If you have on-access scanning enabled, SAV scans every file accessed after it is loaded early in the boot process (prior to standard startup objects).
It checks for updates continuously; the interval is usually set to hourly, but is adjustable from the AutoUpdate preferences. The first update is run shortly after the boot process completes.
SophosLabs releases approximately 6 detection updates per day, spaced about 4 hours apart.
Sophos Engineering releases monthly roll-ups of this data along with detection engine updates.
Sophos releases major product updates approximately every 6 months, with point updates as needed.
All of these updates are managed by Sophos AutoUpdate.
I hope this answers both your question and the question behind your question.
-
Andrew
Threat Researcher
SophosLabs
For our other self-service and peer-to-peer online support systems:
