https://nsauditor.com/ai/ Latest releases, plugins, and compliance-framework updates for NSAuditor AI (Community + Enterprise). en-us Fri, 16 Oct 2026 04:00:00 GMT https://www.nsauditor.com/ai/enterprise/ nsauditor-ai-ee-2.0.0 Fri, 16 Oct 2026 04:00:00 GMT A control that fails on a Tuesday should not wait for the audit three months later to be found. NSAuditor AI Enterprise 2.0.0, released with Community Edition 1.0.0, puts the change in front of you at your next scan: each one-shot Enterprise compliance scan, run on demand or on your schedule, now writes scan_drift_<fw>.json beside its pack — the controls that went to fail or to pass, the controls that lost measurement, and the violations that are new or cleared. A “cleared” you can defend: with the port scanner in the scans you compare, a violation is cleared only when the scan looked for it and it was gone, and one whose scanner did not run or reported itself down, or whose port or region was not measured, is listed as could-not-measure with its reason. Then send the change where your team already works. Add --notify-webhook (public https only) and --notify-format generic, slack or teams to the scan, and the drift reaches your webhook, Slack or Teams channel when a control goes to fail or loses measurement, or when a new violation reaches the --notify-severity you set; a drift that could not be compared with a previous run always notifies. The notification is opt-in and its payload is minimal by default — no new dashboard to adopt. A scan pinned to what its host check approved: from Community Edition 1.0.0 the host check resolves the target and checks every answer, and the scan then connects only to those addresses — on the CLI and through the MCP server, for the target and each redirect hop. An AI summary you can audit byte for byte: with the opt-in AI analysis, an AWS account ID in an ARN or an AWS URL becomes [ACCOUNT_ID] everywhere it occurs in the payload, any other 12-digit number becomes [REDACTED_ID], and the system prompt is written beside the payload before the request, so the two files are what left the machine. Weak crypto that no longer hides in a generic finding: plugin 040’s weak-key and weak-signature certificate findings now fail the certificate control in SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022 and CIS v8. And a cleaner service inventory: on TCP, a row from a port’s authoritative probe that did not identify its service is now evidence with a reason rather than a service row, so the CSV, SARIF, the Markdown report and the AI payload no longer list it. The egress register now lists 21 outbound paths, up from 18; the three new ones are the notification’s own sends to the webhook, Slack or Teams URL you supply, each off by default. Plugin counts (29 Enterprise, 27 Community) and all eight coverage matrices carry over unchanged. Enterprise 2.0.0 runs on Node.js 24 and requires Community Edition 1.0.0 or newer, so upgrade both together — npm i -g nsauditor-ai@1.0.0 @nsasoft/nsauditor-ai-ee@2.0.0. Cloud audits are read-only: they read configuration and metadata and never need write permissions, and under Zero Data Exfiltration your scan data never goes to Nsasoft. Community Edition is free and MIT-licensed on npm; Pro is from $39/month billed annually ($49 month to month); Enterprise is from $2,000/year for read-only AWS, Azure and GCP auditing, evidence mapped to eight compliance frameworks from one scan, and drift alerts to your webhook, Slack or Teams. https://www.nsauditor.com/ai/enterprise/ nsauditor-ai-ee-1.3.0 Wed, 07 Oct 2026 07:00:00 GMT NSAuditor AI Enterprise 1.3.0 is out with Community Edition 0.2.57: it fixes how SLA age is counted outside SOC 2 and closes three more ways a narrower scan read as a fix. SLA age that no longer resets on every scan: since Enterprise 0.32.4, outside SOC 2, a finding whose stored text a compliance pack had rewritten was counted as closed on each later scan and found again as new, so in the HIPAA, NIST CSF, PCI DSS, ISO 27001, CIS, GDPR and NIST SP 800-171 packs its age never reached an SLA threshold and a breach could read as within SLA. 1.3.0 keys a finding on its prose with every framework’s ids removed, on both sides, so a history written by any earlier release reads correctly with no pack regenerated. Three more ways a narrower scan stopped reading as a fix. A failed CVE lookup: the earlier CVE rows on that service are