Security scanner working procedure?

I had a call with CheckMarx customer care.

He mentioned that if the submitted org is in queue then it is not yet scanned. So on the time of scanning whatever code available in the org will be scanned regardless of queue.

ie)Checkmarx report contains the time it started scan. That is the version scanned at that moment.