Record a checkpoint scan policy after the credential exposure