

XnoleX schedules are built on standard cron expressions, so the cadence is as flexible as you need it to be:

0 * * * *      Every hour (at minute 0)
0 0 * * *      Every day at midnight
0 0 * * 1      Every Monday at midnight
0 0 1 * *      First day of every month

Configure a schedule once — target, engine, and frequency — and scans run automatically at that interval. No dashboard babysitting, no calendar reminders, no "did anyone run the scanner this month?"

Picking the Right Engine for the Job

Not every scheduled scan should be a full assessment. XnoleX exposes three engines so you can match the workload to the goal:

• full — the complete pipeline: subfinder, nmap, httpx, nuclei. Best for comprehensive scheduled assessments of critical domains.
• subdomain — attack-surface mapping without vulnerability scanning. Ideal for frequently detecting what changed in your perimeter.
• nuclei — direct vulnerability scanning on known targets. Perfect for fast re-checks after a change or an incident.

A sensible pattern: a weekly full scan on production domains, a daily subdomain scan to catch new hosts the moment they appear, and a nuclei re-check on a specific target right after you ship a change.

The Cron Grammar, Briefly

Schedules use standard 5-field cron syntax:

Each field supports specific values (0, 15, 30), wildcards (*), and steps (*/15). That's the same syntax you already know from crontab — there's nothing new to learn.

Managing Schedules Without Losing Control

Continuous monitoring needs off-switches. XnoleX schedules support the full lifecycle:

• Pause and resume — set is_active to false to pause a schedule without deleting it, and flip it back to resume.
• Run now — trigger a schedule immediately without waiting for the next cron tick. Manual triggers respect your tier's concurrent-scan limit.
• Delete — remove a schedule entirely when a target retires.
• Tracking — each schedule records last_run_at and next_run_at, so you always know when the next assessment fires.

Every run also respects the platform's concurrency controls, so scheduled scans can never silently pile up beyond your limits.

What Changes When Assessment Becomes Continuous

Moving from annual tests to scheduled scans doesn't just change frequency — it changes the questions you can answer:

"What changed since last week?" Instead of wondering what the perimeter looks like today, you compare scans. A new subdomain, a new endpoint, a new technology — the diff between two runs is the changelog of your attack surface.

"Is this fix actually deployed?" After remediation, the next scheduled scan confirms the finding is gone. Continuous scanning turns verification from a manual step into an automatic one.

"Are we getting better or worse?" Severity counts across successive scans show the trend. One bad week becomes visible in the data instead of surfacing months later in an audit.

The Takeaway

Your attack surface changes every week. Your security assessment should too.

Scheduled scans replace the annual point-in-time test with a living baseline — the same automated pipeline, running on your cadence, catching new exposure the week it appears rather than the quarter after. Set up the schedule once, and the hardest part of continuous security becomes the part that's already automated.