Rescan sweep
Every 6 hoursFinds every subscription whose next scan is due and queues it. The due date was set by the grade of the last scan, so the schedule tightens on its own when a site gets worse.
Continuous monitoring A scan is a photograph.
A scan is a photograph.
Monitoring is the film.
Your security posture changes without you touching anything — a dependency gets a CVE, a certificate lapses, someone ships a config change on a Friday. Monitoring re-runs the full check suite on a schedule that follows your risk, and tells you when something moves.
Set up monitoring →Rescan frequency follows your grade
A fixed weekly scan is wrong in both directions: too noisy for a site that is fine, too slow for one that is not. After every scan, the next one is scheduled from the grade it produced.
A Every 14 days
B Every 7 days
C Every 7 days
D Every 3 days
F Every 3 days
A CVE match against your stack overrides all of this and queues a rescan immediately, whatever your grade.
Three things run on their own
CVE check
Daily, 06:00 UTCPulls newly published CVEs from the NVD, matches them against the technology stack detected on your last scan, enriches each match with an EPSS exploitation-probability score, then queues an immediate rescan and alerts you.
Certificate expiry
Daily, 07:00 UTCReads the TLS expiry recorded on your most recent scan and fires at 30, 14 and 7 days remaining — each threshold once per certificate, so a renewal resets it and a stalled one keeps escalating.
Why EPSS and not just CVSS
A CVSS score says how bad a vulnerability would be if exploited. It says nothing about whether anyone is actually exploiting it. Sort a CVE feed by CVSS and you get a list topped by theoretical 9.8s that no one has ever weaponised, while the 6.5 being sprayed at every host on the internet sits halfway down.
EPSS — the Exploit Prediction Scoring System — estimates
the probability that a given CVE will be exploited in the wild in the next
30 days. SecScan pulls it from api.first.org for every match and
ranks your alerts by severity and that probability together, so what
surfaces first is what is most likely to actually happen to you.
What you get told about
- New CVEs affecting your detected stack. Matched by technology, not by guessing from your domain name.
- Regressions. A finding you had fixed coming back, or a grade dropping between scans. This is the one that catches Friday deploys.
- Certificate expiry at 30, 14 and 7 days.
- Every completed rescan, with the full AI-written report.
Alerts arrive by email, and by webhook if you configure one. The webhook payload is Slack-compatible, so a Slack incoming webhook URL works with no adapter in between — paste it in and alerts land in a channel.
Monitoring draws on the same daily scan budget as manual scans — 10 scans a day anonymously, 50 with an account. A subscription schedules recurring scans, so it is checked against that budget when you create it, not silently exempted from it.
What it does not do
Monitoring re-runs the same black-box checks on a schedule. It does not watch your source repository, your CI pipeline, or your dependency manifests — if a vulnerable package is installed but never reachable from the outside, an external scanner will not see it, and neither will this. It is the outside view, taken repeatedly.
Free during early access
Monitoring and scanning are both free while SecScan is in early access.
Start monitoring →