NSAuditor AI

Security Intelligence Without Data Exposure.

A modular, AI-assisted network security audit platform that scans, understands, prioritizes, and tracks vulnerabilities — without ever requiring your data to leave your infrastructure.

NSAuditor AI is the open-source core of a privacy-first security intelligence platform built by Nsasoft US LLC. It orchestrates 27 specialized scanning plugins against target hosts, fuses their results through an intelligent concluder, and optionally produces AI-powered vulnerability reports — all running entirely on your machine.

Zero Data Exfiltration by design. NSAuditor AI works fully offline. AI analysis, CVE correlation, and continuous monitoring all happen locally. External calls (to AI APIs, NVD, etc.) are opt-in and use your own API keys. We never see your scan data.

What's New

Network-scan false-negative closures on the analysis agents (CE 0.2.31 / Enterprise 0.32.6). No CE code change this cycle — a paired bump for Enterprise 0.32.6, a matrix-neutral false-negative-hardening release on the EE analysis-agent (network-scan) path: cleartext transport is now flagged where before only weak-TLS-where-TLS-exists was — a service that should be encrypted but offers no TLS at all used to read clean (→ SOC 2 CC6.7); SMB-alone exposure is now its own HIGH finding rather than being silenced by an SMB && RDP conjunction — SMB without RDP is the higher-risk case (→ CC6.6); and WinRM 5985/5986 · Elasticsearch 9300 · MSRPC 135 · a new aggregate open-port-count rule are new exposure signals (→ CC6.6). Routed SOC 2-first with drift-detector coverage; SOC 2 routing only this cycle — cross-framework mappings (HIPAA §164.312(e)(1) · CIS · NIST) deferred. Plugin count UNCHANGED at 28; all seven coverage matrices UNCHANGED. See CHANGELOG.md for the full per-release history.

Marketplace registration in CLI help + report-quality / routing-integrity release (CE 0.2.30 / Enterprise 0.32.5). CE now surfaces AWS Marketplace license registration in --help and in nsauditor-ai license --status, so a Marketplace buyer can find the registration step without leaving the CLI. Paired with Enterprise 0.32.5, a matrix-neutral report-quality release: nine API Gateway (plugin 1050) mapping rules matched zero findings — eight were re-sourced, and the ninth (a HIPAA §164.312(c)(1) Integrity mapping) was removed on doctrine rather than repaired, because a WAF integration that fails closed alters no ePHI. Routing was never broken and no finding was ever missed: correctly-sourced catch-all rules already failed the same controls, verified by ablation. The real defect was report prose — first-match-wins surfaced a stale auditor-facing rationale while the accurate per-class rationale sat unreachable. Also: six auditor-facing rationales in that API-Gateway cohort were rewritten (a cohort fix, not a class fix — other rationales across the framework files still carry internal-development-history wording), the JSON report artifact no longer serializes raw routing regexes or rule sources, a genuine CI/CD false-clean was closed (a codebuild:ListProjects AccessDenied was warning-only, and warnings route to zero controls, so CI/CD controls could read clean over an un-enumerated inventory — now fail-closed into the existing evidence gap), and three compliance guards were hardened (one had been suppressed by a factually false comment; another had silently become a tautology; a third adds an expected-unmapped equality table). Plugin count UNCHANGED at 28; all seven coverage matrices UNCHANGED.

RDS false-negative depth pass, part 2 (CE 0.2.29 / Enterprise 0.32.4). No CE code change this cycle — a paired bump for Enterprise 0.32.4, a matrix-neutral RDS false-negative-and-report-quality depth pass on plugin 1140: RDS Proxy client↔proxy TLS (a proxy with RequireTLS off accepts cleartext client connections — a transit leg distinct from the DB-engine SSL parameter — now a fail-closed HIGH), a new retained / cross-region-replicated automated-backup at-rest surface (an unencrypted automated backup that survives instance/cluster deletion, invisible to the live-resource and snapshot scans, is now caught), the Aurora cluster-member double-audit closure (a provisioned Aurora cluster's members no longer double-report the cluster-scoped SSL / Multi-AZ settings as instance-level false positives), and a cross-framework report-quality leak closure (a renderer backstop strips foreign framework control-ids out of the violation prose that renders into every framework report). No new plugins, all seven coverage matrices unchanged. See CHANGELOG.md for the full per-release history.