not counted as fixed in the delta or MTTR, and with SLA tracking on the controls they failed now stay FAILED behind a [COVERAGE GAP] LOOKUP NOT MEASURED record; the CVE mapper’s record of a lookup that itself failed also fails, as an evidence gap, the 14 controls its CVE rows map to in seven frameworks. A plugin left out: when a plugin an analysis agent reads is left out of a scan made with 1.3.0 that includes the port scanner (003), the scan records an input gap, and the delta refuses that agent’s earlier rows, MTTR withholds them and, with SLA tracking on, their controls stay failed. A service that was not identified: when the SSH probe is left out of a scan that includes the port scanner (003) and port 22 answers as an unidentified service, the CVE mapper’s and the service agent’s earlier rows there read NOT COMPARABLE in the delta and are withheld in MTTR. Client reports that show their work: in the Pro delta report, every new, resolved and changed row carries a Basis cell that says what was checked for that row. Also in 1.3.0: the MCP host guard compares addresses by value in any spelling and checks every address a host name resolves to at check time; the egress register lists 18 outbound paths, up from 16, adding a redirect the scanned web server returns and a UPnP device’s description URL; a failed GuardDuty listing is an evidence gap rather than a HIGH finding that GuardDuty is not enabled; the Missing-HSTS check fires on port 443 where the HTTPS response was received; and a non-default SNMP community string, and the cookie values the HTTP probe records, no longer reach the scan’s artifacts. Plugin counts (29 Enterprise, 27 Community) and all eight coverage matrices carry over unchanged. Enterprise 1.3.0 requires Community Edition 0.2.57 or newer, so upgrade both together — npm i -g nsauditor-ai@0.2.57 @nsasoft/nsauditor-ai-ee@1.3.0 — and rescan before you compare across the upgrade. Cloud audits are read-only: they read configuration and metadata and never need write permissions, and under Zero Data Exfiltration your scan data never goes to Nsasoft. Community Edition is free and MIT-licensed on npm; Pro is from $39/month billed annually ($49 month to month) for client-ready report --since deltas; Enterprise from $2,000/year for read-only AWS, Azure and GCP auditing and evidence mapped to eight compliance frameworks from one scan, also on AWS Marketplace. https://www.nsauditor.com/ai/pro/#pro-since nsauditor-ai-ee-1.2.0 Mon, 05 Oct 2026 02:00:00 GMT The NSAuditor AI delta report is built on one rule — a finding that disappears between two scans has not been fixed unless the second scan measured where it was — and NSAuditor AI Enterprise 1.2.0, with Community Edition 0.2.56, extends that rule to six more cases across the delta, the mean-time-to-remediate (MTTR) figures and the compliance report. UDP services that go quiet: a UDP finding that vanished reads NOT COMPARABLE unless the other scan recorded that port as closed or answering — measured on a real router run against a twin of it with its 22 UDP rows dropped, 1.2.0 reports all 22 not comparable, each with its reason. Vulnerability data that shifts: NVD stopped matching five CVEs to dnsmasq 2.78 on a router still running dnsmasq 2.78, and 1.2.0 files all five vulnerability-data-changed, with the row calling the absence “a change in the vulnerability data it was matched against, not a remediation”. CVE lookups that failed: the delta and MTTR do not count that service’s earlier CVE rows as fixed. Coverage you can see: an analysis agent that failed, timed out or returned no finding list leaves a [COVERAGE GAP] AGENT NOT RUN record, and the delta and MTTR hold that agent’s rows out; an Enterprise package that did not load is named on stderr and in the scan’s conclusion, with that host’s analysis-agent and CVE rows held out of the comparison. For compliance owners, with SLA tracking on (--compliance-history or --sla-policy) and a prior compliance scan of the same host in the history, a control that failed on a prior finding stays FAILED, backed by an evidence-gap record, when this scan did not re-measure that finding’s port, region or producer; the record is counted among “Evidence gaps (not findings)”. Also new: a CVE newly attributed to an unchanged service stays NEW, with a note that the service is unchanged and the vulnerability data is not, and two scans of one host whose plugin runs