Why does a scan show a support staff name under Run by?

Why this happens

The Run by column normally shows the email of the person who started the scan. When Cyberlop support staff start one, the cell reads the support name, a dot, then an email address.

Support work in your workspace runs inside a support session, which has a start, an end time and a stated reason, and the Activity feed records each session. Checking takes a minute.

How to fix it

Nothing needs fixing. A few steps confirm that the run was expected.

1. Open Activity in the sidebar.
2. Type the support name or the words Support Session into the search box.
3. Find the Session Start · Support Session entry. Its chips show an Until time and a Reason, such as a ticket number.
4. Match the reason to a request you or a colleague sent.
5. Look for the matching Session End · Support Session entry, which shows the session has closed.

The same actor format appears in the Activity feed for other actions the support user took, so one search finds every step of the session.

Still not working?

If you cannot match a support run to any request, ask your administrator first. Then write to /contact with the scan ID and the time shown in the Activity entry.

For the other entries you may see, read what support session entries mean.

Related questions

• What is a Support Session entry in the activity feed?
• How do I see who started a scan?
• How do I see what's been happening in my workspace?
• How do I search the activity feed for a person or action?
• How do I find out who cancelled or deleted a scan?

Full tutorial

Cyberlop activity feed: what it records and how to use it for audits

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre