Reconnaissance is the first step in most attack frameworks. It is the process of gathering information about a target in order to plan an attack. This information can include things like the target's network topology, IP addresses, and open ports.
In this case, the analyst has found that an IP address outside of the company network is being used to run network and vulnerability scans across external-facing assets. This is a clear sign that the IP address is being used for reconnaissance.