Sample scan output — what auditors actually see

AWS SOC 2 scan — plugin 1170 v3.1 + plugin 1200 v6.1 highlighted

Acme Corp's security engineer points NSAuditor at their AWS production account to get a Type I-friendly pre-audit gap report. The scan enumerates opted-in regions, walks SG ingress graphs from public-CIDR roots, and probes EventBridge target liveness with eventual-consistency defense. Results map to AICPA TSC 2017 controls and ship signed via RFC 3161 trusted timestamps.

# Acme audit engineer runs the full enterprise catalog against AWS
$ export AWS_PROFILE=acme-prod-audit
$ nsauditor-ai license --status
✓ Enterprise license active
  Org: audit@acmecorp.example
  Seats: 5 · Expires: 2027-05-07

$ nsauditor-ai scan --host aws --compliance soc2 --out ./acme-audit-evidence
[plugin] AWS EC2 SG Perimeter Auditor (1170 v3.1) ......... 9 findings  
[plugin] AWS Inspector / GuardDuty Auditor (1200 v6.1) ... 51 findings 
[plugin] AWS S3 Security Auditor (1020) .................. 3 findings  
[plugin] AWS IAM Deep Auditor (1010) ..................... 4 findings  
[plugin] AWS KMS Auditor (1070) .......................... 2 findings  
  ...17 more plugins, 22 total, all ran clean

✓ Scan complete · 132 findings across 22 plugins · 17 AWS regions
✓ SOC 2 evidence written to ./acme-audit-evidence/scan_compliance_soc2.{json,html,md}
✓ Chain-of-custody signed · SHA-256 sidecars · RFC 3161 timestamp affixed

Plugin 1170 v3.1 — Security Group transitive chain reachability

The headline feature in EE 0.6.7. Pre-v3 the plugin audited each SG in isolation — a SG with no direct public-CIDR ingress passed even if it was transitively reachable from the internet through a chain of UserIdGroupPairs references. Operators routinely miss these paths: each intermediary SG looks "private" in isolation. v3 closes the false-CLEAN class with deterministic BFS. v3.1 (this release) dedupes graph edges by (source, target) so multi-port references emit one chain per distinct exposure path, not N×.

Plugin 1200 v6.1 — multi-region GuardDuty + Inspector2 enablement

Auditors need detection-substrate evidence per CC7.1. Plugin 1200 enumerates opted-in AWS regions and checks GuardDuty Detector enablement, protection-feature coverage, Inspector2 activation, and scan-target coverage. v6.1 (this release) closes the CloudWatch Logs probe retry-on-empty parity — freshly-created log groups now retry once before classifying DEAD, matching the eventual-consistency defense for IAM / Lambda / SNS / SQS branches.

Network scan — home-office router — 41 plugins, AI-conclusion synthesized

Different mode, same engine. The same EE CLI scans an arbitrary IP host on the local network. Acme's IT lead points the scanner at a home-office router (192.0.2.1) for a CVE sweep + service inventory. The OUI database identifies the device vendor from the ARP MAC, every relevant service plugin probes its port, and the AI conclusion synthesizes a prioritized remediation plan.

$ NSA_ALLOW_ALL_HOSTS=1 nsauditor-ai scan --host 192.0.2.1 --out ./acme-router-scan
# NSA_ALLOW_ALL_HOSTS=1 explicitly authorizes scanning of RFC 1918 private IPs.
# Default policy blocks private/loopback ranges to prevent accidental internal SSRF.

[discovery]   Ping Checker .................... host UP, TTL=65
[discovery]   ARP Scanner ..................... vendor: ACME-NETWORKS (OUI 00:1F:7A)
[discovery]   Port Scanner .................... 53/udp 443/tcp open
[service]     DNS Security Auditor ............ 7 actionable / 0 critical / 3 high / 2 medium / 2 low
[service]     TLS Scanner ..................... TLS 1.2, server banner unknown
[service]     OpenSearch Scanner .............. probed 5601, 9200 — filtered/closed
[service]     mDNS / DNS-SD / NetBIOS / SMB ... no advertised services
[osfp]        OS Detector ..................... TTL=65 → Custom/Proprietary (embedded firmware)
[ai]          AI Concluder .................... synthesized markdown + html report

✓ Scan complete · 41 plugins · 1 host · 7 actionable findings
✓ Report: ./acme-router-scan/scan_response_ai.html (network-ops view)
✓ Report: ./acme-router-scan/scan_conclusion_raw.json (machine-readable)

AI conclusion (excerpt — auto-synthesized by the Concluder plugin)

## Executive Summary

OS (from scan): Custom/Proprietary (TTL=65)

This host presents a moderate security posture with limited internet exposure. Only two
services are confirmed open to external access: DNS (port 53/UDP) and HTTPS (port 443/TCP).
The DNS service runs a significantly outdated version of dnsmasq (2.78) with multiple known
vulnerabilities, representing the primary security concern.

