AI-Powered Network Security Audits Without Data Exposure.
NSAuditor AI is an open-core, AI-powered network security audit platform that runs agentless, read-only, and entirely on your infrastructure. Nothing is installed across your estate, credentials are read-only by design, and your security data never leaves your environment.
With 55 plugins for networks and AWS, Azure, and GCP, one scan delivers risk-scored security findings, exploit-first prioritization using CISA KEV and FIRST EPSS, MITRE ATT&CK mapping, and auditor-ready evidence mapped to 7 compliance frameworks: SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, and GDPR Article 32.
Evidence packs include SHA-256 chain-of-custody manifests and opt-in RFC 3161 trusted timestamps. Operator-held Ed25519 signatures can be verified offline. NSAuditor AI supports air-gapped environments and reports evidence gaps explicitly—never claiming an unassessed surface is secure.
One scan. Technical security assessment. Seven compliance frameworks. Verifiable evidence. Zero data exfiltration.
An open-core scanner with risk-scored findings, threat intelligence, and hepta-framework compliance evidence — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, and GDPR Article 32 — built so your audit trail holds up to a CPA-firm review, a QSA RoC walkthrough, an ISO Stage 2 assessment, a CIS-CAT self-attestation, and a GDPR Article 32 review.
Risk-Scored Prioritization
Every finding carries a composite risk score — severity × exploitability × impact × exposure — so the queue sorts worst-first, and an operator suppression workflow tracks accepted-risk and false-positive dispositions with expiry.
Findings are mapped to MITRE ATT&CK techniques with kill-chain context, so you can show your CISO what an attacker would actually do — not just CVE noise.
A network security audit is a systematic review of your network — hosts, ports, services, configurations, and cloud accounts — to find vulnerabilities, misconfigurations, and compliance gaps before an attacker does.
NSAuditor AI runs that audit locally: it discovers live hosts and services, fingerprints them with safe, non-destructive probes, matches those versions against CVE data offline, maps each finding to MITRE ATT&CK, and generates auditor-ready evidence for seven frameworks — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, and GDPR Article 32 — from a single scan. Unlike SaaS scanners, every step runs on your own infrastructure, so a complete network security audit happens with zero data exfiltration.
Need cloud coverage? NSAuditor AI Enterprise extends the audit across AWS, GCP, and Azure with the full hepta-framework compliance engine, air-gapped operation, and continuous monitoring (CTEM).
Start with the MIT-licensed Community Edition. Upgrade only when you need CVE matching and risk-scored prioritization, compliance evidence, or cloud scanners.
EE 0.38.0 — an evidence pack can now be signed, and the verifier checks more than the signature
Enterprise Edition 0.38.0, published 17 August 2026 alongside Community Edition 0.2.43 and the agent-skill package 0.2.41 — the 96th consecutive trio. An evidence pack has always carried a SHA-256 chain of custody. Now it can carry an approver’s name as well. compliance sign-pack signs one framework’s chain-of-custody envelope with an operator-held Ed25519 key at an approval station, so the scan fleet stays keyless by design and a compromised scanner cannot mint authorship. compliance verify-pack establishes authorship from that signature and then recomputes every artifact hash the envelope enumerates against the files on disk — because a verifier that checked only the signature would authenticate artifact claims nothing had ever verified, and report that as a pass. Two trust anchors, and the tool says which one it used: --registry resolves the approver through your identity registry and checks revocation and validity as at the moment of signing, so a key whose authority has since lapsed does not retroactively invalidate what it signed while valid; --public-key verifies against a key you supply and discloses in its own output that those checks did not run.
Stated precisely, because scope is the whole point: a verified pack signature proves that the holder of a key asserted authorship of one framework’s chain-of-custody envelope and the artifacts that envelope enumerates — not the output directory and not the pack — and because the key is operator-held, authorship is relative to your own key custody and is never a vendor attestation. verify-pack prints that boundary on every run, successful ones included. The signed bytes ship beside the signature, so an auditor can reproduce the check with shasum -a 256 and openssl pkeyutl -verify and no NSAuditor code in the loop. Exit codes distinguish three states rather than two — verified, a violation, and the run could not measure — so an unsigned pack is never reported as a failed one. Requires Community Edition 0.2.43 or newer, raised this cycle because both new commands are routed from Community Edition. Plugin catalog unchanged at 28; all seven coverage matrices unchanged.
Full release history: the Enterprise page and the package changelogs on npm.