Home / Help centre / Scheduling & automation
Scheduling & automation
What's the difference between scheduled scans and CI-triggered scans?
Scheduled scans run a profile on a calendar rhythm that you set in the app. A CI scan runs when your pipeline calls the API, usually on a merge, and reports to the build log without failing the build. Use schedules for regular coverage and CI for per-change checks.
The short version
Both start the same kind of scan from a profile. They differ in what pulls the trigger: the clock, or your pipeline.
How it works in Cyberlop
| Scheduled scan | CI-triggered scan | |
|---|---|---|
| Trigger | A calendar: Once, Daily, Weekly, Monthly, Quarterly or Yearly | Your pipeline, for example on merge |
| Where you set it up | Scheduled Scans in the sidebar | Integrations, then a copied snippet |
| How it starts | At the start date and time, in the organisation timezone | A call to POST /api/ci/scan with a profile ID and a commit |
| Build impact | None | Non-blocking: it prints findings and never fails the build |
| Runs with | The profile you pick | The token owner's permissions and group scope |
The CI job then polls GET /api/ci/result/{scanId} every 30 seconds, up to 120 times, and prints each finding as a line with its severity, title and location. A scheduled run has no pipeline, so you read its results in the app.
The in-app guide describes the API token as carrying its owner's permissions and group scope. Treat the token like a password and keep it in your repository secrets.
What to do next
- Use a schedule when you want regular coverage whether or not the code changed.
- Use CI when you want a scan to follow each change you merge.
- Use both for the best coverage. Each run is a normal scan with a Trigger field on its Overview tab.
Setting up either? See how to schedule a recurring scan or how to trigger a scan from CI. Questions? contact us.
Related questions
- How do I schedule a recurring scan?
- How do I trigger a Cyberlop scan from my CI pipeline?
- How do I copy the ready-made CI workflow for my code host?
- How can I tell whether a scan was started by a schedule?
- Why did my CI job pass even though Cyberlop found critical issues?
How to add security scanning to your CI/CD pipeline
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.