Scheduling periodic and incremental scans
Recurring scans, monitored branches and incremental re-analysis of only what changed.
Periodic scans keep an up-to-date view of vulnerabilities, which matters because both the codebase and the scanner rules change over time.
Scheduled, monitored and incremental scans are only available for Git repositories. None of them are supported for ZIP uploads — an archive has no remote commit identity to compare against.
The scanning modes
| Mode | Behaviour |
|---|---|
| Once | A single run, now. |
| Daily / Weekly / Monthly | The first scan runs immediately on setup; every subsequent scan runs at the same interval, based on the initial run time. |
| Monitor Changes | An initial full scan of the target branch, then hourly checks for new commits. When the branch moves, only the changed files are fetched and analysed. |
| Incremental Scan | A one-off scan of what changed since the last successful scan of the same repository and configuration. |
| Custom Scope | Scans only the files and folders matching the patterns you supply. |
Setting up a scheduled scan
- 01Open the Static Analysis tab
- 02Choose the scan frequency
Daily, weekly or monthly.
- 03Submit
The first scan runs immediately; the schedule follows from that run time.
Repository monitoring
The Monitor Changes mode performs an initial full scan of the target branch and then checks hourly for new commits. If the branch has moved, only the modified files are downloaded and an incremental scan runs against them.
How the comparison point is chosen
Standard Git scans are pinned to an exact commit SHA, and become eligible history checkpoints once they finish successfully. A newly created monitor adopts the newest compatible checkpoint before deciding whether a diff scan is needed — so setting up monitoring on a repository you have already scanned does not re-analyse the whole tree.
An Incremental Scan is a one-time user action rather than a schedule. It finds the newest compatible successful static scan for the same repository and configuration, and uses that run's source SHA as the comparison checkpoint.
This is what makes per-commit AI analysis affordable: a re-scan costs what the change costs, not what the codebase costs.
Managing scheduled scans
To view or edit existing scheduled scans, use the Saved Scans drop-down at the top of the Static Analysis section and select the configuration you want to review or adjust.
The equivalent for dynamic and infrastructure scans is described in Schedule the scan.
Last reviewed 2026-08-16