AI-Powered Network Security Audits Without Data Exposure.
NSAuditor AI is an open-core, AI-powered network security audit platform — the modern successor to our classic network security auditor for Windows. Run a full network security audit with risk-scored findings, MITRE ATT&CK mapping, and seven-framework compliance evidence — SOC 2 (AICPA TSC), HIPAA §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, and GDPR Article 32 — running entirely on your infrastructure. Your data never touches our servers.
An open-core scanner with risk-scored findings, threat intelligence, and hepta-framework compliance evidence — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, and GDPR Article 32 — built so your audit trail holds up to a CPA-firm review, a QSA RoC walkthrough, an ISO Stage 2 assessment, a CIS-CAT self-attestation, and a GDPR Article 32 review.
Risk-Scored Prioritization
Every finding carries a composite risk score — severity × exploitability × impact × exposure — so the queue sorts worst-first, and an operator suppression workflow tracks accepted-risk and false-positive dispositions with expiry.
Findings are mapped to MITRE ATT&CK techniques with kill-chain context, so you can show your CISO what an attacker would actually do — not just CVE noise.
A network security audit is a systematic review of your network — hosts, ports, services, configurations, and cloud accounts — to find vulnerabilities, misconfigurations, and compliance gaps before an attacker does.
NSAuditor AI runs that audit locally: it discovers live hosts and services, fingerprints them with safe, non-destructive probes, matches those versions against CVE data offline, maps each finding to MITRE ATT&CK, and generates auditor-ready evidence for seven frameworks — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, and GDPR Article 32 — from a single scan. Unlike SaaS scanners, every step runs on your own infrastructure, so a complete network security audit happens with zero data exfiltration.
Need cloud coverage? NSAuditor AI Enterprise extends the audit across AWS, GCP, and Azure with the full hepta-framework compliance engine, air-gapped operation, and continuous monitoring (CTEM).
Start with the MIT-licensed Community Edition. Upgrade only when you need CVE matching and risk-scored prioritization, compliance evidence, or cloud scanners.
EE 0.32.9 — a cleaner evidence pack, and a gap that no longer hides
Enterprise Edition 0.32.9, published 29 July 2026 alongside Community Edition 0.2.34 and the agent-skill package 0.2.32. Plugin count and all seven coverage matrices are unchanged from 0.32.8 — 28 cloud plugins, SOC 2 10/4 · HIPAA 7/3 · NIST CSF 13/10 · PCI DSS 19/9 · ISO 27001 17/14 · CIS v8 17/23 · GDPR Art. 32 4/5.
Internal engineering identifiers are out of the report. A compliance report is a document you hand your auditor, so it should read like one. Ours had been carrying internal engineering identifiers — roadmap ids, internal release stamps, the name of an internal audit review — in finding titles, on the attestation cover page, and in the chain-of-custody record. Measured on a rebuilt three-cloud evidence pack, 686 unexplained internal-marker occurrences went to 0 across 105 files, with a positive control in the same run (3,572 benign matches still detected) so the zero is a measurement rather than an absence of looking.
A cloud that could not be scanned no longer reads clean. When a cloud plugin could not start — an optional SDK absent, credentials unusable — it refused to report, and that refusal evaporated one layer up: the compliance report came out byte-identical to one where the scanner ran and found nothing. Ten controls read PASS, with no violation and no warning. The dangerous shape is an ordinary one: AWS and GCP scan for real, Azure's SDK is absent, and the combined pack reads as a clean three-cloud audit. Now every in-scope control of a cloud that could not be scanned carries a fail-closed evidence gap.
Also in this release: an archived scan re-processed by the new build warns instead of failing clean; four report surfaces that contradicted each other on trusted timestamping now say the same verifiable thing; and in the Community Edition, --out <dir> no longer writes to the parent directory when the directory name contains a dot.
Upgrading from 0.32.8: the evidence-gap finding title changed, so suppression rules that matched the old text stop matching — that is the safe direction, since findings resurface rather than hide, but the change is silent. And re-scan rather than re-processing scans captured before 0.32.9; the engine now warns on them.