AI-Powered Network Security Audits Without Data Exposure.
NSAuditor AI is an open-core, AI-powered network security audit platform that runs agentless, read-only, and entirely on your infrastructure. Nothing is installed across your estate, credentials are read-only by design, and every outbound path is opt-in and off by default.
With 56 plugins for networks and AWS, Azure, and GCP, one scan delivers risk-scored security findings, exploit-first prioritization using CISA KEV and FIRST EPSS, MITRE ATT&CK mapping, and auditor-ready evidence mapped to 8 compliance frameworks: SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2.
Evidence packs include SHA-256 chain-of-custody manifests and opt-in RFC 3161 trusted timestamps. Operator-held Ed25519 signatures can be verified offline. NSAuditor AI supports air-gapped environments and reports evidence gaps explicitly—never claiming an unassessed surface is secure.
One scan. Technical security assessment. Eight compliance frameworks. Verifiable evidence. Zero data exfiltration.
An open-core scanner with risk-scored findings, threat intelligence, and octa-framework compliance evidence — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2 — built so your audit trail holds up to a CPA-firm review, a QSA RoC walkthrough, an ISO Stage 2 assessment, a CIS-CAT self-attestation, and a GDPR Article 32 review.
Risk-Scored Prioritization
Every finding carries a composite risk score — severity × exploitability × impact × exposure — so the queue sorts worst-first, and an operator suppression workflow tracks accepted-risk and false-positive dispositions with expiry.
Findings are mapped to MITRE ATT&CK techniques with kill-chain context, so you can show your CISO what an attacker would actually do — not just CVE noise.
A network security audit is a systematic review of your network — hosts, ports, services, configurations, and cloud accounts — to find vulnerabilities, misconfigurations, and compliance gaps before an attacker does.
NSAuditor AI runs that audit locally: it discovers live hosts and services, fingerprints them with safe, non-destructive probes, matches those versions against CVE data offline, maps each finding to MITRE ATT&CK, and generates auditor-ready evidence for eight frameworks — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2 — from a single scan. Unlike SaaS scanners, every step runs on your own infrastructure, so a complete network security audit happens with zero data exfiltration.
Need cloud coverage? NSAuditor AI Enterprise extends the audit across AWS, GCP, and Azure with the full octa-framework compliance engine, air-gapped operation, and continuous monitoring (CTEM).
Start with the MIT-licensed Community Edition. Upgrade only when you need CVE matching and risk-scored prioritization, compliance evidence, or cloud scanners.
Enterprise Edition 0.44.0 is the current release, published 4 September 2026 alongside Community Edition 0.2.51 and the agent-skill package 0.2.49. A finished scan now becomes a report a consultant can send. nsauditor-ai report --from <run> --format executive turns a completed run into a self-contained, print-ready HTML report that opens with no external network reference, with optional cover-page branding via --brand; --format jira writes a Jira-importer CSV, whose field mapping is completed inside Jira and is not verified against a live Jira instance. Pro and Enterprise tiers.
The report states what it could not read. It carries a container census: if finding-like records sit in a place the report does not read, the report says so on the page, named and counted. Silence is disclosed, never rendered. And an audit-trail gap now means both trails are missing — S3 server access logging being off is no longer reported as a gap when a CloudTrail data-event trail already covers that bucket. Coverage is judged per selector, and organization trails and prefix-scoped selectors are refused rather than assumed, so there are fewer false findings and the ones that remain are real.
29 Enterprise auditors, 56 plugins overall, all eight frameworks; every coverage matrix is unchanged this cycle. The Community Edition floor is unchanged at 0.2.49 or newer — install Community Edition first. Previously — EE 0.43.0 (2 September 2026): a cloud provider whose scanner did not run is reported as not audited, with the reason stated and its findings absent rather than empty, so the provider summary describes precisely what was scanned. See the Enterprise plugin catalog →
Full release history: the Enterprise page and the package changelogs on npm.