“Did We Get Better?” NSAuditor AI Enterprise 1.1.0 Brings Delta and Trend Reports That Show Their Work

Every security team eventually hears it from a client, a board or an assessor: did we actually get better since the last scan? NSAuditor AI Enterprise 1.1.0, released by Nsasoft US LLC on 28 September 2026 with Community Edition 0.2.55 and agent skill 0.2.53, answers that question directly, with delta and trend reports for the Pro and Enterprise editions, delivered inside the report you already hand to stakeholders.

Why “resolved” deserves a second look

Diffing two scans is easy: a finding that was there last month and is gone today gets labelled resolved. But findings also disappear when nothing was fixed. The host was not in the second scan’s target list, a plugin hit its time limit, credentials returned AccessDenied, or the cloud scan covered fewer regions. A report that treats those as fixes hands the reader a clean bill of health nobody earned. NSAuditor AI was built to tell the difference.

What the delta report does

One command compares two scan runs:

nsauditor-ai report --from <dir> --format executive --since <runId|prior>

Point --from at the folder your scans write to with --out; --since takes a baseline run id, or prior for the run before the one you report on. The result shows what is new, what is resolved and what changed severity, rendered into the self-contained executive HTML report you hand a client, not just printed to a terminal. The capability is included in Pro and Enterprise, and the free last-vs-current webhook alerting in watch mode stays free.

The NOT-COMPARABLE list: every reason on the row

Before calling a missing finding resolved, the report looks at how each run measured it. When it can see that a finding was not measured the same way twice, it files the finding on a NOT-COMPARABLE list, with the reason on the row:

• the host was not scanned in the other run;
• the plugin that reports it did not run, errored or timed out;
• the scanner recorded an evidence gap, such as AccessDenied;
• the other run had a narrower scope on an Enterprise cloud scan: fewer AWS regions, a different Azure subscription or a different GCP project;
• the check on its port could not complete (probe-not-measured);
• a TCP port the port scanner saw open stopped answering between the two scans (port-not-measured);
• the plugin that produced it changed what identifies a finding across the upgrade (identity-basis-changed).

Each reason points at a concrete next step: add the host back, restore the permission, match the scope. The report turns an argument about whether something was fixed into a short, actionable list. Plugins also declare their own time budget now, and an exceeded budget reads not measured, never clean.

Comparisons it refuses to fake

Some pairs of runs cannot be compared fairly, so the report does not pretend. Two runs at different licence tiers are refused, and so are two runs that straddle a release where a reported number changed meaning. The report states that no comparison was made, so nothing is presented as fixed on a false basis.

A tamper-evident baseline

A before-and-after is only as good as its “before”. Starting with the first scan run on 1.1.0, the run record and each host’s findings files are sealed with SHA-256 digests and chained to the previous run. Both runs are verified before anything is compared. If a findings file was altered, the report names the file and refuses the comparison. That is the kind of evidence an assessor can follow.

Upgrade notes

• Upgrade both packages together. Enterprise 1.1.0 requires Community Edition 0.2.55 or newer: npm i -g nsauditor-ai@0.2.55 @nsasoft/nsauditor-ai-ee@1.1.0.
• One home for the offline NVD store. Scans now resolve it the same way from any directory: NVD_CACHE_DIR, else NSAUDITOR_NVD_CACHE_DIR, else ~/.nsauditor/nvd_cache, and every run records which location it used. If you kept a .nvd-cache folder in a working directory, move it once with mkdir -p ~/.nsauditor/nvd_cache && mv .nvd-cache/* ~/.nsauditor/nvd_cache/, or point NVD_CACHE_DIR at it; the scan names the fix if it finds one.
• Sharper AWS KMS reasoning. The effective-decrypt auditor (plugin 1110) keeps a kms:Decrypt on Resource:* at HIGH on a live run, because a single-region read cannot rule out a key elsewhere that trusts the principal.

Availability

Pro (from $39 a month billed annually, $49 month to month) is built for consultants and MSPs who hand a client a report. Enterprise (from $2,000 a year, also on AWS Marketplace) is for teams that must show movement between two points in time across AWS, Azure and GCP, with evidence mapped to eight compliance frameworks. The scanner uses read-only credentials, and under Zero Data Exfiltration your scan data never goes to Nsasoft; the product has no telemetry.

See what changed since your last scan: nsauditor.com/ai/pro/ · nsauditor.com/ai/enterprise/