An initial software scan is performed to detect a set of software deployed on an endpoint. An ongoing scan of the endpoint is performed to map a set of file directories associated with each software within the set of software. Via the ongoing scan, a usage frequency for each mapped file directory is determined. A heat map is generated for each mapped file directory, according to usage frequency, using a randomized meta-heuristic. A request is received for a software discovery scan result. The software discovery scan, based on the heat map, is performed in response to the request. The result of the software discovery scan is provided to a user.