A method and a system scan a virtual machine (VM). The method stores a first copy of a scan token associated with a first scan operation within a VM and stores a second copy of the scan token in a database accessible by a management module. Upon restarting of the VM, a scan token in the restarted VM is compared with a scan token associated with the restarted VM in the database. The scan token in the restarted VM is current when the scan token in the restarted VM matches the scan token in the database. A first scan operation is resumed on the restarted VM when it is determined that the scan token in the restarted VM is current, and a new first scan operation of the restarted VM is initiated when it is determined that the scan token in the restarted VM is not current.