Stop chasing
false positives.

One file. No network. Hand it to the client.

A scan ends with a directory of artifacts. An engagement ends with something a client reads. nsauditor-ai report closes that gap: point it at a finished run and it renders an executive HTML report — one self-contained, print-ready file that opens with no external network reference of any kind. It survives an email attachment, a laptop with no connectivity, and a reviewer’s locked-down browser.

Add --brand when the report goes out under your own name and the cover page carries it. --format jira writes a Jira-importer CSV instead, so a findings list becomes a backlog. ⚠️ That CSV is written for Jira’s own CSV importer — the field mapping is done inside Jira, and this is not a live-instance integration we have verified.

It states what it could not read

A report that quietly skips a container reads exactly like a report that had nothing to skip. So every report carries a container census: where finding-like records sit in a place the report does not read, that place is named and counted on the page. Silence is disclosed — never rendered as absence.

report is a Pro capability and is included in Enterprise. It produces no PDF: the HTML is print-ready, and your browser prints it when a PDF is what the client asked for.

Prioritize by risk, suppress the noise

Version-based CVE matching is just the start. Every finding is scored — CVSS weighted by verification status, with an uplift for findings carrying an initial-access technique — and the queue is then ordered exploit-first. Findings are emitted unverified — you adjudicate what stays, not the scanner.

A finding-suppression workflow lets you mark items accepted-risk or false-positive; suppressed findings drop out of the report and the risk rollup. Every decision is recorded per scan.

A KEV-listed MEDIUM outranks an unexploited CRITICAL

Severity ranks how bad a vulnerability would be if it were exploited. It cannot tell you whether anyone is exploiting it. Pro closes that gap at scan time: every finding carrying a CVE is joined by CVE ID against a local CISA KEV catalog and a local FIRST EPSS scores file, then banded and reordered exploit-first.

The justification travels with the finding — the KEV flag, the EPSS score with its percentile, the CVE ids that matched, and the store’s own as-of date. Your ranking is always something you can date and defend. Both catalogs are free, public and operator-supplied: point Pro at files you control and the join runs entirely on your machine.

Your existing riskScore does not move — exploitPriority is a new axis beside it. And this is enrichment, not detection: it reorders what the scanner already found.

Where Pro ends and the evidence pack begins

Pro sharpens the queue. Enterprise turns the result into something an assessor reads — 29 Enterprise plugins across AWS, Azure and GCP, and one read-only scan mapped to eight frameworks with an explicit out-of-scope column.

It is also where suppression stops being a filter and becomes a record. Pro’s finding-suppression workflow drops an accepted-risk item out of your report and its risk rollup. The Enterprise compliance engine takes the same decision and gives it an owner, a rationale, a date and an expiry inside the evidence pack — and as of EE 0.36.0 the report checks that approval’s signature against the key material the approver’s registry entry declares, rather than repeating what the record says about itself. A missing verdict reads not checked and never failed.

None of that is part of a Pro licence. If your buyer is an auditor rather than a remediation queue, that is the tier to look at.

See NSAuditor AI Enterprise →

Installing where the host cannot reach a registry

A scanner on an isolated network has a standing problem: the vulnerability data it matches against lives on the internet, and it does not. Enterprise ships a dependency-complete bundle carrying both editions, an install script and SHA-256 checksums — a restricted distribution — so the install and the CVE data can both be carried in.

The condition travels with this path and is part of the offer, not a footnote: the bundle is a restricted distribution rather than a public npm install. It is not architecture-restricted — the install script is verified on native aarch64 as well as amd64, so an arm64 enclave is covered by this path. The published container image is amd64 only; that is a different delivery vehicle from this bundle.

No CVE, KEV or EPSS data ships with the product. You download the NVD feeds you want on a connected host, bundle them, and carry the archive across. Your own CISA KEV catalogue and FIRST EPSS scores can ride the same archive. Both fail closed when stale, so an out-of-date catalogue never reports “not exploited”.

⚠️ A carried bundle is integrity-checked, not authenticated. The recorded SHA-256 detects a file altered in transit, but it travels inside the archive it covers, so it cannot establish who built it.

The install, end to end. On a connected host, authenticate with the download token from your purchase email and fetch the bundle:

npm pack @nsasoft/nsauditor-ai-ee-airgap@0.44.0
tar xzf nsasoft-nsauditor-ai-ee-airgap-0.44.0.tgz

Carry the extracted directory to the isolated host and run its script. It verifies the carried checksums before installing anything, installs Community Edition first (Enterprise declares a peer dependency on it), and forces every install offline:

./install.sh
nsauditor-ai license --plugins

Then carry the vulnerability data, which is separate and never ships with the product:

# connected host
nsauditor-ai feed bundle --from ./nvd-downloads --out feeds.json.gz \
  --kev ./known_exploited_vulnerabilities.json --epss ./epss_scores.csv.gz

# isolated host — imports the feeds you downloaded, from a bundle you carried; restricted distribution
nsauditor-ai feed import --file feeds.json.gz --extras-dir ./stores
export NSAUDITOR_OFFLINE_ONLY=1
nsauditor-ai scan --host aws --env ./org.env --compliance soc2 --out ./out

NSAUDITOR_OFFLINE_ONLY=1 refuses to start if an outbound path is also configured, which rules out the opt-in RFC 3161 timestamping path inside the enclave. A host with no sha256sum or shasum is refused rather than installed onto.

What is verified before the bundle ships. Every release re-builds it and runs a delivery gate against those exact tarballs: all 44 declared production dependencies resolve from the carried closure, 29 Enterprise plugins load, a store-backed scan returns findings from carried CVE data, and the run makes zero network attempts. The gate never reads npm’s exit status — every production dependency is an optionalDependency, so a NIC-down install of the unvendored package exits 0 having installed almost nothing.

Verify the delivery yourself — not the installer. The installer’s exit code is the one thing not to trust on an isolated host, and it is structural rather than a bug: every production dependency is an optionalDependency, so npm skips an unfetchable one silently and still exits 0. After install.sh, confirm what actually landed — nsauditor-ai license --plugins must report the Enterprise plugins active, and a require.resolve sweep of the declared production dependencies must reach 44 of 44 — the carrier shipped in EE 0.43.0 measured 44 of 44 at that release. The same sweep against the ordinary, non-bundled package on an isolated host reaches 0 of 44 — with npm still exiting 0. The full command is in the walkthrough.