Why We Settled on a 5-Minute Scan Interval (Not 1 Minute)
Faster isn't always better. Here's the math behind detection latency, crawler footprint, and the tradeoffs with client budgets.
Clients regularly ask whether we can scan every minute or every 30 seconds. The honest answer is: yes, technically possible, but you wouldn't want us to.
Modern injected malware activates under specific session conditions. Scanning faster doesn't cause the malware to fire more often — it only multiplies the number of empty scans we run. At a 1-minute interval we would burn 5× more compute and catch zero additional incidents in our back-test dataset.
Five minutes is the inflection point at which mean time to detection (MTTD) stabilizes. Below it you pay more for diminishing returns. Above it (15 min, hourly), MTTD rises sharply for fast-moving skimmer families.
The five-minute cadence is also low enough to stay invisible to the attacker's session-tracking logic. Faster crawls start to look like a scraping bot and trip the malware's own anti-analysis checks.