finish in the same second each get their own output directory. What that gives you: client reports built to be defended line by line, with the reason on every not-comparable row; MTTR built to measure remediation, not data churn; and evidence for eight compliance frameworks from one read-only scan. Plugin counts (29 Enterprise, 27 Community) and all eight coverage matrices carry over unchanged. Enterprise 1.2.0 requires Community Edition 0.2.56 or newer, so upgrade both together: npm i -g nsauditor-ai@0.2.56 @nsasoft/nsauditor-ai-ee@1.2.0. Cloud audits are read-only: they read configuration and metadata and never need write permissions, and under Zero Data Exfiltration your scan data never goes to Nsasoft. Community Edition is free and MIT-licensed on npm; Pro is from $39/month billed annually ($49 month to month) for client-ready report --since deltas; Enterprise from $2,000/year for read-only AWS, Azure and GCP auditing and evidence mapped to eight compliance frameworks from one scan, also on AWS Marketplace. https://www.nsauditor.com/ai/pro/#pro-since nsauditor-ai-ee-1.1.0 Mon, 28 Sep 2026 23:30:00 GMT Hand a client a security report and the next question is: did we actually get better since the last scan? NSAuditor AI Enterprise 1.1.0 answers it. In Pro and Enterprise, nsauditor-ai report --from DIR --format executive --since prior (DIR is the folder your scans write with --out; a baseline run ID can replace prior) compares two scan runs and puts what is new, what is resolved and what changed severity into the client-ready, self-contained HTML report. Any tool can diff two scans; the hard part is refusing to call a finding fixed when the scanner only stopped looking. When the report can see that a finding was not measured the same way twice — a host not scanned, a plugin that did not run or timed out, an evidence gap such as AccessDenied, a narrower cloud scope, a port that stopped answering — it files the finding under NOT-COMPARABLE with the reason on the row, which turns a client dispute into a to-do list: scan the missing host, restore the permission, match the scope. Comparisons that would mislead, such as two runs at different licence tiers, are refused rather than guessed at. From the first scan run on 1.1.0 the baseline is tamper-evident: run records and each host's findings files are sealed with SHA-256 digests and chained to the previous run, and an altered findings file is named and the comparison refused. Enterprise adds read-only auditing of AWS, Azure and GCP and evidence mapped to eight compliance frameworks, with Zero Data Exfiltration: scan data never goes to Nsasoft. Upgrade with npm i -g nsauditor-ai@0.2.55 @nsasoft/nsauditor-ai-ee@1.1.0. Pro from $39/month billed annually ($49 month to month); Enterprise from $2,000/year, also on AWS Marketplace. https://nsauditor.com/ai/enterprise/ nsauditor-ai-ee-1.0.0 Tue, 15 Sep 2026 21:00:00 GMT Most software reaches 1.0 by adding features. NSAuditor AI Enterprise reaches it by making a commitment your procurement team can hold us to: the eight surfaces that define how it produces evidence — the finding shape and its markers, the MCP scan and query schemas, the report, attestation and rationale formats, the framework-mapping conventions, the Community peer floor and the GRC push posture — are frozen from this release, and a change to any of them is now a semver-major event. Build an integration on NSAuditor today and 1.0 is the commitment that it will not shift under you. This release also sharpens the numbers an assessor reads: the 'Findings analyzed' line now counts findings, and every report summary carries findingsReceived and findingsRouted so the arithmetic is checkable from the pack alone — no vendor portal, no callback, no trust required. An Azure RBAC assignment at the root scope is named as the root scope; PCI DSS 11.5.2 is described as critical-file change detection, in the standard's own terms. Eight frameworks — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32 and NIST SP 800-171 Rev 2 — from one agentless, read-only scan, with read-only credentials enforced in code. 29 Enterprise auditors, 56 plugins overall; plugin count is unchanged at 29 and all eight coverage matrices are unchanged. Paired with Community Edition 0.2.54 and agent-skill 0.2.52; the peer floor is unchanged at CE >= 0.2.49. https://nsauditor.com/ai/docs/pci/ nsauditor-ai-ee-0.46.0 Wed, 09 Sep 2026 