A new product from Ridge Security aims to make AI-powered penetration testing practical for organizations that can't send their security testing data to external cloud providers. RidgeOne combines the company's RidgeGen platform with an open-weight AI model running on NVIDIA hardware, letting teams run autonomous red-team exercises without external dependencies.
The solution addresses a real gap: advanced security testing has historically required either expensive external consultants or cloud-connected tools that some environments can't support. RidgeOne targets mid-sized organizations with compliance requirements or sensitivity concerns that rule out sending testing data elsewhere.
- RidgeOne runs on NVIDIA DGX Spark hardware with 128 GB of unified memory
- The system completed a full autonomous test against OWASP Juice Shop with 32 findings, including 19 critical or high-severity issues
- Testing took approximately 10 hours without any external AI calls
- RidgeGen links individual vulnerabilities into multi-step attack paths for prioritization
How the Setup Works
RidgeOne uses a validated reference configuration based on the NVIDIA DGX Spark compact AI system. Organizations deploy it within their own VMware environment through a five-step process, avoiding the need to construct separate AI infrastructure.
The open-weight AI model runs entirely locally. Ridge Security says this eliminates ongoing token costs that come with cloud-based AI services and keeps all testing activity, findings, and data under the customer's control throughout the process.
During internal testing, Ridge Security ran RidgeOne against the OWASP Juice Shop vulnerable web application. The system completed the assessment autonomously over roughly 10 hours, producing 32 verified findings. Of these, 19 were classified as critical or high severity. Ridge Security reports the platform also connected separate findings into chains representing multi-step attack paths rather than stopping at individual vulnerabilities.
Why This Matters
The ability to reason across findings is where RidgeGen differs from simpler scanning tools. Many automated testing products surface a list of vulnerabilities. RidgeGen attempts to demonstrate how weaknesses could be combined, giving security teams evidence for prioritizing fixes based on real attack sequences rather than severity ratings in isolation.
Organizations with limited AI or security staffing have historically faced a choice between basic automated tools and expensive external red teams. RidgeOne targets that middle ground, though pricing and full availability details aren't yet public.
Practical Example
Say your organization manages healthcare data subject to HIPAA requirements. You want to test your internal network for weaknesses but can't use cloud-based AI tools that would route sensitive data to third parties. RidgeOne would let your team run a full autonomous penetration test entirely within your own environment, generate findings categorized by severity, and receive a mapped attack path showing how a threat actor could chain vulnerabilities to reach patient records. You control the hardware, the data, and the timeline.
What to Watch Next
Ridge Security hasn't announced general availability or pricing. Watch for enterprise licensing details and whether the platform expands beyond the OWASP Juice Shop validation testing to cover additional target environments.
Key takeaways
- On-premises AI penetration testing removes external data sharing risks for regulated industries
- Autonomous testing can now chain findings into attack paths rather than listing vulnerabilities in isolation
- 10-hour fully autonomous tests against known targets suggest this approach is approaching practical usability for resource-constrained teams
Frequently asked questions
What does "autonomous penetration testing" mean?
The system runs tests without requiring an operator to guide each step, though human review of findings remains part of the workflow.
Does this replace external penetration testing consultants?
Not entirely. It provides continuous internal testing capability but doesn't address the social engineering and physical security angles that human testers cover.
How does it keep data inside the organization?
RidgeOne runs on customer-owned hardware with no outbound calls to external AI services during testing.