How often does a vulnerability scan run?

The Alert Logic® scanner checks in periodically. If it has the capacity and there are hosts to scan, a new single-host scan will begin. A single-host scan is then created and the scanner will execute that scan. Although there is no fixed order of hosts that Alert Logic scans, the scanners do pick the most valuable scan targets first.  

The current order of valuable targets scanned is:  

1. Hosts added for immediate scan by the Alert Logic console or API—in the order that they were added
   
   
2. Hosts that were in the process of being scanned, but had a scan canceled mid-scan (usually because the scanner was terminated)—from least-recently scanned to most-recently scanned
   
   
3. Hosts that have never been scanned—from ones that were discovered earliest to most recent
   
   
4. Hosts that have been recently rebooted (AWS and/or Azure)—from earliest to most recent
   
   
5. Hosts whose scans failed for a reason that is not related to the scanners (such as backend problems, scan job aborted, etc.)—from least-recently scanned to most-recently scanned
   
   
6. All other eligible hosts-from least-recently scanned to most-recently scanned