How often should attack surface discovery run?

Discovery should run continuously or frequently enough to detect changes between formal reviews. Internet-facing assets can appear whenever teams launch applications, change DNS, deploy cloud workloads or complete acquisitions. The right cadence depends on the organisation's rate of change and risk tolerance, but a one-time or annual scan will leave long gaps in visibility.