AI-Powered Network Security Audits Without Data Exposure.
NSAuditor AI is an open-core, AI-powered network security audit platform that runs agentless, read-only, and entirely on your infrastructure. Nothing is installed across your estate, credentials are read-only by design, and nothing goes to Nsasoft. Beyond the scan’s own traffic (your targets and local segment, DNS, your own cloud’s APIs) and NIST’s public NVD API for CVE matching (off with NSAUDITOR_OFFLINE_ONLY=1 and a local NVD store), every outbound path is opt-in and off by default.
With 56 plugins for networks and AWS, Azure, and GCP, one scan delivers risk-scored security findings, exploit-first prioritization using CISA KEV and FIRST EPSS, MITRE ATT&CK mapping, and auditor-ready evidence mapped to 8 compliance frameworks: SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2.
Evidence packs include SHA-256 chain-of-custody manifests and opt-in RFC 3161 trusted timestamps. Operator-held Ed25519 signatures can be verified offline. NSAuditor AI supports air-gapped environments and reports evidence gaps explicitly—never claiming an unassessed surface is secure.
One scan. Technical security assessment. Eight compliance frameworks. Verifiable evidence. Zero data exfiltration.
An open-core scanner with risk-scored findings, threat intelligence, and octa-framework compliance evidence — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2 — built so your audit trail holds up to a CPA-firm review, a QSA RoC walkthrough, an ISO Stage 2 assessment, a CIS-CAT self-attestation, and a GDPR Article 32 review.
Risk-Scored Prioritization
Every finding carries a composite risk score — severity × exploitability × impact × exposure — so the queue sorts worst-first, and an operator suppression workflow tracks accepted-risk and false-positive dispositions with expiry.
Findings are mapped to MITRE ATT&CK techniques with kill-chain context, so you can show your CISO what an attacker would actually do — not just CVE noise.
One scan produces eight auditor-ready evidence packs: SOC 2 (AICPA TSC 2017), HIPAA §164.312 Technical Safeguards, NIST CSF 2.0, PCI DSS v4.0.1 (sub-requirement-level for QSA RoC; every citation derived from the standard itself), ISO/IEC 27001:2022 (per-Annex-A-code with Statement of Applicability discipline), and CIS Critical Security Controls v8 (per-Safeguard with the Implementation Group cumulative discipline — IG1 cyber-insurance baseline / IG2 / IG3; no-certification-body attestation via CSAT / CIS-CAT Pro), and GDPR Article 32 (Security of Processing — infrastructure substrate for Art. 32 only, not GDPR compliance; 4/5/2 across 11 sub-measure units), and NIST SP 800-171 Rev 2 (evidence substrate for CMMC Level 2 preparation — all 110 Rev 2 requirements enumerated; 2/49/59). SHA-256 chain-of-custody sidecars you can verify offline, and opt-in outbound push to Vanta, Drata or Secureframe. No BAA with Nsasoft required.
A network security audit is a systematic review of your network — hosts, ports, services, configurations, and cloud accounts — to find vulnerabilities, misconfigurations, and compliance gaps before an attacker does.
NSAuditor AI runs that audit locally: it discovers live hosts and services, fingerprints them with safe, non-destructive probes, matches those versions against CVE data offline, maps each finding to MITRE ATT&CK, and generates auditor-ready evidence for eight frameworks — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2 — from a single scan. Unlike SaaS scanners, every step runs on your own infrastructure, so a complete network security audit happens with zero data exfiltration.
Need cloud coverage? NSAuditor AI Enterprise extends the audit across AWS, GCP, and Azure with the full octa-framework compliance engine, air-gapped operation, and continuous monitoring (CTEM).
Watch: how do you actually run a network security audit on a cloud account in 2026?
A seven-minute how-to in six steps: scope it before you scan, use read-only credentials, check the scan actually audited, read the findings the way your auditor will, hand over what you did not examine too, and let the auditor verify it with standard shasum and openssl. English captions. Also on YouTube.
Three editions
Free, Pro, and Enterprise
Start with the MIT-licensed Community Edition. Upgrade only when you need CVE matching and risk-scored prioritization, compliance evidence, or cloud scanners.
