The Pulse
Ridge Security Launches RidgeOne, a Local Red-Team Appliance
Ridge Security launched RidgeOne, an AI penetration-testing appliance built around NVIDIA DGX Spark that runs an open-weight model and RidgeGen locally. The company says a test of OWASP Juice Shop found 32 verified issues in about 10 hours,
AI.info Team · Written with AI ·
Ridge Security is selling autonomy and containment in one package: RidgeOne runs AI-assisted penetration tests inside a customer’s environment, without external model calls, but customers still need NVIDIA hardware and a separate RidgeGen license. The company announced the appliance on October 13, pitching it to organizations that want automated security testing without building AI infrastructure or sending test data to an outside provider.
That trade-off is the product’s central pitch—and its practical caveat. Ridge Security says local model execution removes ongoing AI token costs; its product page directs buyers to obtain an NVIDIA DGX Spark and consult a sales representative about a RidgeGen license and credits. The company has not listed a price on the RidgeOne page.
RidgeOne puts RidgeGen on NVIDIA DGX Spark
The appliance combines RidgeGen, Ridge Security’s agentic security-testing platform, with an open-weight AI model on NVIDIA’s compact DGX Spark system. The launch announcement describes a reference configuration with 128 GB of unified memory shared by the model and RidgeGen. Ridge Security’s product page names NVIDIA Nemotron 3 Nano, NVIDIA Nemotron 3 Super and GPT-OSS as model options.
The system is designed to test IT infrastructure, networks, web applications, APIs, Active Directory, hosts and IoT/OT environments. Ridge says it can link weaknesses into multi-step attack paths rather than reporting each potential vulnerability in isolation. The company also says the appliance can run in restricted or segmented networks and be deployed in a VMware environment.
A 10-hour test is Ridge Security’s evidence
Ridge Security says it ran RidgeOne against OWASP Juice Shop, a deliberately vulnerable web application, and completed an autonomous penetration test without operator involvement. The company reports 32 verified findings, including 19 classified as critical or high severity, over approximately 10 hours, with no external AI calls. It says the system connected separate findings into an attack path.
Those figures come from Ridge Security’s own test, not an independent evaluation described in the announcement. The release does not provide a comparison with another product or a breakdown of the individual findings. The result therefore offers a company-reported demonstration of the workflow, rather than evidence of performance across customer networks.
Autonomy comes with limits set by the customer
Ridge Security says customers define which systems fall within scope and how aggressive a test can be. Its product page says policy limits operate outside the AI model, credentials are kept out of the model’s reach, and test actions are logged locally. The company also says repeat tests use recorded assessments to make results reproducible.
“Autonomous security testing is changing what security teams can do, but autonomy has to come with control,” said Lydia Zhang, president of Ridge Security. “RidgeOne gives organizations a practical way to bring AI-powered offensive security into their own environments while maintaining control over the data, the infrastructure and the testing process.”
Hardware and licensing remain part of the bill
RidgeOne is available now, according to the company’s launch announcement. Buyers must obtain the DGX Spark hardware and a RidgeGen license; Ridge Security says its sales team will confirm license and credit details and help scope a proof of value. The no-token-cost claim thus concerns model usage, not the total cost of deploying and operating the appliance.
Ridge Security is also joining NVIDIA’s Inception program, the announcement says. For prospective customers, the concrete offer is a locally run testing appliance with a defined hardware base, a license still arranged through the vendor, and test results the company has so far illustrated with its own OWASP Juice Shop run.