Silence Is Not a Pass: NSAuditor AI Enterprise 0.43.0 Makes Every Cloud Scan Report Exactly What It Examined

Every security scanner tells you what it found. The result that actually costs an organisation an audit is the other one: a clean page over a surface that nothing examined. Nsasoft US LLC has released NSAuditor AI Enterprise 0.43.0, and its whole story fits in one sentence — silence is not a pass. Every scan now reports exactly the estate it examined, and every reader of that report, operator and assessor alike, can see the boundary of what was evidenced.

A provider that did not run now says so

A multi-cloud scan is only as honest as its provider summary. In 0.43.0, a cloud provider whose scanner did not start — because a credential was absent, a dependency was missing, or the plugin was out of scope — is reported as NOT audited, with the reason stated. Its findings are absent rather than empty, the audited-provider list names only the clouds that were actually scanned, and compliance verdicts continue to fail closed over any unscanned surface. The rule is now unconditional across the AWS, Azure and GCP fleet: a cloud-plugin result that reports itself down carries either an error or an explicit skip flag, and the engine labels the two causes distinctly — plugin skipped (fix the scope with --host or CLOUD_PROVIDER) versus scanner error (fix a dependency or a credential) — because the remedies differ.

Evidence gaps state a cause, not a command

When a scanner cannot run, the compliance engine names the reason inside the evidence-gap sentence of every control that scanner would have evidenced. In 0.43.0 that sentence states what was not evidenced — the cause an assessor needs — while operator remediation stays on the operator channel, where it can be acted on. That separation matters most in air-gapped installations, where an instruction to install from a public registry cannot be followed. The assessor reads a clean, cause-stated gap; the operator reads the fix.

The offline carrier ships the versions that were tested

The restricted air-gap carrier is now pinned to the dependency versions its own test suite runs against. Two consecutive builds of the same source produce byte-identical output, verified in an isolated container with the network interface down and zero outbound attempts recorded. What crosses the air gap is what was exercised. Vulnerability feeds travel separately, using feed bundle and feed import over the NVD files you downloaded on a connected host — a bundle is integrity-checked, not authenticated.

Also in this release

• Cleaner “Why this violates” rationale across four framework files, in Markdown, HTML and JSON.
• A GDPR Article 32 assessment (Security of Processing infrastructure substrate only, not GDPR compliance) now fails closed when an Azure scan refuses.
• The frozen interface record, docs/contract-v1.md §1.3, documents the result-envelope liveness keys the compliance engine’s fail-close has always read.

Coverage, unchanged by design

NSAuditor AI Enterprise maps one agentless, read-only scan across AWS, Azure, GCP and on-prem networks to eight compliance frameworks: SOC 2, HIPAA Security Rule §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32 (Security of Processing infrastructure substrate only, not GDPR compliance) and NIST SP 800-171 Rev 2 as evidence substrate for CMMC Level 2 preparation. The catalogue holds 29 Enterprise auditors — 28 cloud auditors plus one Zero Trust posture check — for 56 plugins overall, and all eight coverage matrices are unchanged in 0.43.0, because this release deepens the honesty of controls already covered rather than adding claims.

NSAuditor AI Enterprise 0.43.0 is paired with Community Edition 0.2.50 and agent-skill 0.2.48, requires Community Edition 0.2.49 or newer, and is the 103rd consecutive paired release. Full details, the plugin catalogue and a sample scan are at nsauditor.com/ai/enterprise/.