Skip to main content
Telivy checks a client in four different ways, and each runs on its own schedule. That explains most timing questions, such as why a client on monthly rescans gets new findings in week two, or why a device that was rescanned still shows last month’s software list.

On the computers

The Telivy Agent, installed on each Windows and Mac device, looks at what is on that machine.

From the outside

Everything visible to an attacker without touching a device: websites, mail records, exposed services, look-alike domains, breached credentials.

In the cloud

Microsoft 365 and Google Workspace accounts, permissions, and security settings.

Against threat data

New vulnerabilities published by the security community, compared against what Telivy already knows about the client.

​
The short version

​
How the automatic schedule works

Everything above runs on Telivy’s servers. Nothing needs to be set up on your side, and nothing depends on someone being logged in. A weekly run covers a lot of clients, so Telivy works through them in a queue and a single run can take hours to reach everyone. A client near the back of the queue is not stuck. If a scan is interrupted, Telivy retries it automatically.

​
On the computers: what the agent does

The Telivy Agent runs in the background on every Windows and Mac device where it is installed. It wakes up roughly once an hour, but it does not scan the device every time. On each wake-up, the agent:
1

Checks in with Telivy

This keeps the device’s online status and last seen time accurate in the portal.
2

Checks whether it should update itself

See Auto Update for how agent updates are handled.
3

Collects any instruction waiting for it

A rescan you requested, or one triggered by the client’s monitoring schedule, is picked up here. This is why a rescan reaches a switched-on device within about an hour rather than instantly.
4

Runs any collection that is due

Usually nothing is due and the agent goes back to sleep. The hourly cycle is kept light so it does not slow the machine down.

​
How often each type of data is refreshed

“On rescan” means the check runs when the agent is first installed, then again the next time a rescan happens, either because you asked for one or because the client’s monitoring schedule came round. A full endpoint scan is heavy, and installed software rarely changes from one hour to the next. Disk encryption is checked daily because it can be switched off at any moment, and insurers and auditors ask for it.
A device that is off, asleep, or away from the network when a rescan is triggered collects the instruction the next time it comes online. Its data arrives later than the rest, but nothing is lost.

​
From the outside: what Telivy checks without touching a device

These checks need no agent. They run against the client’s domain, any extra domains you have added, and any IP addresses on the assessment. All of this runs when an assessment is first created, again every week for any client with Risk Monitoring switched on, and any time a rescan happens. The weekly outside check does not depend on the cadence you picked. A client set to quarterly still has its external view, breach exposure, and look-alike domains refreshed every week.
Breach results are cached for a short period instead of being looked up again on every run. New breaches still show up within the weekly cycle.

​
In the cloud: Microsoft 365 and Google Workspace

If the client has a connected Microsoft 365 or Google Workspace tenant, Telivy reads its security configuration daily. That covers user accounts, multi-factor authentication, admin roles, dormant accounts, sharing settings, and tenant policy. For Microsoft 365, sign-in and audit activity can also be collected every hour where that capability is enabled for your agency. That is what makes event-based alerts such as repeated failed logins possible. Every few hours Telivy also tests that the connection still works. Connections expire or get revoked, usually after an admin password or consent change. When that happens, the assessment flags it so you can reconnect. Daily cloud scanning applies to clients with Risk Monitoring switched on. You can turn it off per client, separately from endpoint scanning, in the M365 monitoring and Workspace monitoring columns under Account → Usage. Many partners keep daily Microsoft 365 coverage while endpoints rescan monthly. See Microsoft 365 Security and Google Workspace Security for what is assessed.

​
Against threat data: why findings appear on their own

New findings can appear without any device being scanned again. Telivy keeps a record of what software each machine had at its last scan. Separately, it pulls in new vulnerability information every night, along with which vulnerabilities are being actively exploited in the real world and how likely each one is to be attacked. Once a week, Telivy re-compares the software it already knows about against that updated information. If a serious vulnerability is published for a browser version your client already runs, it appears in that weekly comparison without the machine being rescanned. A finding’s severity can rise or fall as the security community learns more about it, which is why a client’s numbers can shift slightly between rescans. Vulnerability Data Sources explains where this information comes from and how Telivy prioritizes it.

​
What you control

For each client you choose:
  • how often endpoints are fully rescanned (weekly, monthly, quarterly, or off), under More → Scan Settings on the assessment
  • whether Microsoft 365 and Google Workspace are monitored daily, with the M365 monitoring and Workspace monitoring switches under Account → Usage
Everything else runs on the shared schedule described above and is the same for every partner.

​
What a scheduled rescan covers

When a client’s cadence comes round, Telivy saves a snapshot of where things stand so you can see what changed, then refreshes the devices, the external view, and any connected cloud tenant. A rescan replaces the current findings rather than sitting alongside them. The history is kept separately, so you can still show a client how their position has moved over time.

​
FAQ

Three things run regardless of the cadence you picked: the weekly outside check, including breaches and look-alike domains, the weekly comparison of known software against new vulnerability data, and the daily Microsoft 365 and Google Workspace scans. Your cadence controls how often the computers themselves are fully rescanned.
Each agent collects new instructions on its hourly check-in, so give a switched-on machine up to an hour. Machines that are off, asleep, or away from the network will pick it up whenever they next come online, which is also why one or two devices often lag behind the rest.
No. It checks in every hour, which keeps online status current, handles updates, and collects any pending instruction. Only disk encryption is re-checked daily. Everything else, including installed software, saved passwords, and sensitive files, is collected on rescan.
Weekly for any client with Risk Monitoring switched on, and immediately whenever you run a rescan. New exposures also generate alerts if you have a dark web alert policy configured.
On the same weekly outside check. A newly registered domain impersonating your client typically surfaces within a week of registration, and can trigger an alert as soon as it is found.
Vulnerability information reaches Telivy overnight. It is compared against your client’s known software on the weekly pass, or straight away if you run a rescan before then.
Not the platform-wide ones. You control each client’s rescan cadence and their cloud monitoring settings. The rest runs on a shared schedule so that scanning load stays predictable for everyone.
No. They update the existing assessment and do not create a new billable one.
Interrupted scans are detected and retried automatically. If an assessment stays stuck for longer than a day, contact support@telivy.com.