Audit season has a predictable shape. Someone asks for evidence, and three weeks disappear into screenshots, exports and spreadsheets that nobody can independently verify afterwards. NSAuditor AI Enterprise Edition 0.32.10 — released this week by Nsasoft US LLC alongside Community Edition 0.2.35 — is built to collapse that into a single command.
One scan in, seven evidence packs out
NSAuditor AI Enterprise performs one agentless, read-only pass across AWS, Azure and Google Cloud and produces auditor-ready evidence for seven frameworks at once:
- SOC 2 (AICPA Trust Services Criteria)
- HIPAA §164.312 Technical Safeguards
- NIST CSF 2.0
- PCI DSS v4.0.1
- ISO/IEC 27001:2022
- CIS Controls v8
- GDPR Article 32 infrastructure substrate
There is no agent to deploy into the estate under assessment and no console to click through. Read-only credential enforcement is gated in the product’s own CI — it is a property of the code, not a promise in a policy document. Every artifact in the pack carries a SHA-256 chain of custody, so an assessor can verify for themselves that the report bytes are unchanged since the scan wrote them.
What is new in 0.32.10
SOC 2 coverage, enumerated across all 51 criteria
The SOC 2 matrix now enumerates the complete AICPA universe: 10 covered, 4 partial, 37 out of scope — 51 of 51, each out-of-scope criterion carrying a written architectural reason. No control changed status and no routing changed; this is completeness, not repositioning. An auditor gets the entire universe and the reasoning behind each placement rather than a selective view of it. Every framework file is now pinned against an independently held universe constant so a future omission fails the build.
Dependency measurement that matches what you actually install
The release gate that checks NSAuditor’s own third-party dependencies now builds its own subject: it packs the release, installs it into an empty directory exactly the way a customer does, and audits there. On the shipped 0.32.10 bytes the customer install carries zero critical and zero high-severity advisories — a figure re-derived from a real global install of the published packages, with a package-by-package divergence report printed on every run.
No clean verdict without a live source
A pinned canary advisory must return before the gate will report anything. If it does not, the run exits as untrustworthy rather than clean. It is the same no-false-clean rule that governs NSAuditor’s scanning engine: a cloud plugin that cannot enumerate writes a fail-closed evidence gap into the auditor’s document instead of quietly reading as a pass. A zero from a source that said nothing is silence, and silence is never safety.
Zero Data Exfiltration, by architecture
For regulated organisations, the deciding question is usually not what a scanner finds but where the findings go. NSAuditor AI runs entirely inside the customer environment: no telemetry, no SaaS backend, no vendor-side copy of the evidence, and offline licence validation so there is no phone-home. Credentials, findings and reports never leave the network — which is why teams deploy it in VPCs, on ECS/EKS and Kubernetes, on-premises, and in fully air-gapped environments.
Teams already standardised on a GRC platform can opt in to scan-time push of findings to Vanta, Drata or Secureframe.
Who it is for
Security teams preparing for a SOC 2 Type II or ISO 27001 audit. MSPs and MSSPs who need repeatable, client-ready evidence without adding consultant hours. GRC firms wanting a technical evidence layer underneath their framework work. And regulated organisations in finance, healthcare and government where the data-residency answer has to be “it never left”.
Get started
npm install -g nsauditor-ai @nsasoft/nsauditor-ai-eeThe Community Edition is free and open source. Enterprise licensing, the full capability matrix and a sample evidence pack are at https://www.nsauditor.com/ai/enterprise/, and the Enterprise listing is available for procurement through existing AWS Marketplace commitments.
