Apparatus and the methods for security scanning. The apparatus may include a data collection machine. The data collection machine may be configured to transmit an executable file, from an enterprise monitoring process, to a computing machine. The computing machine may be set to be accessed only by a group of users. The computing machine may be a machine that does not have a pipeline to the Internet. The data collection machine may be configured to cause the computing machine to execute the executable file. The data collection machine may be configured to derive, from an output of the executable file, a monitoring condition in the computing machine. The enterprise monitoring process may be a process that includes only individuals that may be not part of the group.