21:00:00 GMT Every compliance product cites standards. NSAuditor AI Enterprise 0.46.0 reads its PCI DSS v4.0.1 citations from the PCI SSC publication itself rather than from a summary of it: sub-requirement identifiers, Customized Approach eligibility and the objective column are derived into a self-validating artifact that the mapping file points at — one source, no second copy to drift. Eligibility is read from where the standard states it, each requirement's own Customized Approach Objective cell, and every one of the 28 mapped controls is Customized-eligible. Each objective says, per control, whether it is the requirement cell's own wording or NSAuditor's paraphrase, and the report labels it from that flag. The derivation ships guarded: a build guard fails on any cited identifier the standard does not contain, and every objective flagged verbatim is checked against the document in both directions — so a citation your QSA reads is one the standard backs, and a drifting citation is a red test rather than a line in your report. The PCI DSS coverage matrix is enumerated at 19 covered + 9 partial + 44 out-of-scope across 72 sub-requirements — covered and partial unchanged, no control changed status — and the other seven framework matrices are unchanged. Paired with Community Edition 0.2.53 and agent-skill 0.2.51; the peer floor is unchanged at CE >= 0.2.49. https://nsauditor.com/ai/enterprise/ nsauditor-ai-ee-0.45.0 Mon, 07 Sep 2026 21:00:00 GMT NSAuditor AI Enterprise 0.45.0 makes every evidence pack a document whose words never outrun its proof. Report time is anchored by RFC 3161 trusted timestamping, opt-in via the NSAUDITOR_TSA_URL environment variable: each artifact gets a .tsr sidecar whose time comes from the Time-Stamp Authority you name rather than from the scanning host, so a wrong host clock cannot corrupt a token, and an assessor reads host skew from the token itself — with a signature behind it. The artifact names its own limits: the scope attestation's ntp block is frozen at six keys with constant values and a note stating plainly that this scanner does not measure its own clock, on an unchanged nsauditor.scope-attestation/v1 schema, so nothing an auditor's tooling reads has moved and the roughly 990 timestamp sidecars already taken stay verifiable. Consistent with that standard, the NTP clock-attestation probe is WITHDRAWN as of EE 0.45.0 — it attested the scanner's own host clock, never your estate, which is the subject of every framework time-synchronisation control — and its wording is guarded against reappearing on any published surface. The agent skill 0.2.50 carries the same discipline into AI assistants: asked whether the scanner measures its own clock, it answers no and points at the timestamping path. The change ships as a minor version so it is findable in the version series auditors read. Eight compliance frameworks from one read-only scan — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32 (Security of Processing infrastructure substrate only, not GDPR compliance) and NIST SP 800-171 Rev 2 — across a catalogue of 56 plugins in total (27 Community + 29 Enterprise). Every coverage matrix is unchanged this cycle. Enterprise Edition 0.45.0 pairs with Community Edition 0.2.52 and agent-skill 0.2.50, and requires Community Edition 0.2.49 or newer. https://nsauditor.com/ai/enterprise/ nsauditor-ai-ee-0.44.0 Thu, 04 Sep 2026 21:00:00 GMT NSAuditor AI Enterprise 0.44.0 turns a finished scan into the deliverable a consultant actually sends. `nsauditor-ai report --from <dir> --format executive` renders a completed run as a self-contained, print-ready HTML report with optional cover-page branding; `--format jira` writes a Jira-importer CSV. The HTML opens with no external network reference at all — it is a file you can hand to a client on an air-gapped laptop. The report also states what it could NOT read: a container census walks the scan record, and any finding-shaped record sitting in a place the report does not open is named and counted on the page itself. Silence is disclosed, never rendered. On the AWS side, an audit-trail gap now means BOTH audit trails are missing: S3 server access logging being off is no longer reported as a gap when a CloudTrail data-event trail already covers that bucket, with coverage judged per selector and organization trails and prefix-scoped selectors refused rather than assumed. Fewer findings, and