Nsasoft US LLC has released NSAuditor AI Enterprise Edition 0.36.0, alongside Community Edition 0.2.41 and agent-skill 0.2.39. The headline change is simple to state: the compliance report now checks the approval signatures it renders, instead of repeating what the record says about itself.
What this is about
Every compliance report contains exceptions — findings someone reviewed and accepted as a risk, or marked as a false positive. Each one carries an approval record: who accepted it, why, and for how long. Auditors read that list closely, because it is where an organisation’s own judgement is written down.
Until this release the report verified the approver’s identity against a registry, but the signature on the record was taken at face value. In 0.36.0 an approver’s registry entry can carry their public key beside its fingerprint — the two must agree, checked when the registry loads — and each approval signature is then verified against the key it names.
Two answers instead of one
The check reports two things separately: whether the exception should still stand, and whether the bytes came from the key they name. Those answers diverge in exactly one situation — a key revoked after it signed — and keeping them apart is what makes “signed after the credential was revoked” a cryptographic finding rather than a note in a text field.
Each verdict also names the exact signature it checked, so it cannot be attached to a different record that happens to share an identifier.
The restraint that stands out
A missing verdict means not checked. It never means failed.
Most identity registries in use today carry fingerprints only, so verification is often unavailable until approvers supply key material. Rather than reporting those as failures — which would effectively accuse an organisation’s own approvers — the report says plainly that it did not check, and a new advisory names how many approvers are still awaiting key material and exactly what to paste to switch checking on.
What has not changed
All seven compliance coverage matrices are unchanged: SOC 2, HIPAA §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8 and GDPR Article 32 as an infrastructure substrate. The plugin catalog stays at 28 Enterprise plugins — 27 cloud auditors for AWS, Azure and GCP plus a Zero Trust posture assessment — and 55 in total with the Community Edition set. Ed25519 suppression signing is still described as reachable and not yet proven, and RFC 3161 trusted timestamping remains opt-in with no default, ever.
Availability
Community Edition nsauditor-ai 0.2.41 is MIT-licensed and free on npm. Enterprise @nsasoft/nsauditor-ai-ee 0.36.0 is licensed and requires Community Edition 0.2.40 or newer — unchanged this cycle.
npm install -g nsauditor-ai@latest @nsasoft/nsauditor-ai-ee@latest nsauditor-ai-agent-skill@latestScanning is agentless and read-only and runs on the operator’s own infrastructure — scan data, credentials and findings stay where they already are, and nothing is transmitted to Nsasoft.
Details: https://www.nsauditor.com/ai/enterprise/
