NSAuditor AI Enterprise 2.1.0: When the Scan Could Not Read Your GCP, Azure or EC2 Inventory, the Report Says So

A scan that could not read part of your cloud should not read as clean. When an assessor asks how you know the asset inventory was complete, your evidence should show where the scan could and could not read. NSAuditor AI Enterprise 2.1.0, published by Nsasoft US LLC on 26 October 2026 with Community Edition 1.1.0 and the agent skill 1.1.0, records the GCP instance, Azure VM and EC2 inventories it could not read in full as evidence gaps, walks only the AWS regions your account has enabled in an all-regions scan, wherever the account’s enabled regions can be read, and runs on the October 2026 Node.js security release.

An unread inventory is an evidence gap, not an empty project

The CIS hardened-image census draws on three auditors: the GCP security audit (plugin 1021), the Azure security audit (1022) and the EC2 instance auditor (1210). In 2.1.0, when one of them cannot read its instance or VM inventory in full, it records one evidence gap that fails CIS v8 Safeguards 4.1, 4.2 and 4.6. The gap carries its cause as a class, and the CIS report names which cloud’s inventory is short and why. A compliance owner can hand that report to an assessor and point to the shortfall by name.

Regions your account has not enabled

This one is for MSPs whose client accounts have not enabled every region. Wherever the account’s enabled regions can be read, an all-regions AWS scan walks the regions the account has enabled, and a listed region the account has not enabled is recorded as not enabled, an evidence gap, rather than an access-denied finding asking the operator to grant the audit role. In that case, CloudTrail raises no missing-trails finding for that region. The result: wherever the account’s enabled regions can be read, a listed region the account has not enabled is no longer reported as a permission to grant the audit role.

No subscription or project? The scan says why

An Azure scan with no subscription id reports its four plugins down with the cause, so Azure no longer reads as audited; a GCP scan with no project or no loadable credentials reports the GCP security audit down with its cause, so its controls fail closed as not measured.

Scans driven from Claude through the MCP server

Community Edition 1.1.0 carries the upgrades for teams that run scans from an AI assistant:

• scan_host stops at a total time limit (SCAN_HOST_WALL_MS, 50 seconds by default) and names the plugins it did not run, so the call returns a partial result rather than nothing;
• with NSA_MCP_RESPONSE_DIR set, a saved response keeps its request beside it, and nsauditor-ai mcp verify-call checks both;
• a scan_cloud CRITICAL, HIGH or evidence-gap title ends (+N more via get_findings) when its finding holds more entries than the title shows;
• a get_findings category filter that matches nothing returns the categories the scan does hold.

Lost measurement, named per scanner

The drift file names a control as having lost measurement from each scanner that stopped measuring it, with the scanners named in sources, so each scanner’s lost measurement is on the record, even on a control that already carried a gap.

Built on the October 2026 Node.js security release

Enterprise 2.1.0 and Community 1.1.0 both declare Node.js 24.22.1 or newer, the October 2026 Node.js security release for the 24 line, as their runtime. Underneath, the 31 AWS SDK clients are locked at one version, and the Google Cloud and Azure SDKs move to their current majors.

Eight frameworks, one read-only scan

NSAuditor AI Enterprise maps one read-only infrastructure scan across AWS, Azure and GCP to SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32 (security-of-processing infrastructure evidence) and NIST SP 800-171 Rev 2 (evidence for CMMC Level 2 preparation). It ships 29 Enterprise and 27 Community plugins. Zero Data Exfiltration: your scan data never goes to Nsasoft.

Upgrading

Install Node.js 24.22.1 or newer first, then install Enterprise 2.1.0 and Community 1.1.0 together in one command. Enterprise 2.1.0 reaches licensed customers through the restricted npm package:

npm i -g nsauditor-ai@1.1.0 @nsasoft/nsauditor-ai-ee@2.1.0

Enterprise starts at $2,000 per year for up to five seats: nsauditor.com/ai/enterprise. Pro starts at $39 per month billed annually: nsauditor.com/ai/pro. Community Edition is free and MIT-licensed on npm.