Refresh by Risk Vector – Bitsight Knowledge Base

Compromised Systems, User Behavior, and Public Disclosure findings cannot be user-refreshed.

Risk Vector	Automated Refresh	User-Requested Refresh
SPF Domains	2 Weeks	1 Day
DKIM Records	30-50 Day	2 Days
TLS/SSL Certificates	60 Days	3 Days
TLS/SSL Configurations	60 Days	3 Days
Open Ports	30-60 Days	4 Days
Web Application Headers	60 Days	3 Days
Patching Cadence	30 days maximum. Many unresolved Patching Cadence findings are checked weekly.	Not applicable.
Insecure Systems	Daily	Not applicable.
Server Software	8 Days	2-3 Days
Desktop Software	Not applicable. This risk vector is not assessed using automated scans. Instead, our internal records are updated weekly based on data received from our partners. Learn how this risk vector is observed.	Not applicable.
Mobile Software	Not applicable. This risk vector is not assessed using automated scans. Instead, our internal records are updated weekly based on data received from our partners. Learn how this risk vector is observed.	Not applicable.
DNSSEC	2 Weeks	1 Day
Mobile Application Security	2 Weeks	6-11 Days
Web Application Security	60 Days	2 Days
DMARC	30 Days	3 Days
Domain Squatting	2 Weeks	Not applicable.

October 8, 2024: Domain Squatting scan frequency updated to be more accurate.
April 30, 2024: DMARC risk vector.
January 10, 2024: Mobile Application Security refresh from 10 days to 6-11 days.

Related articles