Currently, Security for Confluence scans:
Note that comments, drafts, and macro bodies are not yet scanned.
Security for Confluence creates a user who is a member of the
confluence-administrators group so that all Confluence content can be scanned. See What's the soteri-security User? for more information.