NSAuditor AI

We find what your GRC platform misses: shadow admins, IAM privesc, NSG holes. SOC 2 evidence. Open source. Multi-cloud. Zero data exfil.

[NSAuditor AI @Nsasoft]

🚀 NSAuditor AI Enterprise Edition v0.18.0 is here — a deep GCP false-negative hardening release.

🛠️ 5 detection-gap fixes that stop "silent cleans":
1️⃣ Legacy GCS bucket ACL tracking (catches allUsers:READER when UBLA is off)
2️⃣ Project-scope SA key creation flagging
3️⃣ Transitive impersonation graph mapping (BFS up to 4 hops)
4️⃣ Pure ADC auth support — no key file needed
5️⃣ Fail-closed evidence routing (AccessDenied = FAILED, not clean)

📋 One Scan, Six Frameworks: SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO 27001:2022 & CIS Controls v8 — 62 signed evidence artifacts per run with RFC 3161 timestamps + SHA-256 sidecars.

🔌 Now native in Claude Desktop via MCP: start_assessment, prioritize_risks, compliance_check, export_report & more — turning your AI assistant into an autonomous cloud compliance auditor.

#CloudSecurity #GCP #Compliance #DevSecOps

[NSAuditor AI @Nsasoft]

📢 We've also shared this on LinkedIn — full breakdown and discussion here: https://t.co/Hxbr5PGf1G

[NSAuditor AI @Nsasoft]

🚀 NSAuditor AI Enterprise Edition v0.18.0 is here — a deep GCP false-negative hardening release.

🛠️ 5 detection-gap fixes that stop "silent cleans":
1️⃣ Legacy GCS bucket ACL tracking (catches allUsers:READER when UBLA is off)
2️⃣ Project-scope SA key creation flagging
3️⃣ Transitive impersonation graph mapping (BFS up to 4 hops)
4️⃣ Pure ADC auth support — no key file needed
5️⃣ Fail-closed evidence routing (AccessDenied = FAILED, not clean)

📋 One Scan, Six Frameworks: SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO 27001:2022 & CIS Controls v8 — 62 signed evidence artifacts per run with RFC 3161 timestamps + SHA-256 sidecars.

🔌 Now native in Claude Desktop via MCP: start_assessment, prioritize_risks, compliance_check, export_report & more — turning your AI assistant into an autonomous cloud compliance auditor.

#CloudSecurity #GCP #Compliance #DevSecOps

[NSAuditor AI @Nsasoft]

Full release breakdown on LinkedIn: https://t.co/uK83P3RSrN

[NSAuditor AI @Nsasoft]

NSAuditor AI EE 0.18.0 is live: GCP false-negative hardening.

A cloud audit that reads "clean" can still be wrong. This release closes five real GCP detection gaps — no new controls, all six compliance matrices unchanged. 28 plugins.

What we fixed 🧵

[NSAuditor AI @Nsasoft]

4/ Both were caught by a new mandatory pre-publish validation gate — pack → global-install → real scan → live run — before they shipped.

A false negative is the worst defect an audit tool can ship. We hunt them.

npm i -g nsauditor-ai@latest
https://t.co/mA4rcB9ZrY

#CloudSecurity #GCP

[NSAuditor AI @Nsasoft]

3/ Fail-closed, not silently clean.

A denied GCP enumeration now routes into findings and fails its own controls. Plus two pre-existing bugs — a project-IAM check on the wrong client (never ran) and an IAM-admin client unauthenticated under pure ADC — both fixed + live-validated.

[NSAuditor AI @Nsasoft]

2/ IAM impersonation completeness.

A project-scope serviceAccountKeyAdmin can mint a long-lived key for ANY service account = offline impersonation of the whole project. And a custom role can grant actAs admin-equivalence. Both are now detected instead of reading clean.

[NSAuditor AI @Nsasoft]

1/ Legacy-ACL public buckets.

A GCS bucket made public via a legacy ACL (allUsers / allAuthenticatedUsers) while Uniform Bucket-Level Access is off was reading clean — we only checked IAM-policy exposure. Now we scan the bucket ACL + a sampled object-ACL surface.

[NSAuditor AI @Nsasoft]

Also on LinkedIn: watch the same Getting Started walkthrough here https://t.co/dQvZuVKQa7

[NSAuditor AI @Nsasoft]

New to Nsauditor AI Enterprise? Watch this quick Getting Started walkthrough, from the license key in your purchase email to your first signed audit report.

Install, activate, configure, scan, and read the results, all on your own machine. No scan data ever leaves your network. One scan produces timestamped evidence packs across SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, and CIS Controls v8 spanning AWS, Azure, and GCP.

Learn more: https://t.co/tGN97SYUTY

#CloudSecurity #Compliance #SOC2 #HIPAA #DevSecOps

[NSAuditor AI @Nsasoft]

Also on LinkedIn: read the full Getting Started guide here https://t.co/rwiPLuytfk

[NSAuditor AI @Nsasoft]

https://t.co/nq6aPennMJ

[NSAuditor AI @Nsasoft]

Until now an NSAuditor AI cloud audit looked at ONE AWS region — whichever your account was set to. A public bucket in eu-west-1, a wide-open SG in ap-southeast-2: invisible if you happened to scan us-east-1.

EE 0.17.0 adds --aws-region. 🧵

[NSAuditor AI @Nsasoft]

Plugin count unchanged at 28; all six compliance matrices unchanged. This is reach, not new claims.

npm i -g nsauditor-ai@latest (Community)
@nsasoft/nsauditor-ai-ee@latest (Enterprise)

https://t.co/2mUd9KRHs3

#CyberSecurity #CloudSecurity #AWS #InfoSec

[NSAuditor AI @Nsasoft]

Until now an NSAuditor AI cloud audit looked at ONE AWS region — whichever your account was set to. A public bucket in eu-west-1, a wide-open SG in ap-southeast-2: invisible if you happened to scan us-east-1.

EE 0.17.0 adds --aws-region. 🧵

[NSAuditor AI @Nsasoft]

Safe by default. No flag = single region (behaviour-preserving), and it discloses the regions it didn't scan. An unknown region code fails fast — a scan never silently mis-scopes.

In Claude Desktop, "all regions" is covered automatically in small batches: full reach, no timeouts.

[NSAuditor AI @Nsasoft]

The part we care about most: a region it genuinely can't reach is an explicit evidence gap — the CloudTrail verdict fails closed over it, never a silent "all clear." Confirmed live in Claude Desktop.

npm i -g @nsasoft/nsauditor-ai-ee@latest

[NSAuditor AI @Nsasoft]

We shipped NSAuditor AI EE 0.16.7 — and it came straight from a real bug report. An operator asked Claude Desktop to "audit my AWS account" and the CloudTrail auditor came back oddly thin. 🧵

[NSAuditor AI @Nsasoft]

0.16.7: a short per-region connect/request timeout + wider fan-out → a dead region fails in ~2s, not 30. And an errored region is now recorded and skipped, not fatal. 234 seconds → ~13 seconds, fully multi-region.