the ones that remain are real. Eight compliance frameworks from one read-only scan — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32 and NIST SP 800-171 — across a catalogue of 56 plugins in total (27 Community + 29 Enterprise). Every coverage matrix is unchanged this cycle. Enterprise Edition 0.44.0 pairs with Community Edition 0.2.51 and agent-skill 0.2.49, and requires Community Edition 0.2.49 or newer. https://nsauditor.com/ai/enterprise/ nsauditor-ai-ee-0.43.0 Thu, 04 Sep 2026 21:00:00 GMT NSAuditor AI Enterprise 0.43.0 makes every scan report exactly the estate it examined. A cloud provider whose scanner did not run is now reported as NOT audited, with the reason stated, so the provider summary and the audited-provider list describe precisely what was scanned — and compliance verdicts continue to fail closed over any unscanned surface. Evidence gaps now state the cause an assessor needs rather than a remediation command, keeping operator instructions on the operator channel where they can be acted on — which matters most in air-gapped installations. The restricted offline carrier is pinned to the dependency versions its own test suite runs against and builds reproducibly, byte-identical across consecutive builds, verified in an isolated container with the network interface down and zero outbound attempts recorded. Also in this release: cleaner “Why this violates” rationale across four framework files, GDPR Article 32 (Security of Processing infrastructure substrate only, not GDPR compliance) fails closed on an Azure refusal, and the frozen interface record documents the envelope liveness keys the fail-close reads. Eight compliance frameworks from one agentless, read-only scan: SOC 2, HIPAA §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32 and NIST SP 800-171 Rev 2. 29 Enterprise auditors (28 cloud auditors plus one Zero Trust posture check), 56 plugins overall, all eight coverage matrices unchanged. Paired: CE 0.2.50, agent-skill 0.2.48. Requires Community Edition 0.2.49 or newer. Zero Data Exfiltration — the scan runs entirely inside your infrastructure. https://nsauditor.com/ai/enterprise/ nsauditor-ai-ee-0.42.0 Thu, 27 Aug 2026 23:30:00 GMT NSAuditor AI Enterprise 0.42.0 audits your sovereign and government cloud estates as themselves. AWS auditing is now partition-correct across GovCloud, the China regions, the intelligence-community partitions and the European Sovereign Cloud, so resource names, severity ladders and region handling all follow the partition your estate actually runs in — a finding in GovCloud lands with the same weight it would in commercial. Azure sovereign clouds are selected explicitly through AZURE_ENVIRONMENT and resolve fail-closed, and every Azure scan stamps the estate it addressed, so the subject of the report is visible on the face of the report. Also new: an on-demand CycloneDX or SPDX software bill of materials generated over the package you actually install rather than a maintainer’s working tree, and a published FIPS posture statement that names the FIPS-approved algorithms the product employs and states plainly that the product is not itself a FIPS 140-validated cryptographic module. 29 Enterprise auditors, 56 plugins overall, all eight compliance frameworks; the coverage matrices are unchanged because this release deepens correctness on controls already covered. Requires Community Edition 0.2.49 or newer — install Community Edition first. https://nsauditor.com/ai/enterprise/ nsauditor-ai-ee-0.41.0 Wed, 26 Aug 2026 12:00:00 GMT Amazon DocumentDB now has a dedicated auditor. EE 0.41.0 adds the platform’s 29th Enterprise plugin — 1230 AWS DocumentDB Auditor — which assesses your MongoDB-compatible clusters on their own terms across seven dimensions: storage encryption at rest with KMS key-custody classification, TLS enforcement via the tls cluster parameter, audit logging together with its CloudWatch export, automated backup retention, deletion protection, replica and Availability-Zone topology under the cluster lens DocumentDB actually uses, and whether manual cluster snapshots are restorable publicly or by accounts you did not intend. Every dimension the scan cannot read becomes a named evidence gap rather than silence; remediation instructions speak DocumentDB’s own API, so what the report hands your engineer is a command that runs; and DocumentDB Elastic clusters are declared deferred rather