Hello,
Check this Article:
Virus Definition Update FAQ http://www.symantec.com/docs/TECH103326
and
Check this Thread: https://www-secure.symantec.com/connect/forums/best-time-run-liveupdate
With SEP (and I assume all future versions) we release definitions three times a day.
There's no set time that we release defs on/by. We try to aim for early morning/noonish/later afternoon releases, but this obviously is at the mercy of QA...if we find that we've got broken definitions in one of the updates, the updates might be early morning/later afternoon/early evening, as an example.
By default, SEPM runs LiveUpdate every four hours...doing this means that it runs six times a day, with enough "overlap" to ensure that updates are downloaded near the time that they're released.
Full details on the releases can be found on the Multiple Daily Definitions - Detections Added page.
SEP 11 and SEP 12.1 have Multiple Daily Definitions (MDD's) so that even if a threat was first seen on the Internet that morning, by that afternoon or evening protection will be available.
Final note: once per month, there are large hub definitions which must be downloaded for SEP 11 and current releases of SEP 12.1. These will result in a spike of several GB for a day or two around the middle of the month, which is normal.
Reference: https://www-secure.symantec.com/connect/articles/how-big-are-current-symantec-endpoint-protection-definitions
Hope that helps!!