AI-Powered Network Security Audits Without Data Exposure.
NSAuditor AI is an open-core, AI-powered network security audit platform that runs agentless, read-only, and entirely on your infrastructure. Nothing is installed across your estate, credentials are read-only by design, and nothing goes to Nsasoft. Beyond the scan’s own traffic (your targets and local segment, DNS, your own cloud’s APIs) and NIST’s public NVD API for CVE matching (off with NSAUDITOR_OFFLINE_ONLY=1 and a local NVD store), every outbound path is opt-in and off by default.
With 56 plugins for networks and AWS, Azure, and GCP, one scan delivers risk-scored security findings, exploit-first prioritization using CISA KEV and FIRST EPSS, MITRE ATT&CK mapping, and auditor-ready evidence mapped to 8 compliance frameworks: SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2.
Evidence packs include SHA-256 chain-of-custody manifests and opt-in RFC 3161 trusted timestamps. Operator-held Ed25519 signatures can be verified offline. NSAuditor AI supports air-gapped environments and reports evidence gaps explicitly—never claiming an unassessed surface is secure.
One scan. Technical security assessment. Eight compliance frameworks. Verifiable evidence. Zero data exfiltration.
An open-core scanner with risk-scored findings, threat intelligence, and octa-framework compliance evidence — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2 — built so your audit trail holds up to a CPA-firm review, a QSA RoC walkthrough, an ISO Stage 2 assessment, a CIS-CAT self-attestation, and a GDPR Article 32 review.
Risk-Scored Prioritization
Every finding carries a composite risk score — severity × exploitability × impact × exposure — so the queue sorts worst-first, and an operator suppression workflow tracks accepted-risk and false-positive dispositions with expiry.
Findings are mapped to MITRE ATT&CK techniques with kill-chain context, so you can show your CISO what an attacker would actually do — not just CVE noise.
One scan produces eight auditor-ready evidence packs: SOC 2 (AICPA TSC 2017), HIPAA §164.312 Technical Safeguards, NIST CSF 2.0, PCI DSS v4.0.1 (sub-requirement-level for QSA RoC; every citation derived from the standard itself), ISO/IEC 27001:2022 (per-Annex-A-code with Statement of Applicability discipline), and CIS Critical Security Controls v8 (per-Safeguard with the Implementation Group cumulative discipline — IG1 cyber-insurance baseline / IG2 / IG3; no-certification-body attestation via CSAT / CIS-CAT Pro), and GDPR Article 32 (Security of Processing — infrastructure substrate for Art. 32 only, not GDPR compliance; 4/5/2 across 11 sub-measure units), and NIST SP 800-171 Rev 2 (evidence substrate for CMMC Level 2 preparation — all 110 Rev 2 requirements enumerated; 2/49/59). SHA-256 chain-of-custody sidecars you can verify offline, and opt-in outbound push to Vanta, Drata or Secureframe. No BAA with Nsasoft required.
A network security audit is a systematic review of your network — hosts, ports, services, configurations, and cloud accounts — to find vulnerabilities, misconfigurations, and compliance gaps before an attacker does.
NSAuditor AI runs that audit locally: it discovers live hosts and services, fingerprints them with safe, non-destructive probes, matches those versions against CVE data offline, maps each finding to MITRE ATT&CK, and generates auditor-ready evidence for eight frameworks — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2 — from a single scan. Unlike SaaS scanners, every step runs on your own infrastructure, so a complete network security audit happens with zero data exfiltration.
Need cloud coverage? NSAuditor AI Enterprise extends the audit across AWS, GCP, and Azure with the full octa-framework compliance engine, air-gapped operation, and continuous monitoring (CTEM).
Watch: how do you actually run a network security audit on a cloud account in 2026?
A seven-minute how-to in six steps: scope it before you scan, use read-only credentials, check the scan actually audited, read the findings the way your auditor will, hand over what you did not examine too, and let the auditor verify it with standard shasum and openssl. English captions. Also on YouTube.
Three editions
Free, Pro, and Enterprise
Start with the MIT-licensed Community Edition. Upgrade only when you need CVE matching and risk-scored prioritization, compliance evidence, or cloud scanners.
