Thank you for reaching the community forum, Yes, only system apps cannot be scanned by default since their protected by the android OS but plugins can be scanned.to further understand the scanning functionality of our Sophos Mobile, you may refer to this Documentation.