As new viruses and other Internet threats are written, released to the public, and discovered, Trend Micro collects their tell-tale signatures and incorporates the information into the virus and other pattern files.

Trend Micro updates the file as often as several times a week, and sometimes several times a day when people release multiple variants of a widespread threat. By default, IWSVA checks for updates every hour. If a particularly damaging virus is discovered "in the wild," or actively circulating, Trend Micro releases a new pattern file as soon as a detection routine for the threat is available (usually within a few hours).