EE 2.1.0 — Node.js 24.22.1, unread cloud inventories as evidence gaps, regions the account has not enabled, the scan_host time limit, saved requests and multi-entry titles; paired with Community 1.1.0
A scan that could not read part of your cloud should not read as clean. Node.js 24.22.1 or newer is the supported runtime — the October 2026 Node.js security release for the 24 line. The cloud inventories the scan could not read in full — GCP instances, Azure virtual machines, the AWS EC2 feed of the CIS hardened-image census — are evidence gaps, not empty projects or subscriptions, and a listed AWS region the account has not enabled is skipped and recorded as not enabled, not reported as missing trails or as a permission to grant, wherever the account’s enabled regions can be read. Through the MCP server (Community 1.1.0), a host scan stops at a total time limit by default and names the plugins it did not run, a response saved with NSA_MCP_RESPONSE_DIR keeps its request beside it for verify-call, and a CRITICAL, HIGH or evidence-gap title in scan_cloud says when its finding holds more than it shows. Of the ten CVEs the October 2026 Node.js advisory lists, eight name the 24.x line, four of them high, among them a Brotli decoder out-of-bounds write (CVE-2026-111497); below 24.22.1 a scanned host that answers with crafted Brotli reaches that decoder, because Community’s web-application detector, its UPnP device-description fetch and plugin 050 read a target’s HTTP bodies through Node’s fetch. Reachable is not exploited. When the GCP security audit (1021), the Azure security audit (1022) or the EC2 instance auditor (1210) could not read its instance or VM inventory in full, the CIS hardened-image census used to read as complete; each now records one evidence gap that fails CIS v8 Safeguards 4.1, 4.2 and 4.6, with its cause as a class, never error text, and the CIS report names which cloud’s inventory is short and why. Wherever ec2:DescribeRegions can be read, an all-regions AWS scan walks the regions the account has enabled, for every AWS plugin; a listed region the account has not enabled is not called but recorded as not enabled, an evidence gap, instead of an access-denied finding that told the operator to grant the audit role, and CloudTrail no longer reports, at CRITICAL, no trails visible in a region it never read. An Azure scan with no subscription id reports its four plugins down with the cause, so Azure no longer reads as audited; a GCP scan with no project or no loadable credentials reports the GCP security audit down with its cause, so its controls fail closed as not measured. Through the MCP server, scan_host stops at a total time limit (SCAN_HOST_WALL_MS, 50 seconds by default) and names the plugins it did not run; with NSA_MCP_RESPONSE_DIR set, each saved response keeps its request beside it, and nsauditor-ai mcp verify-call checks both; a scan_cloud CRITICAL, HIGH or evidence-gap title ends (+N more via get_findings) when its finding holds more entries than the title shows, and a get_findings category filter that matches nothing returns the categories the scan does hold. The drift file now names a control as having lost measurement from each scanner that stopped measuring it, with the scanners named in sources, so a second gap on a control that already carried one is no longer silent. And the 31 AWS SDK clients are locked at one version, and the Google Cloud and Azure SDKs move to their current majors.
Where it stops, stated: when ec2:DescribeRegions is denied, the enabled set is unknown, so a listed region is scanned as before. While a census gap from 1021, 1022 or 1210 stands, Community’s report --since sets aside that plugin’s rows, so a new CRITICAL from the same plugin does not read as new in that comparison. A GRC push sends a census gap as a failed control, and scan_cloud lists the new gaps without their cause, which is in the compliance pack only. Lost measurement is judged per scanner, not per scope: a scanner whose gap on a control widens does not lose measurement there again. The two measured limits stated since Enterprise 1.3.0 still hold: a scan made before 1.3.0 could not record a plugin left out of it, and a scan that found its ports with the Nmap plugin (024) alone has no port oracle, so include the port scanner (003) in the scans you compare. Enterprise Edition 2.1.0 is the current release, published 2026-10-26 alongside Community Edition 1.1.0 and the agent-skill package 1.1.1. Coverage: all eight coverage matrices unchanged since EE 2.0.0.
29 Enterprise auditors, 56 plugins overall, all eight frameworks. The Community Edition floor is 1.0.0 or newer — install Community Edition first. Enterprise 2.1.0 runs on Node.js 24.22.1 or newer; upgrade both packages together, with Community 1.1.0 for the MCP changes: npm i -g nsauditor-ai@1.1.0 @nsasoft/nsauditor-ai-ee@2.1.0. Install Node.js 24.22.1 or newer first: on an older runtime npm prints an EBADENGINE warning and installs anyway, and the air-gap install.sh refuses. Enterprise 2.1.0, like 2.0.0, imports a name that first ships in Community 1.0.0; below it Enterprise’s core does not load while its plugins still do — on Community 0.2.57 as on 0.2.56 — so the scan skips its intelligence, analysis-agent and compliance stages. Do not name an older Community in the same npm install -g command as Enterprise: npm then nests a second Community under Enterprise, and Enterprise’s stages are skipped with no message and no compliance report. Install the paired versions together, or Community first. Compared across the upgrade, a GCP evidence gap from 2.0.0 reads resolved and a new one opened, once: its sentence no longer carries the error text. See the Enterprise plugin catalog →
Full release history: the Enterprise page and the package changelogs on npm.