AI-Powered Network Security Audits Without Data Exposure.
NSAuditor AI is an open-core, AI-powered network security audit platform — the modern successor to our classic network security auditor for Windows. Run a full network security audit with risk-scored findings, MITRE ATT&CK mapping, and seven-framework compliance evidence — SOC 2 (AICPA TSC), HIPAA §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, and GDPR Article 32 — running entirely on your infrastructure. Your data never touches our servers.
An open-core scanner with risk-scored findings, threat intelligence, and hepta-framework compliance evidence — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, and GDPR Article 32 — built so your audit trail holds up to a CPA-firm review, a QSA RoC walkthrough, an ISO Stage 2 assessment, a CIS-CAT self-attestation, and a GDPR Article 32 review.
Risk-Scored Prioritization
Every finding carries a composite risk score — severity × exploitability × impact × exposure — so the queue sorts worst-first, and an operator suppression workflow tracks accepted-risk and false-positive dispositions with expiry.
Findings are mapped to MITRE ATT&CK techniques with kill-chain context, so you can show your CISO what an attacker would actually do — not just CVE noise.
A network security audit is a systematic review of your network — hosts, ports, services, configurations, and cloud accounts — to find vulnerabilities, misconfigurations, and compliance gaps before an attacker does.
NSAuditor AI runs that audit locally: it discovers live hosts and services, fingerprints them with safe, non-destructive probes, matches those versions against CVE data offline, maps each finding to MITRE ATT&CK, and generates auditor-ready evidence for seven frameworks — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, and GDPR Article 32 — from a single scan. Unlike SaaS scanners, every step runs on your own infrastructure, so a complete network security audit happens with zero data exfiltration.
Need cloud coverage? NSAuditor AI Enterprise extends the audit across AWS, GCP, and Azure with the full hepta-framework compliance engine, air-gapped operation, and continuous monitoring (CTEM).
Start with the MIT-licensed Community Edition. Upgrade only when you need CVE matching and risk-scored prioritization, compliance evidence, or cloud scanners.
EE 0.32.10 — the advisory gate now audits what a customer installs
Enterprise Edition 0.32.10, published 3 August 2026 alongside Community Edition 0.2.35 and the agent-skill package 0.2.33. Plugin count and framework count are unchanged — 28 cloud plugins, 55 in total, seven frameworks. The SOC 2 matrix is now enumerated in full at 10 covered · 4 partial · 37 out of scope = 51; no control changed status.
The gate had been measuring the wrong tree. The check that has to pass before a release ships was running against the maintainer's development tree while describing itself as the production closure. Those are not the same software. It now packs the tarball, installs it into an empty directory the way a customer does, and audits that instead.
The two answers barely overlap. The development tree carries 25 advisories, 8 of them high severity. What a customer actually installs carries 6, none of them high. Across 26 advisory packages the two lists share 5, and not one of the shared ones is high severity — every high the old gate reported was development-only, and every number it published described software no customer receives.
It will not report clean without an answer. A gate that cannot reach an advisory database can return an empty result that looks exactly like a clean one, so the empty result is no longer allowed to pass as clean: the run has to prove a database actually answered before any verdict is reported. Alongside it, the SOC 2 matrix is now enumerated in full — 10 covered, 4 partial, 37 out of scope, 51 in total — which is enumeration completeness rather than a coverage change, since no control changed status and no routing moved. The other six matrices are unchanged. The Type II write-up now states which of its mechanisms are reachable from a shipped entry point and which are built but not reachable.
Verified on the published bytes. Installed from the packages as published, all 28 enterprise plugins load active, and a three-cloud scan produced a 76-file evidence pack per cloud.
Previously — EE 0.32.9 · 29 July 2026
Internal engineering identifiers are out of the report. A compliance report is a document you hand your auditor, so it should read like one. Ours had been carrying internal engineering identifiers — roadmap ids, internal release stamps, the name of an internal audit review — in finding titles, on the attestation cover page, and in the chain-of-custody record. Measured on a rebuilt three-cloud evidence pack, 686 unexplained internal-marker occurrences went to 0 across 105 files, with a positive control in the same run (3,572 benign matches still detected) so the zero is a measurement rather than an absence of looking.
A cloud that could not be scanned no longer reads clean. When a cloud plugin could not start — an optional SDK absent, credentials unusable — it refused to report, and that refusal evaporated one layer up: the compliance report came out byte-identical to one where the scanner ran and found nothing. Ten controls read PASS, with no violation and no warning. The dangerous shape is an ordinary one: AWS and GCP scan for real, Azure's SDK is absent, and the combined pack reads as a clean three-cloud audit. Now every in-scope control of a cloud that could not be scanned carries a fail-closed evidence gap.
Also in that release: an archived scan re-processed by the new build warns instead of failing clean; four report surfaces that contradicted each other on trusted timestamping — which remains on the roadmap, not in this release — now say the same verifiable thing; and in the Community Edition, --out <dir> no longer writes to the parent directory when the directory name contains a dot.
Upgrading from 0.32.8: the evidence-gap finding title changed, so suppression rules that matched the old text stop matching — that is the safe direction, since findings resurface rather than hide, but the change is silent. And re-scan rather than re-processing scans captured before 0.32.9; the engine now warns on them.