Rank by exploitation,
not by CVSS.

One file. No network. Hand it to the client.

A scan ends with a directory of artifacts. An engagement ends with something a client reads. nsauditor-ai report closes that gap: point it at a finished run and it renders an executive HTML report — one self-contained, print-ready file that opens with no external network reference of any kind. It survives an email attachment, a laptop with no connectivity, and a reviewer’s locked-down browser.

Add --brand when the report goes out under your own name and the cover page carries it. --format jira writes a Jira-importer CSV instead, so a findings list becomes a backlog. ⚠️ That CSV is written for Jira’s own CSV importer — the field mapping is done inside Jira, and this is not a live-instance integration we have verified.

What goes inside brand.json

Every field is optional. Omit the file and the report renders unbranded under its default title.

// brand.json — put it next to your logo
{
  "title":        "Q3 External Perimeter Review",
  "companyName":  "Acme Manufacturing GmbH",
  "preparedBy":   "J. Rivera, Security Consulting LLC",
  "contact":      "security@example.com",
  "logoPath":     "acme-logo.png"
}

title replaces the headline; companyName is who the report is for; preparedBy is who prepared it. logoPath is a local PNG or JPEG, resolved next to the brand file and embedded into the HTML as a data URI.

That logo rule is strict on purpose, and every part of it protects the same promise — that the file opens with no external network reference. A URL is refused and never fetched: a remote logo is egress at render time and a tracking pixel every time your client opens the report. SVG is refused, because SVG is markup that can carry a script and break the no-script guarantee from inside the image. The path may not escape the brand file’s own directory, checked as typed and again after symlinks resolve. The cap is 2 MB, and the format is read from the file’s magic bytes rather than its extension — renaming an SVG to .png does not get it past the check. A brand file that cannot be read, is not valid JSON, or whose logo is refused is a fatal error and no report is written: a flag you passed is never silently dropped, because that is how a report goes out unbranded without anyone noticing.

It states what it could not read

A report that quietly skips a container reads exactly like a report that had nothing to skip. So every report carries a container census: where finding-like records sit in a place the report does not read, that place is named and counted on the page. Silence is disclosed — never rendered as absence.

report is a Pro capability and is included in Enterprise. It produces no PDF: the HTML is print-ready, and your browser prints it when a PDF is what the client asked for.

Prioritize by exploitation, not by CVSS

Version-based CVE matching is just the start. Every finding is scored — CVSS weighted by verification status, with an uplift for findings carrying an initial-access technique — and the queue is then ordered exploit-first. Findings are emitted unverified — you adjudicate what stays, not the scanner.

A KEV-listed MEDIUM outranks an unexploited CRITICAL

Severity ranks how bad a vulnerability would be if it were exploited. It cannot tell you whether anyone is exploiting it. Pro closes that gap at scan time: every finding carrying a CVE is joined by CVE ID against a local CISA KEV catalog and a local FIRST EPSS scores file, then banded and reordered exploit-first.

The justification travels with the finding — the KEV flag, the EPSS score with its percentile, the CVE ids that matched, and the store’s own as-of date. Your ranking is always something you can date and defend. Both catalogs are free, public and operator-supplied: point Pro at files you control and the join runs entirely on your machine.

Your existing riskScore does not move — exploitPriority is a new axis beside it. And this is enrichment, not detection: it reorders what the scanner already found.

Where Pro ends and the evidence pack begins

Pro sharpens the queue. Enterprise turns the result into something an assessor reads — 29 Enterprise plugins, 28 of them cloud auditors across AWS, Azure and GCP, and one read-only scan mapped to eight frameworks with an explicit out-of-scope column.

It is also where suppression lives — and suppression is an Enterprise capability, not a Pro one. Enterprise adds a suppression workflow for the compliance report: accepted-risk and false-positive records keyed on source and title pattern, approved with an approver’s signature, renewable on a cadence, and read by the compliance engine — which Pro does not run, so a suppression has no effect on a Pro report. The Enterprise compliance engine gives each decision an owner, a rationale, a date and an expiry inside the evidence pack — and as of EE 0.36.0 the report checks that approval’s signature against the key material the approver’s registry entry declares, rather than repeating what the record says about itself. A missing verdict reads not checked and never failed.

Isolated networks are Enterprise too: the offline install walkthrough — carry the package and the CVE data in, verify checksums, then import the feed — now lives on the Enterprise page.

None of that is part of a Pro licence. If your buyer is an auditor rather than a remediation queue, that is the tier to look at.

See NSAuditor AI Enterprise →