Automated Security Scanning

FortWatch runs on the schedule you set. Most customers run weekly full scans with daily lightweight checks on critical assets, but you can pick daily, weekly, monthly, or a custom cron expression per asset. If you want continuous coverage, schedule overlapping scanners so there's always fresh data — port discovery one day, CVE scanning the next, SSL checks the day after.

Yes. Every schedule is timezone-aware and supports cron expressions, so you can run scans at 2 a.m. local time, only on weekends, or during your regular maintenance window. Per-asset overrides let you run noisy scanners on low-traffic assets and quiet scanners on production without touching a single config file.

A full FortWatch scan runs across 11 scanners covering CVE detection, open port discovery, service fingerprinting, SSL/TLS certificate and cipher analysis, DNS and email security records, cloud exposure checks, subdomain enumeration, web exposure, HTTP security headers, directory brute force, and technology fingerprinting. Each scanner produces findings that are deduplicated, severity-tagged, and AI-triaged before you see them.

FortWatch scans external attack surface, so scanners hit public endpoints the same way any internet user would. Rate limiting is built in per asset, and aggressive scanners (directory brute force, web exposure) are off by default. You can cap concurrency per workspace, and scheduled scans default to off-peak windows so legitimate traffic always takes priority.

Every finding is run through AI triage before it reaches your dashboard — context from the asset, the CVE, and the actual response is checked for known false-positive patterns. You can also mark findings as false positive once, and FortWatch suppresses the same signature on future scans for that asset. Suppressions are audited, so nothing gets silently hidden.

A single-asset scan typically finishes in 3 to 15 minutes depending on which scanners are enabled and how large the target is. Port scanning and CVE detection are the fastest; directory brute force and subdomain enumeration are the slowest. Parallel scanning means adding more assets doesn't linearly add time — a 20-asset scan usually completes in under an hour.

Yes. Any Owner, Admin, or Manager can run an on-demand scan from the asset page with one click. Manual scans don't interrupt the schedule — they run in parallel, and results are merged into the scan history. This is useful after a deployment, a certificate rotation, or when you're verifying a fix.

FortWatch diffs the new scan against the previous one, flags net-new findings, and sends alerts based on severity. Critical and high findings trigger email or webhook notifications immediately; medium and low findings appear in the daily digest. Every finding includes an AI-written explanation, affected asset context, and a remediation suggestion so you can act without leaving the dashboard.