<p>Scanners on isolated networks live with a standing contradiction: the vulnerability data they match against lives on the internet, and they do not. Nsasoft US LLC released <strong>NSAuditor AI Enterprise Edition 0.37.0</strong> on 16 August 2026, paired with Community Edition 0.2.42 and agent-skill 0.2.40, and it resolves that contradiction the way operators on classified, OT and defence networks have always resolved it — by carrying the data across themselves.</p>
<h2>Two commands, one archive</h2>
<p><code>nsauditor-ai feed bundle</code> runs on a connected host and merges the NVD feed files an operator has already downloaded into a single portable archive. <code>nsauditor-ai feed import</code> runs on the isolated host and reads that archive into the offline CVE store. In between, the archive travels however your site already moves data across the boundary.</p>
<p>The capability underneath is not new — NSAuditor AI has had an offline CVE store and a hardened ingest path for that store for several releases. What was missing was a way to reach it. The ingest function had no shipped caller, and Nsasoft’s position throughout was that hardened code nobody can invoke is not a feature, which is why offline CVE matching was described as a withdrawn claim rather than a roadmap promise. 0.37.0 is the release where it becomes something a customer can actually run.</p>
<h2>A design decision taken on a measurement</h2>
<p>The original plan was to bundle the built CVE store and ship that across. A measurement taken before the work started killed it: the store is a lossy derivation of an NVD feed. Configurations are flattened, references are dropped, and withdrawn or CPE-less records are discarded at ingest, so a store cannot be turned back into a feed.</p>
<p>Bundling the source feeds instead has two durable advantages. The same hardened ingest path runs on both sides of the trust boundary, rather than a second, less-exercised one appearing on the isolated side. And no new archive format is minted that the vendor would owe compatibility on indefinitely.</p>
<h2>Exploit intelligence crosses with it</h2>
<p>Since 0.34.0, NSAuditor AI has joined CVE findings against a local CISA KEV catalogue and a local FIRST EPSS scores file to order the remediation queue exploit-first — the property that lets a KEV-listed MEDIUM outrank an unexploited CRITICAL. On an isolated network, that only works if those files can get there.</p>
<p><code>feed bundle –kev</code> and <code>–epss</code> carry the operator’s own KEV catalogue and EPSS scores inside the same archive; <code>feed import –extras-dir</code> places them on the far side and prints the two environment lines to set. No exploit data ships with the product. These are the operator’s files, downloaded from CISA and FIRST under the operator’s own terms, and on an isolated network the archive is the only route across.</p>
<p>Both are validated on the <em>connected</em> host, and the reasoning is specific rather than incidental. The parsers return an empty result for unreadable input rather than failing outright, and an empty catalogue sitting at a store path makes every finding read “not known exploited” — which is exactly what a genuinely clean host also reports. A validation that fired on the isolated side would fire in the one place nothing can be done about it. Validating where a bad download can still be replaced is the difference between a check and a formality.</p>
<h2>Integrity, stated precisely</h2>
<p>Each carried file records a SHA-256 that import verifies, so a file altered or truncated in transit is detected. Nsasoft is explicit about the limit of that guarantee: it establishes integrity, not authorship, because the recorded hash travels inside the same archive as the data it covers. Import therefore treats every field it reads from an archive as untrusted input, and signing the bundle on the connected host is named as future work rather than implied as present.</p>
<p>Import also names every record it skipped and why. Withdrawn CVEs and entries carrying no CPE data are expected outcomes of ingest, not data loss, and an operator reconciling counts on the far side of a boundary needs that stated rather than inferred.</p>
<h2>Offline installation, delivered as a bundle</h2>
<p>0.37.0 also ships a dependency-complete offline installation bundle with an install script and checksums, under restricted distribution and for linux/amd64 only; no arm64 image is published. The bundle was assembled from the tarballs the registry serves rather than from a working tree — a distinction Nsasoft says this release proved the value of, since a post-publish documentation fix meant the git tag no longer pointed at the exact bytes npm was serving. Building from the registry keeps every customer on 0.37.0 running identical code.</p>
<h2>Availability</h2>
<p><code>@nsasoft/nsauditor-ai-ee</code> 0.37.0 is on npm under the Enterprise licence. Community Edition <code>nsauditor-ai</code> 0.2.42 is MIT-licensed and free. Enterprise requires Community Edition 0.2.42 or newer — a raised floor this cycle, because the new feed commands are routed from Community Edition and an older CE would build an incomplete archive without saying so.</p>
<p>The plugin catalogue is unchanged at 28 Enterprise plugins — 27 cloud auditors across AWS, Azure and GCP plus a Zero Trust posture assessment — 55 in total with Community Edition’s 27. All seven compliance coverage matrices are unchanged: SOC 2, HIPAA §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8 and GDPR Article 32.</p>
<h2>About Nsasoft US LLC</h2>
<p>Nsasoft US LLC builds security tooling that runs where the data already is. NSAuditor AI performs agentless, read-only cloud and network security assessment with a Zero Data Exfiltration architecture: scan data, credentials and findings stay on the customer’s own infrastructure, and nothing is transmitted to Nsasoft. More at <a href=”https://www.nsauditor.com/ai/enterprise/”>nsauditor.com/ai/enterprise</a>.</p>
