A method and apparatus for generating a reconnaissance index for a communications network is described. In one embodiment, scan detection data is initially received. A number of scan flows and a number of unique source Internet protocol (SIP) addresses initiating said number of scan flows is then identified from said scan detection data. Afterwards, a reconnaissance index is generated by utilizing said number of scan flows and said number of unique SIP addresses.