How often should you scan your homelab for vulnerabilities?

Short answer: nightly. Long answer: it depends on what you're actually trying to catch and how much noise you can tolerate on the morning coffee. This is the realistic guide.

The three scan cadences that matter

Nightly (every 24 hours): The right default. Every major distro security advisory is published within a day of the upstream fix. Running nightly means a CVE that lands on Tuesday afternoon shows up in Wednesday morning's report. Couple that with a diff-from-yesterday view so you only see what's new, and you're not drowning in the same findings every day.
Weekly: Reasonable if you read reports yourself (no one else does) and you run a stable environment. A Proxmox cluster with a dozen LXC containers that never get new packages? Weekly is fine. You'll miss a four-day window during any given week, which is usually acceptable for homelab stakes.
Monthly or ad-hoc: Only if you're doing occasional audits and treating the homelab as a hobby, not a dependency. Fine for the box that runs Pi-hole and nothing else. Not fine for anything that holds data you care about, hosts services other people use, or sits on the internet.

What "nightly" actually costs

A full Noxen scan of 10 hosts (SSH inventory, port scan, TLS audit, HTTP header probes, admin-surface detection, CVE match) takes about 2–5 minutes, mostly waiting on port scan timeouts. At 03:00 local time, that's not going to wake up your router or eat your power bill.

CPU on the scanned hosts is effectively zero — Noxen is just running dpkg-query over SSH and connecting TCP sockets. If you can SSH into a box and run dpkg -l without noticing, the host can tolerate a nightly scan.

Signal per scan — what you actually find

On a fresh Ubuntu 22.04 homelab VM, an initial scan typically surfaces:

6–20 CVE findings in OpenSSL, libcurl, glibc, and whichever web stack is installed.
1–3 TLS posture issues on exposed HTTPS ports (weak ciphers, near-expiry certs, missing SANs).
0–5 HTTP header misses on anything running a web UI (missing CSP or HSTS almost everywhere).
0–2 exposed admin surfaces if you're self-hosting Grafana / Portainer / phpMyAdmin without fronting them with a VPN.

After that first scan, the signal drops. Nightly scans against the same host produce new findings only when something changes: a new CVE landed, a service was installed, a cert rotated, a port opened. That's the point — you want to know what moved, not what's the same as yesterday.

When to rescan immediately

After apt upgrade or dnf update on any host (to confirm the patch closed the CVE you expected).
After bringing a new service up (to confirm it didn't open ports you didn't mean to).
After a major upstream CVE announcement (OpenSSL, Log4j, sudo) — you want to see your exposure immediately.
After rotating an SSH key or TLS certificate (sanity check).

What a sensible cadence looks like in practice

Nightly full scans at 03:00 local time, via a LaunchAgent helper. Run while you sleep.
Diff-from-yesterday banner on your Mac when you wake up. Usually empty.
Monthly deep review on a Saturday morning — read the full cumulative report, plan patches.
Immediate manual scans after any significant change.

Noxen is designed around that exact pattern. Scheduled scans are configured in Settings → Scanning, the diff view is the default on launch, and "Scan now" is one click away from any host.