Real-time antivirus scanning vs. scheduled scans – what’s it all about?

Periodically, clients will inquire about the configuration settings of our ManageSuite managed antivirus platform. With this service, we have enabled both real-time scanning and scheduled scanning.

Real-time scanning is exactly that – it’s scanning that runs in the background and checks files in “real time” when they are created, opened, copied, and saved.

Scheduled scans are a necessary part of ensuring the continuous health of your system. On a regular basis, they thoroughly check your systems for viruses and other threats.

The challenge with scheduled scans is timing them when systems will be available. Ideally, all systems would be scanned during off-business hours to limit any potential performance hit from affecting a user’s ability to work. Servers tend to be on and available 24 hours a day, 7 days a week, 365 days a year, so we typically run scans at the most convenient time – over the weekend in the early morning hours. However, not all desktops are available on weekends, and laptops often spend their weekends completely unreachable in their laptop bags or otherwise offline.

Therefore, we schedule desktop and laptop scans when the odds are highest they will be available, but when the scan should be least impactful to the user. We regularly review the schedules and make the necessary adjustments to increase effectiveness while decreasing the potential impact on system performance.

The reason for the need to run these scheduled scans is two-fold. First, scheduled scans run against all files stored on the device, so a scheduled scan is the best way to check for potential dormant threats. Antivirus software use “definition files,” which are updated regularly. These files contain a database of identified malware and the tool compares files against the known threats to see if any match. We recently onboarded a new client during which our first scheduled scan found remnants of a malware event that dated back to 2015 that their prior vendor failed to fully remediate!

Second, if your business operates in a regulated industry and requires oversight by external auditors, they love this stuff and will require scheduled scans because it’s the right thing to do. In summary, like oatmeal, it’s good and it’s good for you.