Continuous Endpoint Vulnerability Scanning Explained

Last updated: September 2, 2026

Cyrisma continuously evaluates every endpoint that has the Cyrisma agent installed in near real time. As an endpoint changes — a patch is applied, an application is updated, new software is installed — its vulnerability findings update automatically to reflect that new state. There is no separate vulnerability scan to create, configure, or schedule. Coverage begins the moment an agent starts communicating with the Cyrisma platform, and it stays current for as long as the agent keeps reporting.

What this means

  • Your vulnerability posture is always a reflection of how endpoints look now, not how they looked at the last scan window.

  • Onboarding is a single step: install the agent. Vulnerability findings typically show up in the platform within 5 minutes.

  • Endpoints stay lightweight. Cyrisma performs all vulnerability and risk analysis on the platform, not on the device.

How It Works

When a Cyrisma agent is installed and begins communicating with the Cyrisma platform, the endpoint is automatically included in Continuous Endpoint Vulnerability Scanning.

The agent captures a snapshot of the system information required for analysis, including information about the operating system, installed software, software versions, patches, and updates.

The agent securely sends this information to the Cyrisma platform. Cyrisma performs vulnerability and risk correlation server-side using relevant vulnerability intelligence, rules, and threat information. The analysis is not performed locally on the endpoint.

What It Identifies

Endpoint Vulnerability Scanning may identify:

  • CVEs affecting installed operating systems and applications

  • Root causes associated with identified vulnerabilities

  • Live detections and other risk-prioritization information