than silently absent. The RDS auditor now delegates DocumentDB to the new plugin and carries a standing disclosure that a Neptune estate is unaudited — stated where an auditor reads. The plugin was proven live against paired known-good and known-violating fixtures, detecting six of six planted violations with no false positive on the hardened pair. It routes to all eight supported frameworks — SOC 2, HIPAA Security Rule §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32 as Security of Processing substrate, and NIST SP 800-171 Rev 2 as evidence substrate for CMMC Level 2 preparation — through 245 mapping entries keyed to its own findings, and all eight coverage matrices are unchanged: this release is evidence depth on controls already covered. 29 Enterprise auditors, 56 plugins overall. Community Edition 0.2.48 and the agent-skill 0.2.46 are paired refreshes and the peer floor is unchanged at Community Edition 0.2.45 or newer. https://nsauditor.com/ai/enterprise/ nsauditor-ai-ee-0.40.3 Tue, 25 Aug 2026 12:00:00 GMT Eight compliance frameworks from a single agentless, read-only scan of AWS, Azure, GCP and on-prem networks — SOC 2, HIPAA Security Rule §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32 as Security of Processing infrastructure substrate only and never GDPR compliance, and NIST SP 800-171 Rev 2 as evidence substrate for CMMC Level 2 preparation and never a CMMC certification. The eighth framework landed in EE 0.40.0 and it is still the reason to look: SP 800-171A decomposes every requirement into determination statements and a C3PAO scores each one, so this engine publishes the full objective list beside the subset it evidences — 69 of 172 determination statements across the 51 mapped requirements — and every partial names which shortfall it is. All 110 Rev 2 requirements are enumerated with no declared subset, so there is nothing hidden behind a sample. It informs your System Security Plan and POA&M and never produces them, emits no MET or NOT MET determination and no score, and CUI scope stays your assertion. EE 0.40.3 is the version you install today, and it makes the evidence chain underneath all eight check itself: on the RFC 3161 trusted-timestamp path — opt-in via NSAUDITOR_TSA_URL, with no default authority and an outbound call only to the authority you name — every timestamp token is matched against the exact artifact digest it attests before anything is written to disk, so a .tsr sidecar in your evidence pack provably belongs to the artifact beside it, and one framework’s chain-of-custody envelope records that check per artifact as an explicit boolean your auditor can read. The verification instruction printed on the compliance report cover page is one that runs exactly as printed, so an assessor reproduces the result with stock openssl and none of our software in the path. Tokens encoded in BER — which CMS permits and which openssl ts -verify accepts — are accepted rather than discarded, so timestamps from commercial authorities such as DigiCert, GlobalSign or Sectigo land in the pack where you expect them. All eight coverage matrices and the 28-auditor Enterprise catalog are unchanged. Community Edition 0.2.47 and the agent-skill 0.2.45 are paired refreshes and the peer floor is unchanged at Community Edition 0.2.45 or newer. https://nsauditor.com/ai/enterprise/ nsauditor-ai-ee-0.40.2 Sun, 24 Aug 2026 12:00:00 GMT Eight compliance frameworks from a single agentless, read-only scan of AWS, Azure, GCP and on-prem networks — SOC 2, HIPAA Security Rule §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32 as Security of Processing infrastructure substrate only and never GDPR compliance, and NIST SP 800-171 Rev 2 as evidence substrate for CMMC Level 2 preparation and never a CMMC certification. The eighth framework arrived at EE 0.40.0 and it is the reason to look: SP 800-171A decomposes every requirement into determination statements and a C3PAO scores each one, so this engine publishes the full objective list beside the subset it evidences — 69 of 172 determination statements across the 51 mapped requirements — and every partial names which shortfall it is. All 110 Rev 2 requirements are enumerated with no declared subset, so there is nothing hidden behind a sample. It informs your System Security Plan and POA&M and never produces them, emits no MET or NOT MET determination and no score, and CUI scope stays