compliance_matrix: NSAuditor AI Gives Your AI Assistant an Authoritative Answer on Compliance Coverage

Security tooling has quietly acquired a new class of user. Alongside the engineer at a terminal and the auditor with a checklist, there is now an AI assistant sitting in the middle of the workflow, reading the tool’s output and answering questions about it in natural language — for the security team, and increasingly for the buyer evaluating the product.

That user has a specific failure mode. Asked a question the tool exposes no data for, an assistant will not usually say “unknown.” It will reason from whatever it can see and produce a confident, plausible, wrong number.

NSAuditor AI Enterprise 0.32.11, released 5 August 2026 with Community Edition 0.2.36 and agent-skill 0.2.34, closes that gap with a new MCP tool built for exactly this reader.

One question, one authoritative answer

The new compliance_matrix tool returns the shipped coverage matrix for any of the seven supported frameworks — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8 and GDPR Article 32. Ask an assistant what NSAuditor covers for SOC 2 and the answer is now read out of the product rather than inferred around it:

SOC 2 (AICPA TSC)
  covered      10
  partial       4
  out of scope 37
  ─────────────────
  total        51   (complete TSC universe, enumerated)

Three properties make this a governance control rather than a convenience endpoint:

Derived at call time. The numbers come from the shipped framework data on each invocation, so the answer cannot drift away from the engine that produces the findings.
Fails closed. If the data cannot be read, the tool declines to answer instead of returning an empty or partial matrix. A blank matrix reads like a small matrix, and a small matrix is a false claim.
States its denominator. “37 out of scope” on its own asks the reader to compute the universe. “37 out of scope across the full 51-criterion TSC universe” does not.

The same discipline, applied to the scan itself

The release extends that thinking to the cloud scan summary. The severity breakdown now carries the complete spectrum — INFO included, rolled up by category — and scope boundaries get a dedicated channel with a badge of their own:

[🔎 SCOPE NOT ASSESSED]

It is deliberately not the evidence-gap badge. “This run could not verify X” and “this release does not evaluate X” are different statements, and collapsing them into one label costs an assessor real time. On a live AWS run, nine scope declarations and eight evidence gaps were reported side by side, each named, each in its own channel — and both the assistant-facing summary and the command-line evidence table carry them.

Also in 0.32.11

Sharper GCP firewall analysis. Rules with an unreadable direction field are now reported individually by name; an unresolvable project returns an explicit not-reachable state; and an explicit deny-all-ingress rule is correctly read as the hardening control it is. Each new condition is anchored across all seven frameworks.
Self-documenting licences. Every licensed capability now ships a written description, printed by license --capabilities — eighteen capabilities with a sentence of plain English behind each name.
Honest --watch documentation, described precisely as the continuous CTEM alerting loop it is.

Verified where it counts

The behaviour above was confirmed against the published packages a customer actually downloads — a global install of the release tarballs, the MCP validation battery re-run against those installed bytes, and a live smoke run across AWS, Azure and GCP in which every measured framework matched the previous release’s baseline exactly. Coverage matrices are unchanged, and the plugin count holds at 28 Enterprise cloud-audit plugins, 55 including Community Edition.

Still local-first, by architecture

Scanning is agentless and runs on read-only credentials. Cloud credentials, findings and configuration never leave your network: no telemetry, no SaaS backend, no phone-home, and licence validation happens locally. For regulated and restricted environments, that is not a preference — it is the deployment requirement.

Community Edition: npm install -g nsauditor-ai. Enterprise licensing and the full capability matrix: nsauditor.com/ai/enterprise.