Scheduled Scans
A scan you have to remember to run is a scan that stops happening after three weeks. Schedules keep regression coverage going on their own.
Why Schedule
- Catch regressions. A nightly scan of staging tells you which of yesterday's merges reintroduced something.
- Scan when nobody is watching. Deep policies are slow and noisy. Run them at 2am against an environment nobody is using.
- Produce evidence on a cadence. Auditors like to see that testing happens regularly, not just the week before the assessment.
Creating a Schedule
Two routes, both ending in the same place:
- From the scan wizard — on the Schedule step, choose to schedule recurring runs instead of (or as well as) running now. Everything you configured — target, discovery, auth, policy, scope — is carried into the schedule.
- From the Schedules screen — open Schedules in the sidebar and create one directly.
Recurrence Options
- Hourly or an interval in hours — for fast-moving environments.
- Daily — the usual choice, run outside working hours.
- Custom cron expression — for anything more specific, such as weekdays only, or the first of the month.
- One-off at a chosen date and time — a single future run that does not repeat.
Vooki Pro must be running for a schedule to fire. If the machine was asleep or the app was closed over a scheduled window, the next run is recalculated forward rather than firing a backlog of missed scans all at once.
Managing Schedules
The Schedules screen lists every schedule with its recurrence and its next run time. From there you can edit a schedule, pause it, run it immediately, or delete it. Completed runs appear in Scans like any other scan, and their findings flow into All Findings and the Dashboard trend.
Getting Notified
A scheduled scan nobody looks at is not much better than no scan. Connect Slack or a webhook under Integrations so a critical finding reaches the team without anyone having to open the application.
Practical Advice
- Schedule against staging, not production, unless you have built a custom policy specifically for it.
- Check the auth lifetime. A hardcoded token that expires next Tuesday means every scheduled scan after Tuesday runs unauthenticated and quietly finds nothing. Use OAuth2 client credentials where you can.
- Do not stack schedules. Two Deep scans firing at the same hour against the same host will fight each other for bandwidth and produce timing-based false positives.
- Start with Standard nightly and add a weekly Deep run, rather than running Deep every night.