By default, traffic between the scanning servers and database is not encrypted. SQL Server Management Studio does give you the option to encrypt it. Microsoft has it's own documentation on how to encrypt a database connection here: https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/enable-encrypted-connections-to-the-database-engine?view=sql-server-2017