EE 2.0.0 — Node.js 24, the resolved-address pin, the drift file and its notification, an AI payload with no AWS account ID; paired with Community 1.0.0
Your compliance posture moves between audits — Enterprise 2.0.0 shows you what moved. Node.js 24 is the supported runtime. Every one-shot compliance scan writes what changed since the previous scan beside its pack — controls to fail or to pass, controls that lost measurement, violations new or cleared, and what could not be measured, never read as cleared — and can notify a webhook, Slack or Teams when a control goes to fail or loses measurement, when a new violation reaches a severity you set, or when the drift could not be compared. A scan connects only to the addresses its host check resolved (Community 1.0.0), the AI payload carries no AWS account ID, and plugin 040’s weak-key and weak-signature findings fail the certificate control in six of the eight frameworks. The drift file, scan_drift_<fw>.json, sits beside each compliance pack: a violation is cleared only when this scan looked for it and it was gone, and one whose scanner did not run or reported itself down, or whose port or region was not measured, is listed as could-not-measure with its reason. The notification is opt-in and CLI only — --notify-webhook (public https only), --notify-format generic|slack|teams and --notify-severity, not --watch and not the MCP server; a drift that could not be compared with a previous run always notifies, but the first scan, with no previous run, is the baseline and sends nothing; the payload is minimal by default. The pin applies on the CLI and through the MCP server, for the target and each redirect hop. In the AI payload an account ID in an ARN or an AWS URL becomes [ACCOUNT_ID] everywhere it occurs, and any other 12-digit number [REDACTED_ID]; the system prompt is written beside the payload before the request, so the two files are what left the machine. The certificate control now fails on plugin 040’s weak-key and weak-signature findings in SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022 and CIS v8; GDPR Article 32 and NIST SP 800-171 stay held for review. And on TCP, a row from a port’s authoritative probe that did not identify its service is now evidence with a reason, not a service row, so the CSV, SARIF, the Markdown report and the AI payload no longer list it.
Where it stops, stated: a notification retried after a timeout or a server error can arrive twice, and a hanging endpoint can cost about 32 seconds per framework. A scan that found its ports with the Nmap plugin (024) alone has no port oracle, so a violation on a port that scan did not measure can be listed as cleared; include the port scanner (003) in the scans you compare. The pin does not hold through an HTTP proxy set with NODE_USE_ENV_PROXY, which resolves the name itself, or over an idle connection opened earlier to the same name, for as long as the target keeps it open. UDP non-answers stay in the service list: a UDP silence is open-or-filtered, and the delta reads those rows. A probe with no adapter of its own can still list a port it did not identify, with a status other than open: on a router scan, the SUN RPC plugin listed port 111, which the port scanner had measured closed. Enterprise Edition 2.0.0 is the current release, published 2026-10-15 alongside Community Edition 1.0.0 and the agent-skill package 1.0.0. Coverage: all eight coverage matrices unchanged since EE 1.3.0.
29 Enterprise auditors, 56 plugins overall, all eight frameworks. The Community Edition floor is 1.0.0 or newer — install Community Edition first. Enterprise 2.0.0 runs on Node.js 24; upgrade both packages together: npm i -g nsauditor-ai@1.0.0 @nsasoft/nsauditor-ai-ee@2.0.0. Enterprise 2.0.0 imports a name that first ships in Community 1.0.0; below it Enterprise’s core does not load while its plugins still do — on Community 0.2.57 as on 0.2.56 — so the scan skips its intelligence, analysis-agent and compliance stages: Community 0.2.56 and later name that on stderr, and 0.2.55 or older says nothing. Rotate a webhook URL a logged --watch run printed: it printed the full --webhook-url to stdout, and now prints the host. A weak certificate under a trusted CA now reads as the weak-key or weak-signature finding alone, not also as an untrusted chain; a weak certificate under an untrusted CA still reads untrusted. Compared across the upgrade, the phantom rows’ disappearance reads as not measured, never as fixed. See the Enterprise plugin catalog →
Full release history: the Enterprise page and the package changelogs on npm.