See the general instructions for running ecomscan for the first time.
Magento Cloud has read-only storage, which is good practice from a security perspective. However, since eComscan uses auto-update to always have the latest detection capabilities, eComscan needs to be installed on a writable partition of your server.
For Magento Cloud, there is a writable section under /mnt/shared/. You can use this to install eComscan:
mkdir -p /mnt/shared/$USER/sansec curl -sL https://mageintel.com/ecomscan/ecomscan-linux_amd64.gz |gzip -d> /mnt/shared/$USER/sansec/ecomscan chmod 755 /mnt/shared/$USER/sansec/ecomscan
To set up continuous monitoring, you should request special CRON access with Magento here: https://cloud.magento.com/project/<id>/setup/project_details
Once that is enabled, you can install a cron in your repository, as described here: