A security scan is run against every website every 24 hours. This scan checks the active plugins and themes of the WP install and using the https://wpvulndb.com/ API determines whether plugin/themes need to be updated or not. We  recommend that you keep all the plugins updated so as to minimize security threats.