When you enable real-time security risk scan, it continuously runs in the background of your Portal. Similarly, scheduled scans occur automatically according to the configured schedule. You can disable real-time and scheduled scans without affecting your scan configuration settings. When you decide to resume real-time scanning, simply re-enable the scan.
If you disable real-time scanning, background scanning and file blocking will not occur, which will make your Portal vulnerable to infection. If you disable scheduled scanning, scanning and blocking of your SQL content store will not occur. Disabling scheduled scanning makes your system vulnerable to infected files being stored on your SharePoint servers.