How detection cycles work, real-time vs scheduled

“Real-time monitoring” is on every vendor page and is only true for some sources. Here is which, why, and what a sensible schedule looks like.

Real time

Certificate transparency logs. A new certificate for a lookalike domain shows up in the logs shortly after issuance, often before the site has content.

Asset checks. A link reported by a customer, a bot or your own tooling is checked on arrival.

Scheduled

New registrations. Registration data publishes on the registry’s cadence, not yours.

Social handles, replies and ads. Platforms are polled. Poll too fast and you hit rate limits, too slow and you are late, so the interval depends on the source and the platform.

App stores. Listings do not change by the minute, so a regular schedule is enough.

Rescans

First detection is not the end. Parked domains activate, removed pages come back and kits move. Open cases are rechecked until removal is confirmed, and a threat that reappears reopens the case. A monitoring product that detects once and stops misses the reactivation.

What to ask a vendor

• Which sources are real time, and which are polled?

• What is the polling interval for each?

• Are open cases rescanned, and how often?

Frequently asked questions

Does real time mean everything is instant?

No. Certificate logs and reported links are handled on arrival. Other sources are polled on a schedule that depends on the source and the platform’s limits.

Can we trigger a scan?

Reported links are checked on arrival through the bots, the dashboard or the API.

Want to see what is already out there? Get a free scan or book a demo.