> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans.md).

# Branch periodic scans

Branch periodic scans are automated checks that assess the security posture of applications and infrastructure. These scans run at regular intervals using supported and enabled Cortex Cloud Application Security scanners. You can analyze scan details directly from a dedicated inventory table, including code context, scan date, health, detected findings, and generated issues.

## Prerequisites

| Prerequisite                                              | Requirement                                                                                                                                                     |
| --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Application Security module**                           | The Cortex Cloud Application Security module is active for the tenant                                                                                           |
| **VCS integration**                                       | At least one Version Control System integration (GitHub, GitLab, Bitbucket, Azure Repos) is connected, and the integration instance status is **Connected**     |
| **Repository onboarding**                                 | At least one repository is onboarded through the VCS integration. A repository that is not onboarded is never scanned and produces no row in the scan inventory |
| **Scanner enablement**                                    | At least one scanner (IaC, SCA, Secrets) is enabled in the repository scan configuration. A repository with every scanner disabled produces no findings         |
| **Application Security Periodic `View` permission**       | Required to view periodic scan results                                                                                                                          |
| **Application Security Periodic `View/Edit` permissions** | Required to trigger a rescan. A user holding only the view permission can read scan results and must escalate a rescan to a user holding the edit permission    |

## Core achievements

* **Establishing a defensible baseline:** Converting the committed state of every scanned branch into a measured posture rather than an assumed one
* **Reducing silent coverage gaps:** Distinguishing a repository that scanned clean from a repository whose scanner never executed
* **Routing detections to remediation:** Directing each issue category to the issue inventory that owns resolution for that category
* **Restoring failed coverage:** Diagnosing scan failures to a specific cause — permission, token, clone, connection, or webhook — and correcting the cause rather than repeating the failure

#### Shift-left position

Branch periodic scans are the baseline enforcement point in the shift-left lifecycle (IDE → PR → CI → **Periodic** → Runtime). A finding blocked at pull request scan or CI scan never reaches the periodic scan baseline. A finding that does reach the periodic baseline represents risk already committed to the scanned branch. Treat a growing periodic baseline as a signal to strengthen enforcement at the pull request stage.

## Core concepts

Branch periodic scans have four concepts that shape accurate risk assessment.

* **Scan signals:** Scan health shows execution status. Scan status applies only to CI and pull request scans.
* **Coverage:** Inventory rows represent scan results, not total onboarded repository coverage.
* **Findings and issues:** Findings are detections. Issues are policy-matched records for remediation.
* **Urgency:** New issues receive Urgency on the next periodic scan cycle.

Refer to [Branch periodic scan concepts reference](/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references/reference-branch-periodic-scan-concepts.md) for details.

## How to access branch periodic scans

Under **Modules** select **Application Security** → **Branch Periodic Scans**.

## References

Use [References](/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references.md) for detailed scan documentation.

## Next step

[Branch periodic scan workflow](/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/branch-periodic-scan-workflow.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.