Branch periodic scans

Branch periodic scans establish the security baseline for every onboarded repository. Branch periodic scans run automatically at a fixed interval against the scanned branch, evaluate the existing codebase with every enabled Cortex Cloud Application Security scanner, and convert detections into issues. Use branch periodic scans to answer one question with evidence: which repositories are fully scanned, and what did the most recent scan find.

The Branch Periodic Scans inventory presents scan results and supports rescanning; the inventory does not resolve issues. Issue resolution occurs in the dedicated issue inventory for each issue type.

Prerequisites

Prerequisite	Requirement
Application Security module	The Cortex Cloud Application Security module is active for the tenant
VCS integration	At least one Version Control System integration (GitHub, GitLab, Bitbucket, Azure Repos) is connected, and the integration instance status is Connected
Repository onboarding	At least one repository is onboarded through the VCS integration. A repository that is not onboarded is never scanned and produces no row in the scan inventory
Scanner enablement	At least one scanner (IaC, SCA, Secrets) is enabled in the repository scan configuration. A repository with every scanner disabled produces no findings
Application Security Periodic View permission	Required to view periodic scan results
Application Security Periodic View/Edit permissions	Required to trigger a rescan. A user holding only the view permission can read scan results and must escalate a rescan to a user holding the edit permission

Core achievements

• Establishing a defensible baseline: Converting the committed state of every scanned branch into a measured posture rather than an assumed one
• Reducing silent coverage gaps: Distinguishing a repository that scanned clean from a repository whose scanner never executed
• Routing detections to remediation: Directing each issue category to the issue inventory that owns resolution for that category
• Restoring failed coverage: Diagnosing scan failures to a specific cause — permission, token, clone, connection, or webhook — and correcting the cause rather than repeating the failure

Shift-left position

Branch periodic scans are the baseline enforcement point in the shift-left lifecycle (IDE → PR → CI → Periodic → Runtime). A finding blocked at pull request scan or CI scan never reaches the periodic scan baseline. A finding that does reach the periodic baseline represents risk already committed to the scanned branch. Treat a growing periodic baseline as a signal to strengthen enforcement at the pull request stage.

Core concepts

Branch periodic scans have four concepts that shape accurate risk assessment.

• Scan signals: Scan health shows execution status. Scan status applies only to CI and pull request scans
• Coverage: Inventory rows represent scan results, not total onboarded repository coverage
• Findings and issues: Findings are detections. Issues are policy-matched records for remediation
• Urgency: Not every issue carries Urgency. Supported issues receive Urgency on the next periodic scan cycle

Refer to Reference A: Branch periodic scan concepts for details.

How to access branch periodic scans

Under Modules select Application Security → Branch Periodic Scans.

Workflow

Follow the workflow to review scan results, validate coverage, and route issues for remediation.

Open the Branch periodic scan workflow.

References

Use References for detailed scan information, such as inventory table attributes, scan health values, health error types and more.

Next step

Branch periodic scan workflow.