→ See a sample EE scan output: walk-through with synthetic Acme Corp AWS account (no signup required)

What It Does

Scan → Verify → Prioritize → Track → Act

• 27 scanner plugins probe networks across ICMP, TCP, UDP, HTTP, TLS, SNMP, DNS, SMB, RPC, mDNS, UPnP, WS-Discovery, MCP (Model Context Protocol), and more
• Smart result fusion — the Result Concluder merges all plugin outputs into a normalized view with OS detection, service fingerprinting, and evidence linking
• Structured finding format — all findings use a common schema with category, severity, evidence, and remediation — enabling consistent SARIF export and MCP integration
• AI-powered analysis — send redacted scan results to OpenAI or Claude (your keys, your choice) for vulnerability assessments and remediation guidance
• Verified vulnerabilities (Pro) — safe, non-destructive probes confirm findings are real, not just version-matched guesses. If it can't be verified, it's flagged as "potential" not "confirmed"
• Continuous monitoring (CTEM) — watch mode rescans on a schedule, diffs against previous results, and fires webhook alerts on changes
• MCP integration — expose scanning tools to AI assistants like Claude Code via Model Context Protocol
• CI/CD ready — SARIF output with --fail-on severity gating for pipeline integration

Editions

NSAuditor AI is available in three editions: Community (free, MIT-licensed, no restrictions), Pro ($49/mo), and Enterprise ($2k+/yr).

Why upgrade to Enterprise?

If you're heading into a SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS Controls v8, or GDPR Article 32 audit — or need to satisfy customer security questionnaires citing those frameworks, or an IG1 attestation for cyber-insurance renewal — Enterprise turns scan output into auditor-ready evidence packs that pass institutional scrutiny:

• ☁️ 28 cloud plugins across AWS / Azure / GCP — find the configuration risks an auditor will flag, before they do (CloudTrail integrity, KMS custody, S3 Object Lock, IAM shadow-admin paths, GCP IAM impersonation chains, Azure RBAC sprawl, and more)
• 📋 7 compliance frameworks shipped — generate any combination from a single scan:
  • SOC 2 (AICPA TSC 2017) — 10 fully-covered + 4 partial controls
  • HIPAA Security Rule §164.312 — 7 covered + 3 partial Technical Safeguards; Zero BAA required (ePHI never leaves your infrastructure)
  • NIST CSF 2.0 Core (NIST CSWP 29, Feb 2024) — 13 covered + 10 partial Subcategories across 106 of CSF 2.0's 107 Subcategories; Subcategory-level mapping (auditor-canonical, not high-level Function/Category claims)
  • PCI DSS v4.0.1 (PCI SSC, June 2024 errata; v3.2.1 retired March 31, 2024) — 19 covered + 9 partial + 39 OOS sub-requirements across 67 of ~250 (MVP-67); sub-requirement-level mapping for QSA Report on Compliance workflow; Defined-vs-Customized Approach discipline per Appendix E (15 Defined-only sub-requirements enforced at schema layer); CHD Scope operator-attested via CDE Data Flow Diagram per Req 1.2.4; Card-brand AOC enforcement priority view (Visa CISP / Mastercard SDP / Amex DSOP / Discover DISC)
  • ISO/IEC 27001:2022 (ISO + IEC, Oct 2022; 2013 edition retired Oct 31, 2025) — 17 covered + 14 partial + 62 OOS across 93 Annex A controls (the complete Annex A universe); per-Annex-A-code mapping auditor-canonical for ISO/IEC 17021-1 certification body assessors; Statement of Applicability per Clause 6.1.3.d discipline + ISMS Clauses 4-10 OOS-by-design with 7 Major Nonconformity classes
  • CIS Critical Security Controls v8 (CIS, May 2021; v8.1 errata June 2024) — 17 covered + 23 partial + 113 OOS across 153 Safeguards / 18 Controls; per-Safeguard mapping with the Implementation Group cumulative discipline (IG1=56 cyber-insurance baseline / IG2 cumulative=130 / IG3 cumulative=153); no-certification-body attestation discipline (INPUT to your CSAT / CIS-CAT Pro self-attestation, never "CIS certified"); Cloud Companion Guide v8 shared-responsibility + CIS-Hardened-Image substrate-evidence credit (4.1/4.2/4.6)
  • GDPR Article 32 (Security of Processing) (Regulation (EU) 2016/679) — 4 covered + 5 partial + 2 OOS across 11 Art. 32 sub-measure units; GDPR Article 32 infrastructure substrate only — NOT GDPR compliance (GDPR is a 99-article legal regime; Art. 32 security-of-processing is the only article an infrastructure scanner can substrate-evidence; the rest is operator-side, out of scope by design). Four-factor proportionality (substrate for your "appropriate to the risk" determination, never an absolute pass/fail); personal-data-scope attestation (pair with your Art. 30 records of processing); Art. 83(4) lower fine tier (€10M/2%, not the €20M/4% headline tier); Art. 32(3)/Art. 42 cloud-provider certification-inheritance
• 🔐 Cryptographically signed evidence — SHA-256 chain-of-custody + RFC 3161 trusted timestamps + Ed25519 suppression signing. Non-repudiation, not just integrity. Auditors can verify offline.
• 🏛️ Zero Data Exfiltration architecture — your scan data never leaves your infrastructure. Air-gapped deployment supported. AI analysis happens locally (Ollama) or via your own API keys. Important for PCI DSS CDE-isolation threat models.
• 🔗 GRC connectors — Vanta + Drata + Secureframe (Enterprise) — map compliance findings to your GRC platform's evidence/test records and push them at scan time (opt-in). Suppression-aware outcome mapping (Vanta) / structured records (Drata + Secureframe), idempotent retries, rate-limit handling, token redaction, and Zero-Data-Exfiltration egress redaction. Early-access, single-workspace; live validation against production tenants is in progress. See GRC Connectors below.
• 🗄️ WORM evidence storage — S3 Object Lock COMPLIANCE-mode for SEC Rule 17a-4(f) / FINRA 4511 retention compliance
• 📊 SLA / MTTR tracking + recurring-scan attestation — the Type II operating-effectiveness evidence auditors actually demand (not just point-in-time snapshots)
• 🎯 11 adversarial-audit Claude Code skills authored per the Per-Framework Adversarial-Audit Skill Pairing institutional pattern — Phase-4 Compliance/GRC chain 8-of-8 COMPLETE for all shipped frameworks (SOC 2 + HIPAA + NIST CSF + PCI DSS + ISO 27001 + CIS Controls v8 + GDPR Article 32 + GRC connector)