your assertion. EE 0.40.2 is the version you install today, and it strengthens the evidence chain underneath all eight: on the RFC 3161 trusted-timestamp path — opt-in via NSAUDITOR_TSA_URL and never a default — the authority’s status is now read from its own response bytes before anything reaches disk, so only a token the authority actually granted is ever recorded, five distinct authority responses are reported by name, and any timestamp already held from an earlier run is left byte-identical. Policy-OID timestamping on that same opt-in path now works on OpenSSL 3.0 and later including the shipped container, so operators pointing at a commercial authority such as DigiCert, GlobalSign or Sectigo get timestamps. Customer-facing Google Cloud remediation text is cleaner too. All eight coverage matrices and the 28-auditor Enterprise catalog are unchanged. Community Edition 0.2.46 and the agent-skill 0.2.44 are paired refreshes and the peer floor is unchanged at Community Edition 0.2.45 or newer. https://nsauditor.com/ai/enterprise/ nsauditor-ai-ee-0.40.1 Fri, 21 Aug 2026 22:00:00 GMT Enterprise Edition adds NIST SP 800-171 Rev 2 as its eighth compliance framework, scoped as evidence substrate for CMMC Level 2 preparation. THE HEADLINE NUMBER IS AN UNFLATTERING ONE AND THAT IS THE POINT: of the 110 requirements in Rev 2, this engine reports 2 as covered, 49 as partial and 59 as out of scope with a written reason each. That is not a coverage gap - it is what happens when you claim coverage at the level an assessor actually scores. SP 800-171A decomposes each requirement into determination statements and a C3PAO scores every one; a requirement counts as covered here only when EVERY one of its objectives is a statement about technical system state the scan reads directly, and almost every requirement retains an objective about a defined procedure, an identified set or an authorization that configuration cannot evidence. All 110 are enumerated - no declared subset, so no under-enumeration surface - and every mapped requirement carries its full objective list beside the subset this engine supplies examine-method material for: 69 of 172. Rev 2 is pinned deliberately, because CMMC assesses Rev 2 by rule and Rev 3 is a different 97-requirement universe. WHAT THIS IS NOT, stated as a refusal rather than a disclaimer: it is not a CMMC certification, not a FedRAMP authorization, it emits no MET or NOT MET determination and no SPRS score - those are the assessor's words and the DoD methodology's arithmetic, and a score implied from partial evidence is a fabrication. Two data fields were removed during development rather than shipped, a per-requirement scoring weight and a requirement-type label, because both were transcriptions this repository cannot re-derive from an authority it holds. CUI scope remains the operator's assertion: the scanner cannot see CUI, cannot distinguish it from FCI, and cannot see an enclave boundary. Requirement ids collide exactly with PCI DSS sub-requirement ids - 3.5.1 is real in both standards - so every citation must carry its qualifier. Requires Community Edition 0.2.45 or newer - a REAL floor raise, because an older Community Edition rejects the eighth framework by name. https://nsauditor.com/ai/enterprise/ nsauditor-ai-ee-0.39.0 Wed, 19 Aug 2026 22:00:00 GMT Enterprise Edition 0.39.0 extends coverage-boundary declarations to every cloud provider. A deferredScope declaration is the only channel by which a report reader learns a surface was never examined - and all nine shipped declarations sat on AWS plugins, while the seven GCP and Azure plugins declared nothing. AWS disclosing is exactly what made the others' silence read as completeness, which is the false-completeness class this marker exists to close; it was field-confirmed on an operator scan where deferredScope was EMPTY on Azure beside a non-empty AWS list. Seven new declarations ship across plugins 1021, 1022, 1024, 1025, 1220, 1221 and 1222 - between 8 and 12 static boundaries each, emitted at run() scope on the audited path including over an empty estate, and never on a precondition-failure path where no audit ran. They are ordered by materiality, because Community Edition abridges the declaration to 420 characters in its scan badge. THE PRECISION MATTERS MORE THAN THE COUNT: every boundary was verified against the implementing code rather than a keyword search, and that