Ridge Security has announced RidgeOne, an appliance combining its RidgeGen security-testing platform with an open-weight AI model running on NVIDIA DGX Spark. The pitch is autonomous penetration testing without sending sensitive testing data to an external AI provider, or building a separate AI setup first. That is a concrete local-AI security product, with useful details beyond the usual promise to make cybersecurity cleverer.
Watch Desk analysis
What happened
Help Net Security reports that RidgeOne is built around a configuration with 128 GB of unified memory shared between the model and RidgeGen. The system can be deployed in a VMware environment, and the company says it can be brought online in five steps. RidgeOne is designed to test networks, web applications, APIs, Active Directory, hosts and IoT/OT environments, including multi-step attack paths.
Ridge Security says it tested the system on OWASP Juice Shop. In that test, the company reports, RidgeOne completed a penetration test without operator involvement, produced 32 verified findings, including 19 critical- and high-severity findings, and connected separate issues into an attack path over roughly 10 hours. It says the test made no external AI calls. Those are the company’s reported results, not an independent assessment of the appliance’s performance.
Why it matters
Keeping security tests and their data inside an organisation’s environment may appeal to teams that cannot send sensitive findings to a cloud service. Running an open-weight model locally also changes the cost equation: Ridge Security says it avoids ongoing token charges from external AI providers. The trade-off is that buyers still need suitable infrastructure and evidence that the tool’s findings are accurate and useful.
The reported test gives readers a specific measure to scrutinise, rather than a vague claim of autonomous security. But a run on OWASP Juice Shop does not establish how RidgeOne performs across real production systems. In security, “verified” is a claim worth checking, not a magic word that completes the audit for you.
Our read
RidgeOne puts local inference to work on a clearly defined security task: testing an organisation’s systems while keeping the activity and data on site. That is a useful development for teams weighing AI-assisted testing against confidentiality and operating costs. The next proof point is independent, repeatable testing on varied systems, with enough detail to judge false positives as well as findings.
What to watch
- Whether Ridge Security publishes more detail on the OWASP Juice Shop test and its verification method.
- How RidgeOne performs on systems beyond the company’s reported test.
- What hardware, licensing and deployment costs customers face.
Discussion spark: Should organisations trust an AI security appliance with autonomous testing before independent evaluations are available, or is keeping the data on-site enough to justify an early trial?
Sources and evidence
- Source update (13 October 2026, 12:49 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.