Hi,
Thank you for your post.
As far as I know, the bulletin advance notification is normally made available three business days before the regular security update release on the second Tuesday of the month. Upon release of the security updates, the bulletin advance notification is replaced by the security bulletin summary, which is the definitive announcement of the security update release for the month. But you can configure definition updates (via Client Security policy) to occur as often as once per hour. To prevent flooding the distribution server with update requests, Client Security agents use the service start time of the Antimalware service as the starting point for client updates.
Regard,
Nick Gu - MSFT