→ See sample EE scan output — full evidence pack against synthetic Acme Corp AWS account (no signup required) → Buy NSAuditor AI Enterprise Edition — $2k / $5k / $10k+ per year for 5 / 25 / unlimited seats + custom SLA. Onboarding call included.

Prefer to buy through AWS Marketplace?

Enterprise Edition is also available as an AWS Marketplace container listing — same product, same local ES256 license key, billed through your AWS account (consolidated billing / EDP drawdown, procurement-friendly; custom Enterprise terms via AWS Private Offers). The listing is public. If it doesn't resolve in your AWS region or account, contact us and we'll extend a Private Offer directly.

How Marketplace fulfillment works (ZDE and air-gap preserved — no runtime AWS dependency at scan time):

1. Subscribe on the listing (tiers base / growth / scale mirror the 5 / 25 / unlimited-seat plans).
2. Register your email + AWS account ID at the URL shown in the listing's usage instructions — your ES256 license key arrives by email.
3. Pull and run the Docker image from the Marketplace registry (commands in the listing's usage instructions and your license email) with NSAUDITOR_LICENSE_KEY=<your key>. One tier-agnostic image — upgrades are just a new license key, never a new image. The container runs fully offline after that; billing lives in AWS, enforcement is your local key.

Feature comparison

This repository is the Community Edition — fully functional, MIT-licensed, no restrictions, no telemetry. Pro and Enterprise features ship via the @nsasoft/nsauditor-ai-ee package and install alongside the CE binary once licensed.

→ Get Pro or Enterprise →

GRC Connectors (Vanta, Drata, Secureframe)

Enterprise feature. Requires @nsasoft/nsauditor-ai-ee.

Every compliance scan already produces a GRC-ready JSON evidence artifact. The GRC connectors take the next step: they map each NSAuditor compliance finding to your GRC platform's own evidence/test records and push them at scan time — so your Vanta, Drata, or Secureframe workspace reflects the latest cloud posture without a manual export/import round-trip.

Opt-in, and Zero-Data-Exfiltration by default. The push is off unless you set the environment variables below. When it runs, egress is redaction-gated: resource identifiers can be hashed or removed, the persisted audit log stores a body fingerprint (never the raw payload), and your API token is never written to any artifact. Nothing leaves your infrastructure that you didn't opt into.

