LAS VEGAS — Nsasoft US LLC has released NSAuditor AI Enterprise Edition 0.39.0, paired with Community Edition 0.2.44 and agent-skill 0.2.42. The headline change is unusual for a security scanner: rather than adding detections, this release makes every cloud plugin state, in the report itself, what it does not examine.
Why an empty result is the hardest one to read
When a cloud security scan comes back with nothing, it has answered two very different questions with the same silence. It might mean the surface was examined and found clean. It might mean the surface was never examined at all. For anyone assembling evidence for a SOC 2, ISO 27001 or PCI DSS assessment, only the first is worth anything.
NSAuditor has published machine-readable coverage declarations for a while, but until this release all nine of them lived on the product’s AWS plugins. The seven GCP and Azure plugins declared nothing. As the company puts it in its own release notes, that asymmetry was the real problem: AWS disclosing is exactly what made the others’ silence read as completeness.
What changed
Seven new declarations now ship across the GCP and Azure scanners, deep auditors and the dedicated Azure auditors, each carrying 8 to 12 boundaries. Measured on this release against real cloud accounts, the counts come back at AWS 9, Azure 4 and GCP 3.
Three design choices are doing the work:
- They are emitted even over an empty account. An estate with no resources returns zero findings whether or not anything was ever examined — which is precisely when a coverage statement is worth having. They are deliberately not emitted when a scan fails its preconditions and never runs; that is a different fact and gets a different signal.
- They are ordered by materiality. Community Edition’s assistant-facing summary abridges each declaration to 420 characters, so boundaries that would invalidate a broad conclusion lead, and per-resource detail trails.
- They were checked against the code, not a keyword search. That changed four of them before release.
The four boundaries that got narrower
This is the detail worth lingering on. The token serviceTag appears nowhere in the product’s source. A search-driven process would have concluded Azure service tags were unhandled and shipped that as a disclosed gap. In fact one plugin handles Azure’s Internet and AzureCloud service tags with their own severity calibration — so publishing the boundary would have denied a capability that actually ships.
Three others were narrowed the same way: key-vault rotation policy presence is evaluated (only the interval is not), diagnostic export is evaluated (only its destination and retention are not), and Workload Identity Federation admin roles are flagged (only pool trust configuration is unread).
The company’s framing is that an overstated boundary is an underclaim, and an underclaim is the expensive direction — because nothing ever complains about it.
Also in this release
Two AWS declarations were made estate-independent. They had been emitted inside a per-region helper, so the count scaled with the number of enabled regions; both now emit once per run on any estate. Two sentences claiming multi-region enumeration was deferred were corrected, since both plugins in fact fan out across every in-scope region.
GCP service-account impersonation now refuses rather than quietly degrading. Where an impersonated client yielded no Authorization header, the scan previously reported that it could not enumerate — a misleading reason that sent operators to check permissions they already had. A preflight now fails loudly, naming the target principal and the remedy, and the scan is treated as down rather than as an audit that found nothing.
On the Community side, the assistant-facing scan_cloud description stopped naming a provider roster it has no way to derive, and two commands introduced in the previous release — compliance sign-pack and compliance verify-pack — were added to the CLI help text, where they had been missing despite being fully documented everywhere else. A new build check now derives the list of commands the CLI actually accepts and fails if the help text and that list disagree in either direction.
Compliance coverage is unchanged, and that is the point
All seven compliance matrices hold steady: SOC 2 at 10 covered / 4 partial / 37 out-of-scope, HIPAA Security Rule §164.312 at 7/3/45, NIST CSF 2.0 at 13/10/83, PCI DSS v4.0.1 at 19/9/39 (67 of roughly 250 sub-requirements), ISO/IEC 27001:2022 at 17/14/62, CIS Controls v8 at 17/23/113, and GDPR Article 32 at 4/5/2 — scoped by the vendor as Security of Processing infrastructure substrate only, never GDPR compliance.
Unchanged is a claim rather than an oversight. A coverage declaration routes to zero controls by design, re-measured across all 49 declaration-by-framework combinations, beside a control that correctly routed to three SOC 2 controls. A disclosure that something was not examined must never be filed as evidence that it passed.
The plugin catalog also holds at 28 Enterprise plugins and 55 overall — 27 cloud auditors across AWS, Azure and GCP plus one network-scan zero-trust posture assessment.
Availability
Community Edition is MIT-licensed on npm as nsauditor-ai. Pro and Enterprise ship as @nsasoft/nsauditor-ai-ee and install alongside it. Enterprise 0.39.0 requires Community 0.2.43 or newer, unchanged from the previous release, so upgrading Enterprise alone is sufficient. The product runs on the customer’s own infrastructure with agentless, read-only credentials, and scan data is not collected, transmitted or stored by the vendor.
More: nsauditor.com/ai/enterprise