changed four of them - grep-absence is a hypothesis about vocabulary, not a capability boundary, and an overstated boundary is an underclaim, the direction nothing ever complains about. Two boundary texts were promoted out of places no report reader could reach: one from a code comment, one from a data field the summariser never reads. A declaration is not a finding and not a gap - it routes to ZERO controls by design, re-measured at 49 declaration-by-framework combinations returning 0 control violations beside a live negative control that correctly routed to 3 SOC 2 controls. Plugin catalog UNCHANGED at 28; all seven coverage matrices UNCHANGED. Requires Community Edition 0.2.43 or newer - the floor is UNCHANGED this cycle. Community Edition 0.2.44 rides the trio because the model-facing scan_cloud description was being truncated by an MCP client, and a truncated description that keeps its routing mechanics while losing its honesty rules fails silently; it now leads with the reading rules. https://nsauditor.com/ai/enterprise/ nsauditor-ai-ee-0.38.0 Mon, 17 Aug 2026 22:00:00 GMT Enterprise Edition 0.38.0 adds two commands for evidence-pack authorship: compliance sign-pack signs the chain-of-custody envelope at an approval station with an operator-held Ed25519 key, covering one framework envelope and the artifacts it enumerates, and compliance verify-pack establishes authorship from it. PROVEN against published bytes: the three-part gate ran on the registry build - sign and verify clean, a length-preserving one-byte edit to a covered report caught while the signature itself still verifies, and the openssl-only auditor procedure reproduced beside a live negative control. The verifier also recomputes every artifacts[].sha256 against disk, because checking the signature alone would authenticate a manifest whose artifact claims nothing had ever verified. Scope, stated plainly: a verified signature proves the holder of a key asserted authorship of ONE framework's envelope at a stated time, relative to your own key custody - never a vendor attestation, and never proof the findings are true. Exit 0 verified, 1 a violation, 2 the run could not measure - and the third is never a failure. Also corrected: gzipped KEV/EPSS stores loaded as zero entries in 0.37.0 (compression is now decided by content, not filename), and a GCP evidence gap that named the wrong cause. Requires Community Edition 0.2.43 or newer. https://www.nsauditor.com/ai/enterprise/ nsauditor-ai-ee-0.37.0 Sun, 16 Aug 2026 12:00:00 GMT A scanner on an isolated network has a standing problem: the vulnerability data it matches against lives on the internet, and it does not. The offline CVE store and its hardened ingest path have shipped for several releases — and no shipped entry point could reach them, which is why offline CVE matching was never advertised as delivered. Enterprise 0.37.0 ships the two commands that close it. `feed bundle` merges the NVD feed files YOU downloaded on a connected host into one portable archive; `feed import` reads it into the offline store on the isolated one, and names why it skipped records — about a quarter of a real NVD year file is skipped by design, being withdrawn CVEs and entries with no CPE match data, and that is not data loss. Bundling the SOURCE feeds rather than the built store was re-ruled on a measurement taken before it was built: the store is a lossy derivation of an NVD feed, so it cannot be turned back into one. Optional --kev and --epss carry YOUR OWN CISA KEV catalogue and FIRST EPSS scores inside the same archive, validated on the connected host where a bad download can still be replaced, because both parsers return an EMPTY result for unreadable input rather than failing — and an empty catalogue at a store path reports every finding as not-exploited, which is exactly what a clean host reports. No exploit data ships with this product. A bundle is INTEGRITY-CHECKED, NOT AUTHENTICATED: the recorded SHA-256 detects a file altered in transit but travels inside the archive it covers, so it cannot establish authorship. Air-gapped delivery ships as a dependency-complete bundle with an install script and checksums, distributed RESTRICTED and amd64 only; no arm64 image is published. Requires Community Edition 0.2.42 or newer, raised this cycle because the new entry points live there. Plugin catalog unchanged at 28; all seven coverage matrices unchanged.