Scheduled scans

Scheduled scans

A scan you have to remember to run stops happening after a few weeks. Schedules keep regression testing going on their own: a nightly scan of staging tells you which of yesterday's merges reintroduced a bug, and a regular cadence gives auditors evidence that testing actually happens.

Create a schedule

  • From the scan wizard: on the Schedule step, choose a recurrence instead of, or as well as, Run now. Everything you configured (target, discovery, auth, policy, scope) carries into the schedule.
  • From the Schedules screen: open Schedules in the sidebar and create one directly.

Recurrence options: hourly or every N hours, daily, weekly, monthly, a custom cron expression (for example, weekdays only), or a one-off run at a chosen date and time.

Runs without the app open

Scheduled scans do not need the Vooki Pro window. A small background scheduler, started by your operating system for your user account, runs them. It uses launchd on macOS, a systemd user service on Linux and Task Scheduler on Windows. No administrator rights are needed.

  • It keeps running when the screen is locked.
  • It stops when you sign out, and starts again at your next sign-in. On Linux you can turn on Keep running after I sign out.
  • The computer must be on and awake. Nothing runs while it is off or asleep.

The Background scheduler card on the Schedules screen shows its state and has a button to start or repair it.

Missed runs

A run counts as on time if it starts within 15 minutes of the scheduled time. For later runs, choose under Schedules › ⋯ › If a scheduled time is missed:

  • Run it once when the computer is back (the default): the most recent missed run catches up once, if it is less than 24 hours old. You never get a backlog of scans firing at once.
  • Skip it: wait for the next scheduled time.

Managing schedules

Each schedule shows its recurrence, next run and last result: Completed, Failed, Missed, Cancelled, Interrupted or Blocked. Blocked means a check failed before the run started, most often an expired licence or a plan that does not include scheduled scans. You can edit, disable or delete any schedule.

Practical advice

  • Schedule against staging, not production, unless you have built a production-safe policy.
  • Check auth lifetimes. A hard-coded token that expires next week means every scan after that quietly runs logged out. Use OAuth2 client credentials where you can.
  • Do not stack schedules. Two heavy scans against the same host at the same time fight for bandwidth and cause timing-based false positives.
  • Start with Standard nightly and a weekly Deep run.
  • Connect Slack or a webhook so critical findings reach the team without anyone opening the app.

Full reference: Scheduled scans (docs)