# Enable the scan-time push (Enterprise)
COMPLIANCE_GRC_PROVIDER=vanta        # or: drata | secureframe
COMPLIANCE_GRC_TOKEN=<your API key>  # never serialized to artifacts
# Optional:
# COMPLIANCE_GRC_REDACTION=hash      # off | hash | remove  (egress identifier redaction)
# COMPLIANCE_GRC_CONTROL_MAP=/path/to/config.json  # provider config: Vanta control→test map, Drata connection ({connectionId, resourceId, schemaMap}), or Secureframe ({workspaceId, collectionId, schemaMap})

Reliability + audit-integrity built in: idempotent retries (a network-timed-out push won't create duplicate records), per-attempt + total-duration timeout caps, a consecutive-failure circuit breaker, token redaction across every log and error path, and a durable per-control push audit log written next to your scan artifacts.

Honest status. The Vanta, Drata, and Secureframe connectors are shipped, opt-in, and covered by an extensive test suite. Live validation against production Vanta / Drata / Secureframe tenants is in progress as partner onboarding proceeds — until it completes, treat production use as early-access and validate against your own tenant first. This is a single-workspace, operator-configured connector; it is not a multi-tenant managed sync. (Secureframe's API shape is published-assumed pending partner intake; its idempotency keys are SENT but vendor-side dedup is unverified.)

Quick Start

# Install globally
npm install -g nsauditor-ai

# See all flags, subcommands, and worked examples
nsauditor-ai --help

# Configure (optional — scans work fully offline without AI)
cat > .env << 'EOF'
AI_ENABLED=true
AI_PROVIDER=ollama              # openai | claude | ollama
OLLAMA_MODEL=llama3             # For local AI (no API key needed)
# OPENAI_API_KEY=sk-...         # Or use OpenAI
# ANTHROPIC_API_KEY=sk-ant-...  # Or use Claude
OPENAI_REDACT=true
EOF

# Scan a host with all plugins
nsauditor-ai scan --host 192.168.1.1 --plugins all

# Scan a subnet in parallel
nsauditor-ai scan --host 192.168.1.0/24 --plugins all --parallel 10

# Start the MCP server for AI assistants
nsauditor-ai-mcp

Or run without installing:

npx nsauditor-ai scan --host 192.168.1.1 --plugins all

Or clone and run from source:

git clone https://github.com/nsasoft/nsauditor-ai.git
cd nsauditor-ai
npm install
node --env-file=.env cli.mjs scan --host 192.168.1.1 --plugins all

Results land in ./out/<host>_<timestamp>/:

Works on Node 20+ (tested on Node 22).

Plugins

Core Scanners

Discovery Plugins

Pro/Enterprise Plugins (via @nsasoft/nsauditor-ai-ee)

28 enterprise plugins across AWS, GCP, and Azure substrate audits — all mapped to AICPA Trust Services Criteria 2017 (10 covered + 4 partial controls). EE plugins live in the disjoint 1000+ ID range; CE reserves 001-099. Once licensed, the EE package installs alongside the CE binary and discovers automatically.

→ Watch a sample scan run end-to-end — synthetic Acme Corp AWS account + home-office router. Real real scan output, no signup required. See the transitive SG chain reachability finding, the multi-region GuardDuty audit, the dnsmasq CVE detection, and what the signed evidence pack actually looks like.

→ Buy NSAuditor AI Enterprise Edition · $2k / $5k / $10k+ per year · 5 / 25 / unlimited seats · onboarding call included.

All EE plugins follow the same institutional plumbing pattern:

• Thread H _instrumentSdkClient wrap — per-API AccessDenied counter + ZDE structural guard (verb-prefix denylist regex blocks Get* / Retrieve* / Read* value-reading APIs at SDK boundary) + idempotency sentinel
• Throttle-retry — exponential-backoff retry on Throttling* / RequestLimitExceeded / TooManyRequestsException with per-command wall-clock budget
• Thread F conclude() field-selection allowlist — structured-data ZDE: only AWS-public-namespace identifiers + integer counts flow through to findings; customer policy content / key material / encrypted payloads NEVER propagate
• conservative_classifier_principle — emit INFO+evidenceGap with verification prompt when ARN-shape disambiguation needs a follow-up API call; vacuous PASS on partial substrate evidence is treated as the worst SOC 2 reporting outcome
• aws_string_case_normalization — trim + lowercase AWS-returned strings at SDK-helper boundary; protects against the 7+ recurrent classes of case-sensitivity fail-open (IAM Condition keys, Lambda runtimes, KMS aliases, Effect/Action discriminators, FULL_ADMIN sentinel, S3 region)