Abstract: A method for scanning hosts using an autonomous, self-destructing payload, deploying, by a computing device, at least one payload to at least one host, the at least one payload comprising at least one instruction to scan the at least one host for malicious activity, an instruction to produce and store in the memory of the at least one host an encrypted output file, and an instruction to delete the payload. The method includes disconnecting, by the computing device, from the at least one host. The method includes executing, by the at least one host, the payload, while disconnected from the computing device. The method includes reconnecting, by the computing device, to the at least one host. The method includes retrieving, by the computing device, from the at least one host, the encrypted output file. The method includes analyzing, by the computing device, the encrypted output file for evidence of malicious activity.