Your Vulnerability Scanner Found 200 Findings. Now What?
Scanners detect; someone still has to decide. How NSAuditor AI Pro orders the queue exploit-first with CISA KEV and EPSS data you control.
Every vulnerability scan ends the same way: a long list. Two hundred findings, a thousand — the number varies, but the moment is identical. The scanner has done its job, and now a person has to do theirs. Which of these gets fixed first? Which CVE actually applies to the version we’re running? Is anyone exploiting it, or is it dangerous only on paper? Which of these are false positives that will burn an afternoon? And how do you explain any of this to management, or to a client who paid for the assessment?
This is where security workflows break down — not at detection, but at decision. Most tools respond to the problem by detecting more. NSAuditor AI Pro takes the opposite approach: it adds an intelligence and prioritization layer on top of the scan, so the list you end with is a queue you can defend.
From a version banner to a CVE list
Pro generates CPE identifiers automatically from the service versions the scanner detects and matches them against NVD vulnerability data — including a fully offline mode, where the CVE store is a file you populate and the lookup never leaves your machine. The practical difference is the step from “we found Apache 2.4.x on this host” to “these are the CVEs associated with this specific software and version, ranked by CVSS.” Where a lookup cannot complete, the report says so with an explicit coverage-gap finding rather than staying silent — a gap you can see is a gap you can close.
Exploit-first: the ordering that matches reality
Severity alone is a hypothesis. CVSS tells you how bad exploitation would be; it cannot tell you whether anyone is actually doing it. So Pro joins every CVE-carrying finding against two public data sets: the CISA Known Exploited Vulnerabilities catalog, and FIRST’s EPSS exploitation-probability scores. Findings are banded — known-exploited, elevated, baseline — and the queue is reordered exploit-first. A MEDIUM that is being exploited in the wild outranks a CRITICAL with no exploitation evidence, and the justification travels with the finding: the KEV flag, the EPSS score and percentile, the matched CVE IDs, and the data’s own as-of date.
Two design choices matter here. First, no exploit data ships with the product — both feeds are free and public, and you download them and point Pro at your copies, so the join runs entirely on your machine. Second, a stale feed fails closed: an out-of-date catalog withdraws its answer rather than asserting “not exploited.” A ranking you can date and source is a ranking you can defend.
Context, and the judgment call that stays yours
Findings carry MITRE ATT&CK technique annotations, and a composite risk score — CVSS weighted by verification status, with an uplift for findings carrying an initial-access technique. But Pro is explicit about where the tool stops and the professional begins: findings are emitted unverified, and you adjudicate. Mark a finding accepted-risk or false-positive and it drops out of the report and the risk rollup, while the decision itself is recorded for that scan. Your scanner should not make the final risk decision. You should — with the record showing you did.
AI that analyzes enriched findings, not raw output
NSAuditor AI works with OpenAI, Claude and Ollama using your own API keys, so scan data goes only where you point it — including nowhere at all, with a local model. What Pro changes is the input: the AI receives CVE matches, ATT&CK techniques, risk scores and structured findings, not a wall of scanner text. An executive summary or remediation plan written from enriched findings is a different artifact from one written from raw output — and an egress-redaction layer anonymizes targets and scrubs sensitive identifiers from what leaves for the AI provider.
Recurring scans that measure change
Pro lifts the Community Edition’s seven-day history prune: scan history is retained without limit, and scan-over-scan comparison shows what changed between runs. That turns recurring scanning from “run it again” into a way of seeing movement — what appeared, what was fixed, what has been sitting in the queue for three cycles.
Reports a client can read
The output is a risk-ranked, CVE-annotated report in HTML, JSON or Markdown, with the HTML print-optimized for one-click PDF. The workflow, end to end: scan, enrich, prioritize, review, report, remediate, rescan.
Where Pro sits
The Community Edition is free and open source (MIT): npm install -g nsauditor-ai and you have the scanner, the plugin engine and AI reporting. Pro is $39/month billed annually ($470/year) and adds the intelligence layer described here. Above both sits NSAuditor AI Enterprise, where the same scan results feed compliance evidence packs across eight frameworks — a different problem, for a different reader.
Pro is not another dashboard producing more alerts. It exists to turn raw scan data into decisions a security professional can stand behind. Details, a sample scan and the full edition comparison: nsauditor.com/ai/pro.