## Prioritized Remediation Plan

1. Update dnsmasq immediately (Priority: Critical, Timeline: 24 hours)
   - Action: Update dnsmasq to version 2.89 or later via vendor firmware update
   - Rationale: Addresses multiple CVEs with public exploits

2. Identify and secure HTTPS service (Priority: High, Timeline: 7 days)
   - Action: Determine web server software/version behind port 443; enforce network-level ACL

3. Establish firmware management process (Priority: Low, Timeline: 60 days)
   - Action: Create inventory and update schedule for network appliances

What's in the box — EE 0.6.7 today

Coverage is measured against AICPA Trust Services Criteria 2017. Plugin count is what auditors actually care about — the plugins are the evidence-acquisition surface, not just a feature count. Numbers below are current as of EE 0.6.7 / 2026-05-19.

Evidence pipeline

Every scan that emits compliance findings also emits an auditor-grade evidence pack. This is what makes the difference between "we ran a scan" and "here is the contemporaneous artifact chain proving we ran the scan and it has not been altered since."

• ✓
  scan_compliance_soc2.json + .html + .md
  Three rendering formats of the same authoritative SOC 2 mapping. JSON for GRC platform ingestion (Vanta connector ships native), HTML for auditor review, Markdown for pull-request workflows.
• ✓
  scan_attestation_soc2.json + RFC 3161 timestamp
  Cryptographic attestation — Ed25519-signed envelope wrapping the SOC 2 report, with a trusted-timestamp authority counter-signature (FreeTSA or operator-supplied TSA) proving the report existed in this exact form at this exact moment.
• ✓
  scan_chain_of_custody_soc2.json + per-artifact .sha256 sidecars
  Each artifact produced has a separate SHA-256 sidecar; the chain-of-custody manifest cross-links every sidecar with the producing scan ID. Tamper-evident from artifact through report through attestation.
• ✓
  Vanta / Drata / Secureframe push connectors
  Native push to the GRC platform with response-body cap + per-attempt audit log + token-format pre-flight. Multi-tenant safe; per-tenant token rotation supported.
• ✓
  WORM evidence storage hook
  Optional immutable-storage hook for retention compliance (SEC 17a-4f, FINRA 4511, FedRAMP record-keeping). Bit-perfect retention with cryptographic non-alteration proof.

Why this release matters

EE 0.6.7 is a patch-level cleanup cycle that closes the two reviewer-deferred items from 0.6.6. Small change-set; big trust signal. Both folds eliminate classes of false-CLEAN findings (where the scanner emits PASS on a substrate that's actually compromised) — the worst possible outcome for SOC 2 evidence.

• ✓
  Plugin 1170 v3.1 — SG-reference-graph edge dedup
  Pre-fold a SG with 3 ingress perms each referencing the same source SG on different ports emitted 3 distinct edges. The BFS treated each as a separate chain, inflating chainCount 2-5× and exhausting per-target chain caps on noise. Hub-and-spoke topologies (common in shared-services VPCs) silently truncated, masking deep CRITICAL exposures. Post-fold edges dedupe by (source, target) with ports aggregated as array. isCrossVpc AND-aggregates conservatively (walk possibly-same-VPC chains rather than silently skip).
• ✓
  Plugin 1200 v6.1 — CloudWatch Logs probe retry-on-empty parity
  Pre-fold the CWL dead-target probe was asymmetric with the IAM / Lambda / SNS / SQS branches. DescribeLogGroups returns logGroups: [] (not a thrown exception) for missing groups, so the shared retry helper's thrown-NotFound retry never fired. Freshly-created log groups probed within seconds of creation could false-DEAD. Post-fold the helper accepts a result-based predicate; phases are mutually exclusive (single retry total per invocation — compound paths cap at 2 network calls).
• ✓
  4 same-session reviewer folds applied · clean review pass
  0 R-CRITICAL + 0 R-HIGH + 1 R-MEDIUM + 3 R-LOW — all folded before staging. Independent reviewer pass via two parallel agents (one per fold site) flagged 4 items; all closed same-session. Plus 1 unanticipated structural improvement caught by a compound-path test interaction (not by either reviewer): the two-phase restructure of the retry helper that prevents triple-retry on compound paths.
• ✓
  soc2.json + coverage matrix UNCHANGED
  Both folds are internal — graph structure and retry policy. No new emission categories, no new SOC 2 control coverage claimed. Institutional honesty: scope depth grows without scope-shifting.