I have a database for a chat app to which users can upload images. These images get scanned before they are made available to other users in a conversation. But when the antivirus gets an update, should I rescan images which have already been uploaded (or maybe only those that haven't been viewed by every member of the conversation yet), or just leave it be and only scan images that will be uploaded in the future with the updated antivirus?
Rescanning everything would be costly, and if the chances of an exploit in an image emerging and being used before the antivirus is updated are low, then does rescanning make sense? And if it does, which images do you advise me to rescan?