NSAuditor AI Enterprise Reaches 1.0: One Read-Only Scan, Eight Compliance Frameworks, and an Evidence Contract That Is Now Frozen

LAS VEGAS — Most software reaches 1.0 by adding features. Nsasoft US LLC has taken NSAuditor AI Enterprise there by doing something rarer in the security tooling market: freezing the contract that its customers’ integrations depend on.

Version 1.0.0 shipped on 15 September 2026, alongside Community Edition 0.2.54 and the agent-skill package 0.2.52.

What 1.0 actually means here

Eight surfaces define how NSAuditor AI Enterprise produces compliance evidence:

• the plugin finding shape, and its evidence-gap, deferred-scope and positive-substrate markers
• the MCP scan_cloud and get_findings schemas
• the report, attestation and rationale formats
• the framework-mapping conventions
• the Community peer-range floor
• the GRC push posture

All of them have shipped unchanged since EE 0.32.3. As of 1.0.0 they are binding: a change to any one of them is now a semver-major event.

For a security team, that is the difference between a tool and a dependency. Anyone who has built reporting, ticket routing or a GRC pipeline on top of a scanner knows the failure mode — a minor version lands, a field is renamed, and a quarter’s worth of automation quietly stops meaning what it meant. NSAuditor AI Enterprise 1.0 is a commitment that this will not happen without a major-version signal, and it is written down in docs/contract-v1.md rather than implied in a changelog.

It is not a feature list. It is a promise with a version number, and a procurement team can hold the vendor to it.

One agentless scan, eight framework-shaped evidence packs

The core proposition is unchanged and remains the product’s strongest argument. A single agentless, read-only scan across AWS, Azure and GCP maps onto eight frameworks:

SOC 2 · HIPAA · NIST CSF 2.0 · PCI DSS v4.0.1 · ISO/IEC 27001:2022 · CIS Controls v8 · GDPR Article 32 · NIST SP 800-171 Rev 2

Each framework gets evidence cited in its own vocabulary, from one finding stream — rather than eight separate collection exercises with eight separate sets of screenshots. Read-only credentials are enforced in code, and the product is local-first: findings stay on the operator’s own infrastructure.

The Enterprise catalog stands at 29 auditors — 28 cloud auditors plus one Zero Trust posture check — and 56 plugins overall across Community and Enterprise. All eight coverage matrices are unchanged in this release.

Arithmetic an assessor can check without trusting the vendor

The most quietly consequential change in 1.0 is one an auditor will notice before a buyer does. Every compliance report summary now carries findingsReceived and findingsRouted, and the Findings analyzed line counts findings.

The practical effect: an assessor holding nothing but the evidence pack can check the arithmetic from the pack alone. No vendor portal. No callback to a SaaS backend. No step where the reader has to take the producing tool’s word for it.

That is the whole design philosophy compressed into one field pair. A number an auditor can verify is evidence; a number they have to accept on faith is a conversation.

Two further precision improvements land in the same release: an Azure RBAC role assignment made at the root scope is now named as the root scope rather than the subscription, and PCI DSS 11.5.2 is described as critical-file change detection — which is what the standard says.

Where this fits

NSAuditor AI Enterprise targets the recurring obligation rather than the point-in-time engagement: the evidence work that sits between assessments, for internal security teams, vCISOs, MSSPs and compliance consultancies carrying a book of recurring client relationships. Deployment is local-first with an air-gapped install path available under restricted distribution for isolated networks.

Community Edition remains MIT-licensed on npm as nsauditor-ai, and Enterprise pairs with a Community floor of 0.2.49 or newer.

What is next

Nsasoft has signalled delta and trend reports for the Pro tier — what changed since the last scan — followed by identity-provider posture for Enterprise, starting with Okta. Release cadence moves to one trio every two weeks.

Full details, pricing and editions: nsauditor.com/ai/enterprise. A sample evidence pack is published at nsauditor.com/ai/docs/sample-scan.