Failed or incomplete scans
Why an external or internal scan ends as Failed or Partial or does not start, what each message means, and how to run it again.
- Updated October 12, 2026
- Verified on RECON v3.3.0
- 6 min read
A scan can fail to start, stop halfway or finish with incomplete results. This guide helps you recognise which case you are in, for external scans and for internal scans with the Scout probe, and pick the right fix.
Symptoms
In the scan list every scan has a status:
| Status | Meaning |
|---|---|
| Pending | the scan is waiting to start (the name of the current phase may appear instead) |
| In Progress | the scan is running |
| Analyzing | an internal scan has finished and RECON is still processing the results |
| Completed | the scan finished successfully |
| Partial | the scan finished, but part of the analysis did not succeed |
| Failed | the scan did not produce reliable results |
| Cancelled | you cancelled the scan |
Other common symptoms:
- a scan stays In Progress much longer than usual;
- when you create an external scan, the message "Insufficient Cyber Tokens" appears;
- an internal scan does not start and an error message appears, or Run scan is disabled;
- an internal scan shows the Scan failed panel with the reason;
- an internal scan finds fewer devices than expected.
Causes
External scans
- One of the core discovery phases (subdomain enumeration, DNS resolution, HTTP service probing) failed: the scan is Failed.
- No host resolved during the scan, yet public DNS resolves the names: this is a temporary resolution problem and the scan is Failed.
- A secondary discovery phase (technology detection, TLS analysis or page crawling) failed: the scan is Partial.
- Your Cyber Token balance does not cover the selected domains.
Internal scans
- The probe is not online when you start the scan, or stops reporting during the scan.
- The probe cannot reach the target networks.
- Another scan already covers the same networks on the same probe.
- You already have 5 scans queued or running.
- The probe licence has expired, its capacity is exceeded, or the owner has not shared the licence with you.
- The scan runs past its time limit, or the probe hangs during the scan.
Solutions
External scan Failed
An external scan is Failed when one of the phases the whole analysis depends on does not succeed. A typical case: subdomains are found but none resolves during the scan, while public DNS resolves them. That is a temporary issue, not a problem with your domain.
Run the scan again with Rescan from the scan menu. Like every run, the new scan uses Cyber Tokens for each domain.
External scan Partial
The main discovery succeeded, so the results are usable, but a secondary analysis (technologies, TLS or site pages) did not complete. If you need complete results, use Rescan.
Scan stuck In Progress
For an external scan that is In Progress or Pending and not moving, open the scan menu and choose Restart: the scan goes back to the queue and starts again. You can also choose Cancel scan: for external scans, the Cyber Tokens charged are credited back.
Restart does not apply to internal scans: use Rescan to run them again.
Insufficient Cyber Tokens
Each domain in an external scan costs 90 Cyber Tokens at the end-user price, or 50 Cyber Tokens at the partner price (1 Cyber Token = 1 euro). Top up your balance and try again. If creating the scan fails after the charge, RECON credits the tokens back automatically.
Internal scan does not start
| What you see | What to do |
|---|---|
| Run scan is disabled | the probe is not Online: follow the offline probe guide. If the probe is shared with you, the owner may not have shared its licence |
| "A scan already covers one of these networks. Wait for it to finish or confirm the overlap." | wait for the running scan on the same probe to finish, or confirm the overlap |
| "Could not start the scan. Please try again or contact support." | make sure you do not already have 5 scans queued or running, then try again |
| a message about the probe licence | the licence has expired, the capacity is exceeded or it is not shared with you: follow the licence capacity guide |
An internal scan accepts up to 10 target networks.
Internal scan Failed
Open the scan: the Scan failed panel shows the reason.
| Reason shown | What to do |
|---|---|
| "Probe disconnected" | the probe stopped reporting during the scan: bring it back online, then use Rescan |
| "Probe never connected" | the probe never sent a heartbeat: finish the installation |
| "All networks unreachable" | none of the target networks responded: check the networks you chose and install a probe on the right segment |
| "No valid networks" | the scan had no valid network ranges: fix the target networks |
| "The scan timed out before completing." | the scan ran past its time limit: scan fewer networks at a time or spread them across several probes |
| "Probe stopped responding mid-scan" or "Probe unresponsive" | use Restart probe from the probe card menu, then run the scan again |
| "Incomplete results" or "Scan results could not be processed." | run the scan again; if it happens again, contact support |
Internal scans started from RECON use the standard mode: the probe closes the scan within about 55 minutes and uploads what it has collected. If RECON has not received the results 60 minutes after the start, the scan is marked as timed out. If a probe reports that it is scanning but makes no progress for about 25 minutes, RECON closes the scan as hung.
Few devices or networks not covered
In the internal scan, the Network reachability panel shows the status of each network:
| Status | Meaning and fix |
|---|---|
| Reachable | network covered at full depth |
| No live hosts | network reachable and scanned, no host responded |
| Unreachable | the probe cannot reach the network (a different subnet or a firewall): install a probe on that segment |
| Throttled | the gateway firewall rate-limited the probe: allow the probe or add a probe on the segment |
| Blocked | the gateway firewall blocked the probe: allow the probe or add a probe on the segment |
| Partial | large network, the gentle scan did not finish: add a probe on the segment |
| Coverage not established | the probe found a route but never completed a sweep: a count of zero hosts is not a clean result |
If an IDS, IPS or NAC filters the probe's traffic, add the probe host to those systems' exceptions.
Prevention
- Before starting an internal scan, check that the probe is Online.
- Install a probe in every network segment you want to scan in depth.
- Allow the probe on firewalls, IDS, IPS and NAC.
- Keep an eye on your Cyber Token balance before creating external scans on many domains.
Contact support
If a scan keeps failing after these checks, contact Orizon support with the scan name, the date and the status shown.