Best practice is to run vulnerability scans at least once a month and always after major system updates, new deployments or configuration changes. High-risk environments, such as those handling sensitive customer data, often use continuous or weekly scanning to ensure issues are spotted quickly.