Nsasoft US LLC has shipped NSAuditor AI Enterprise Edition 0.34.0, paired with Community Edition 0.2.39 and agent-skill 0.2.37. It adds exploit intelligence to the Pro tier and changes something more consequential than a feature list suggests: which vulnerability your team looks at first.
Severity answers the wrong question
Every scanner ranks findings by severity, and severity measures how bad a vulnerability would be if someone exploited it. It is silent on whether anyone actually is.
That silence is why remediation backlogs look the way they do. A queue of CRITICALs, none of them obviously more urgent than the next, and somewhere down the list the one CVE that is currently being used against organisations like yours — sitting at MEDIUM, because on a severity scale that is all it is.
Two public datasets, joined automatically
The security industry already solved the data problem. CISA publishes the Known Exploited Vulnerabilities (KEV) catalog — CVEs confirmed as exploited in the wild. FIRST publishes EPSS — a probability score for whether a given CVE will be exploited. Both are free and public.
What has been missing is the join. Teams do it by hand, one CVE at a time, after the scan finishes — which means in practice it often does not happen at all.
NSAuditor AI 0.34.0 does it at scan time. Every finding carrying a CVE is matched by CVE ID against a local KEV catalog and a local EPSS scores file, and banded:
KNOWN_EXPLOITED— CISA lists it as exploited in the wildELEVATED— high EPSS exploitation probabilityBASELINE— everything else
Then the queue reorders exploit-first. Which produces the line that makes the release worth reading about:
A KEV-listed MEDIUM outranks an unexploited CRITICAL.
The evidence travels with the ranking
A prioritisation engine that just emits a number is hard to defend to an auditor. This one shows its work. Each promoted finding carries the KEV flag, the EPSS score with its percentile, the CVE ids that matched, and the publication date of the catalog they were matched against — so the ordering is always something you can date and explain.
Nothing you already report on moves
riskScore is untouched; exploitPriority is a new axis alongside it. The join runs downstream of CVE matching, so it reorders what the scanner found rather than changing what it finds. The plugin catalog stays at 28 Enterprise plugins, 55 overall, and all seven compliance coverage matrices — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8 and GDPR Article 32 infrastructure substrate — are unchanged.
Local-first, as always
Both catalogs are operator-supplied and the join runs entirely on your own hardware. No CVE, no host and no finding leaves the network to obtain the ranking. Exploit intelligence is Pro-tier and operator-configured.
One upgrade note worth reading before you deploy
Enterprise 0.34.0 requires Community Edition 0.2.39 or newer. That floor was raised on purpose: Community Edition 0.2.39 fixes a port scanner that probed zero ports under a global install, and an NVD cache that broke CVE lookup under MCP. Running Enterprise 0.34.0 against an older Community Edition would inherit that port-scanner false clean, so this is a correctness requirement, not a version formality.
Community Edition is free and MIT-licensed on npm as nsauditor-ai. Enterprise Edition ships as @nsasoft/nsauditor-ai-ee and is also available through AWS Marketplace.
NSAuditor AI Enterprise · Documentation · Pricing
