Group assets by exposure and consequence
Start with an inventory identifying owners, internet exposure, purpose and dependencies. Separate public services, sensitive internal systems, user devices and operational technology. Two technically similar devices can need different schedules because they support different business activities and face different access paths.
Document an interval and its reasoning for each group. Exposed, fast-changing services may need more frequent assessment than stable restricted systems. Check contracts, regulatory obligations and internal requirements separately. A sensible local target is not automatically a requirement for every environment.
Add checks after meaningful changes
Scheduled scans can leave gaps after deployments or new disclosures. Define triggers for new public services, access-control changes and credible exploitation information affecting software you use. Identify potentially affected assets before selecting the safest useful check rather than automatically launching an indiscriminate full-estate job.
Include remediation validation. Assess after a patch, configuration change or required reboot rather than waiting blindly for the next routine cycle. Confirm the method can detect the original condition. Fresh evidence should support closure, especially when a service had immediate external exposure.
Measure coverage, not completion
A successful job does not prove complete coverage. Review unreachable hosts, failed authentication, exclusions and missing targets. Compare results with inventory sources. Give collection failures an owner; otherwise a device that repeatedly fails assessment can disappear from the team's interpretation of the dashboard.
Agents need heartbeat, assessment freshness, supported versions and connection checks. Installed but silent agents provide no current assurance. Investigate stale records and separate retired devices from active systems with broken reporting. Do not improve the coverage percentage by deleting unexplained missing devices.
Make the schedule safe
Agree windows, intensity and escalation contacts with owners. Operational technology, medical equipment and fragile systems need explicit operational approval. Vendor guidance, controlled trials or alternative methods may be necessary before active scanning. Document stop conditions and the person who can authorise a pause.
Review after exposure, architecture or use changes. Track freshness, authentication success and validation delays with counts. If frequent jobs fail or disrupt services, fix the method and ownership problem. More scheduled activity is not progress when it cannot produce dependable evidence safely.