Nothing obvious. I think Apple's policy is to be non-drama-queeny about it.
A process called xProtect runs and phones Apple Towers, but the only reason I know is Little Snitch alerting me. If the check box is checked, it is automatic. Basically, as long as you are on the Net you will be up-to-date within 24 hours max.
After a bit I will just tell LS to let it through, but I like to watch stuff for a few iterations before I do that (that approach also showed just how often Google s/w phones home!).