AI-Powered Network Security Audits Without Data Exposure.
NSAuditor AI is an open-core, AI-powered network security audit platform — the modern successor to our classic network security auditor for Windows. Run a full network security audit with risk-scored findings, exploit-first triage (CVE findings joined to the CISA KEV catalog and FIRST EPSS scores at scan time, so a known-exploited MEDIUM outranks an unexploited CRITICAL), MITRE ATT&CK mapping, and seven-framework compliance evidence — SOC 2 (AICPA TSC), HIPAA §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, and GDPR Article 32 — running entirely on your infrastructure. Your data never touches our servers.
An open-core scanner with risk-scored findings, threat intelligence, and hepta-framework compliance evidence — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, and GDPR Article 32 — built so your audit trail holds up to a CPA-firm review, a QSA RoC walkthrough, an ISO Stage 2 assessment, a CIS-CAT self-attestation, and a GDPR Article 32 review.
Risk-Scored Prioritization
Every finding carries a composite risk score — severity × exploitability × impact × exposure — so the queue sorts worst-first, and an operator suppression workflow tracks accepted-risk and false-positive dispositions with expiry.
Findings are mapped to MITRE ATT&CK techniques with kill-chain context, so you can show your CISO what an attacker would actually do — not just CVE noise.
A network security audit is a systematic review of your network — hosts, ports, services, configurations, and cloud accounts — to find vulnerabilities, misconfigurations, and compliance gaps before an attacker does.
NSAuditor AI runs that audit locally: it discovers live hosts and services, fingerprints them with safe, non-destructive probes, matches those versions against CVE data offline, maps each finding to MITRE ATT&CK, and generates auditor-ready evidence for seven frameworks — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, and GDPR Article 32 — from a single scan. Unlike SaaS scanners, every step runs on your own infrastructure, so a complete network security audit happens with zero data exfiltration.
Need cloud coverage? NSAuditor AI Enterprise extends the audit across AWS, GCP, and Azure with the full hepta-framework compliance engine, air-gapped operation, and continuous monitoring (CTEM).
Start with the MIT-licensed Community Edition. Upgrade only when you need CVE matching and risk-scored prioritization, compliance evidence, or cloud scanners.
EE 0.37.0 — vulnerability data you can carry onto a network that cannot fetch it
Enterprise Edition 0.37.0, published 16 August 2026 alongside Community Edition 0.2.42 and the agent-skill package 0.2.40 — the 95th consecutive trio. A scanner on an isolated network has a standing problem: the vulnerability data it matches against lives on the internet, and it does not. The offline CVE store and its hardened ingest path have shipped for several releases — and no shipped entry point could reach them, which is why offline CVE matching was never advertised as delivered. Two commands close it. nsauditor-ai feed bundle merges the NVD feed files you downloaded on a connected host into one portable archive; feed import reads it into the offline store on the isolated one and names why it skipped records — roughly a quarter of a real NVD year file is skipped by design, being withdrawn CVEs and entries with no CPE match data, and that is not data loss. Optional --kev and --epss carry your own CISA KEV catalogue and FIRST EPSS scores inside the same archive, validated on the connected host where a bad download can still be replaced.
What it deliberately does not say: no CVE, KEV or EPSS data ships with this product — every catalogue is one you downloaded. A carried bundle is integrity-checked, not authenticated: the recorded SHA-256 detects a file altered in transit, but it travels inside the archive it covers, so it cannot establish who built it. Air-gapped delivery ships as a dependency-complete bundle with an install script and checksums — a restricted distribution, amd64 only; no container image bundle ships and arm64 images remain WITHDRAWN. Requires Community Edition 0.2.42 or newer, raised this cycle because the new entry points live in Community Edition. Plugin catalog unchanged at 28; all seven coverage matrices unchanged.
Full release history: the Enterprise page and the package changelogs on npm.