An approach to handling connection errors between an external antivirus server and a storage device is disclosed. The storage device is equipped with an internal antivirus server. Antivirus metadata that describes the antivirus scan is stored in an antivirus metadata repository on the storage device. The connection between the external antivirus server and the storage device is monitored. The external antivirus server executes the antivirus scan on the storage device. If the connection fails, control of the antivirus scan is passed from the external antivirus server to the internal antivirus server. The internal antivirus server determines where to begin based on the antivirus metadata. When the connection is restored, control is passed back to the external antivirus server.