Continuous Monitoring
Beyond scheduled scans: real-time detection of NEW threats. Sectora correlates external signals (CVE feeds, KEV updates, breach corpus) with your asset inventory and alerts when something changes.
Monitoring vs. scheduled scans
Scheduled scans are point-in-time — they run, find what they find, alert, sleep. Continuous Monitoring is event-driven — when something changes in the external threat landscape, it cross-references your inventory in real time.
External signals monitored
Alert events
- New CVE affects your stack — within an hour of publication.
- CVE you have just got KEV-listed — re-prioritise immediately.
- Employee email appears in breach corpus — leaked credential signal.
- New subdomain detected for your domain — potential shadow IT or DNS hijack.
- Asset cert expires soon — 30/14/7-day warnings.
- Stored token leaked via GitHub — Stripe/AWS/GitHub already detected + notified.
- Shield blocking surge — request volume above baseline indicating attack.
- DNS records changed unexpectedly — potential hijack.
How it differs from on-call
Traditional on-call alerts on YOUR system breaking. Sectora Monitoring alerts on THE WORLD breaking in ways that affect you. Both are needed.
Configuration
Settings → Monitoring → enable per-signal type, route to the appropriate channel. Default routing:
- New CVE affecting your stack → Slack #sec-alerts
- KEV update → PagerDuty + Slack
- Cert expiry warning → email + Slack (30 days), PagerDuty (7 days)
- Leaked credential → PagerDuty Sev2
- New subdomain → daily digest
Asset inventory tie-in
Monitoring is only as good as your inventory. Pair with ASMfor automatic asset discovery — otherwise you might not be alerted on a vulnerable asset you didn't know about.
What's next
- ASM — asset discovery feeding monitoring.
- Threat Intelligence — the underlying signal sources.
- Scheduled Scans — complements monitoring with regular re-scans.