Exploit-First Triage: NSAuditor AI Enterprise 0.34.0 Ranks Findings by What Attackers Are Actually Using
NSAuditor AI Enterprise 0.34.0 joins CISA KEV and FIRST EPSS onto CVE findings at scan time, so a known-exploited MEDIUM outranks an unexploited CRITICAL.
LAS VEGAS, NV — Nsasoft US LLC has released NSAuditor AI Enterprise Edition 0.34.0, alongside Community Edition 0.2.39 and agent-skill 0.2.37. The headline is a change to something every security team quietly works around: the order of the remediation queue.
The problem severity was never built to solve
A scan of a real environment returns more CRITICALs than any team can fix this week. Severity ranks how bad a vulnerability would be if it were exploited. It says nothing at all about whether anyone is exploiting it.
The two questions practitioners actually triage on — is this being used in the wild right now? and how likely is exploitation at all? — are answered by two free public datasets. Most teams consult them by hand, one CVE at a time, after the scan is already over. It is slow, it does not scale, and it is exactly the kind of work that gets skipped in a busy week.
What 0.34.0 does
NSAuditor AI now performs that join at scan time. Every finding that carries a CVE is matched by CVE ID against a local CISA Known Exploited Vulnerabilities (KEV) catalog and a local FIRST EPSS scores file, then lands in one of three bands:
KNOWN_EXPLOITED— listed by CISA as exploited in the wildELEVATED— a high EPSS exploitation probabilityBASELINE— everything else
The finding queue is then ordered exploit-first. The practical consequence is a single sentence worth pinning to a wall:
A KEV-listed MEDIUM outranks an unexploited CRITICAL.
The ranking arrives with its own justification
Prioritisation tooling usually asks you to trust a composite number. This does not. The reason travels with the finding: the KEV flag, the EPSS score together with its percentile, the CVE ids that matched, and the publication date of the catalog they were matched against.
That last field matters more than it looks. It means the ordering is always something an assessor can date. When someone asks why a particular finding sits where it sits in the queue, the answer is already in the evidence pack rather than in somebody’s memory of a conversation.
It enriches; it does not replace
riskScore is untouched. exploitPriority is a new axis beside it, which means teams already reporting on risk scores see nothing move. The join also runs downstream of CVE matching, so it improves the ordering of what the scanner already found rather than changing what it finds.
And it stays on your machine
Both catalogs are free, public and operator-supplied, and the join runs entirely on the operator’s own infrastructure. No CVE, no host and no finding leaves the network to obtain the ranking — consistent with the product’s local-first posture, in which scan data is not collected, transmitted or stored by the vendor.
What has not changed
The plugin catalog is unchanged at 28 Enterprise plugins, 55 overall. All seven compliance coverage matrices — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8 and GDPR Article 32 infrastructure substrate — are unchanged, with no control moving in either direction. Exploit intelligence is a Pro-tier capability and is operator-configured.
Availability and the upgrade requirement
Community Edition is free and MIT-licensed on npm as nsauditor-ai. Enterprise Edition ships as @nsasoft/nsauditor-ai-ee, is licensed per seat, and is also available through AWS Marketplace.
Enterprise 0.34.0 requires Community Edition 0.2.39 or newer, and the floor was raised deliberately. Community Edition 0.2.39 fixes a port scanner that probed zero ports under a global install, and an NVD cache that broke CVE lookup under MCP. Pairing Enterprise 0.34.0 with an older Community Edition would inherit that port-scanner false clean, so the peer requirement is a correctness condition rather than a version formality.
