AI-Powered Network Security Audits Without Data Exposure.
NSAuditor AI is an open-core, AI-powered network security audit platform that runs agentless, read-only, and entirely on your infrastructure. Nothing is installed across your estate, credentials are read-only by design, and every outbound path is opt-in and off by default.
With 56 plugins for networks and AWS, Azure, and GCP, one scan delivers risk-scored security findings, exploit-first prioritization using CISA KEV and FIRST EPSS, MITRE ATT&CK mapping, and auditor-ready evidence mapped to 8 compliance frameworks: SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2.
Evidence packs include SHA-256 chain-of-custody manifests and opt-in RFC 3161 trusted timestamps. Operator-held Ed25519 signatures can be verified offline. NSAuditor AI supports air-gapped environments and reports evidence gaps explicitly—never claiming an unassessed surface is secure.
One scan. Technical security assessment. Eight compliance frameworks. Verifiable evidence. Zero data exfiltration.
An open-core scanner with risk-scored findings, threat intelligence, and octa-framework compliance evidence — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2 — built so your audit trail holds up to a CPA-firm review, a QSA RoC walkthrough, an ISO Stage 2 assessment, a CIS-CAT self-attestation, and a GDPR Article 32 review.
Risk-Scored Prioritization
Every finding carries a composite risk score — severity × exploitability × impact × exposure — so the queue sorts worst-first, and an operator suppression workflow tracks accepted-risk and false-positive dispositions with expiry.
Findings are mapped to MITRE ATT&CK techniques with kill-chain context, so you can show your CISO what an attacker would actually do — not just CVE noise.
A network security audit is a systematic review of your network — hosts, ports, services, configurations, and cloud accounts — to find vulnerabilities, misconfigurations, and compliance gaps before an attacker does.
NSAuditor AI runs that audit locally: it discovers live hosts and services, fingerprints them with safe, non-destructive probes, matches those versions against CVE data offline, maps each finding to MITRE ATT&CK, and generates auditor-ready evidence for eight frameworks — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2 — from a single scan. Unlike SaaS scanners, every step runs on your own infrastructure, so a complete network security audit happens with zero data exfiltration.
Need cloud coverage? NSAuditor AI Enterprise extends the audit across AWS, GCP, and Azure with the full octa-framework compliance engine, air-gapped operation, and continuous monitoring (CTEM).
Start with the MIT-licensed Community Edition. Upgrade only when you need CVE matching and risk-scored prioritization, compliance evidence, or cloud scanners.
Silence is not a pass: every scan reports exactly the estate it examined
Enterprise Edition 0.43.0 is the current release, published 2 September 2026 alongside Community Edition 0.2.50 and the agent-skill package 0.2.48. A cloud provider whose scanner did not run is now reported as not audited — with the reason stated, and with its findings absent rather than empty — so the provider summary describes precisely what was scanned, and compliance verdicts keep failing closed over any unscanned surface.
Evidence gaps state the cause an assessor needs, not a command to type. Operator remediation stays on the operator channel, where it can be acted on, which matters most in air-gapped installations. The two causes are labelled distinctly — a plugin skipped by scope versus a scanner that did not start — because the remedies differ. And the restricted offline carrier is now pinned to the dependency versions its own test suite runs against, so two builds of the same source produce identical bytes and the delivery that crosses an air gap is the one that was exercised.
29 Enterprise auditors, 56 plugins overall, all eight frameworks; every coverage matrix is unchanged because this release deepens the honesty of controls already covered. The Community Edition floor is unchanged at 0.2.49 or newer — install Community Edition first. Previously — EE 0.42.0 (27 August 2026): sovereign and government estates audited as themselves, with partition-correct AWS auditing, fail-closed Azure sovereign-cloud selection, an SBOM of the installed package and a published FIPS posture. See the Enterprise plugin catalog →
Full release history: the Enterprise page and the package changelogs on npm.