Thanks for all the responses, very helpful. This article by Mick was of particular interest:
http://www.symantec.com/connect/articles/how-big-are-current-symantec-endpoint-protection-definitions
I'm comfortable with the idea of hub defs being downloaded once a month, however it would help if I could be sure roughly what time of day or night this is likely to happen. My LUAs are configured to check for updates once per hour to ensure the SEP11 clients get updates as quickly as possible.
If a hub definition set were to be downloaded during office hours that could impact Internet access for users. So, is it possible to know if Symantec always release hub defs during the night (UK time), or is it random timing?
Thanks