The IT Nerd

Ridge Security today announced RidgeOne, a self-contained solution that brings autonomous AI-powered penetration testing and agentic red teaming to mid-sized organizations. Combining Ridge Security’s RidgeGen® agentic security validation platform with an open-weight AI model running on NVIDIA DGX Spark, RidgeOne enables organizations to perform deep security testing within their own environment without sending sensitive testing data to an external AI provider or incurring ongoing AI token costs. Ridge Security is also joining the NVIDIA Inception Program, which provides startups with resources and support to help accelerate the development of innovative technologies.

For organizations with limited AI or security resources, accessing advanced security testing capabilities can be a challenge. RidgeOne is designed to make autonomous security testing easier to deploy and more accessible, giving organizations a way to use AI-driven offensive security without having to build their own AI infrastructure or maintain a separate AI environment.

RidgeOne is designed to provide several practical advantages:

• Easy to deploy. RidgeOne provides AI-powered security testing without requiring organizations to build and maintain separate AI infrastructure.
• Predictable costs. Running an open-weight model locally eliminates ongoing token costs associated with external AI services.
• Portable. The appliance can be moved and deployed across different network segments, making it useful for organizations with distributed or segmented environments.
• Deep security testing. RidgeOne can autonomously test IT infrastructure, networks, web applications, APIs, Active Directory, hosts and IoT/OT environments, including multi-step attack paths.
• Private by design. Testing activity and sensitive security data remain within the customer’s environment rather than being sent to an external AI provider.

The solution is built around a validated reference configuration based on the NVIDIA DGX Spark compact AI system, with 128 GB of unified memory shared between the AI model and RidgeGen. RidgeOne can be deployed in a VMware environment and brought online in five steps, without requiring customers to build separate AI infrastructure.

In testing, Ridge Security ran RidgeOne against OWASP Juice Shop and completed a full autonomous penetration test without operator involvement. The assessment produced 32 verified findings, including 19 critical and high-severity findings, over approximately 10 hours, without making any external AI calls. The system also connected separate findings into a multi-step attack path.

That ability to connect the dots is central to RidgeGen. Rather than stopping at individual vulnerabilities, the platform can reason across findings, test whether weaknesses can be chained together and provide evidence that security teams can use to prioritize fixes.

As attackers increasingly use AI to automate and accelerate their operations, organizations need ways to put the same technology to work on the defensive side. RidgeOne gives security teams a portable way to bring autonomous testing capabilities into their own environments, whether they are testing a corporate network, a restricted segment or a different environment altogether.

RidgeOne is now available for organizations looking to deploy private, autonomous security testing within their own environments.

Ridge researchers discovered CVE-2026-42542, a high-severity vulnerability in TDengine, a time-series database used in industrial IoT, manufacturing, energy, connected vehicles and other environments that rely on machine and sensor data.

The basic problem is pretty striking: an unauthenticated attacker can crash a TDengine server with a single malformed packet. No credentials, session or user interaction are required. Ridge has not yet observed exploitation or identified any attack IOCs – however, AI-aided vulnerability discovery and chaining have substantially changed the security equation, and the pace of exploitation is only expected to increase.

As Ridge researcher Yan Zhou puts it: “This is a one-packet, no-password kill switch on a database that quietly runs a lot of critical infrastructure. An attacker doesn’t need credentials, a foothold, or any real skill – just the ability to reach the port. What worries us isn’t sophistication, it’s location.”

The concern is what happens when the database underneath an industrial or IoT environment goes down. Telemetry can stop flowing, monitoring can go dark, and operations teams can lose visibility into what’s happening. There’s also the possibility of using an outage like this to blind defenders before pursuing another objective.

TDengine is also embedded in appliances and other vendor-delivered systems, so organizations may not even realize they have it running. And while a patch is available, industrial environments can be difficult to update quickly because of maintenance windows and vendor support requirements.

Detection is tricky:

This vulnerability produces a crash, not an implant, so there are no file hashes, domains, or C2 addresses to hunt for. The signal is behavioral:

• Repeated taosd segmentation faults. Check dmesg, the kernel journal, and any core-dump collection. A database process that had been stable and is now segfaulting repeatedly is the primary indicator.
• Service restart loops. If systemd or a supervisor is cycling taosd, treat it as a potential security event rather than a stability nuisance.
• Anomalous connections to TCP port 6030 from sources outside your known client inventory – particularly short-lived connections that send a small payload and never establish a session.
• Unexplained gaps in time-series ingestion. A hole in your own metrics is often the first visible symptom of a downed metrics database.

For teams writing network detection, there is a clean signature anchor: a packet to the RPC port whose declared msgLen is smaller than the fixed message header is never legitimate traffic. That condition alone is a high-fidelity indicator.

Ridge has published the technical details, including the root cause and remediation guidance, in this blog: https://ridgesecurity.ai/blog/one-packet-can-take-down-the-database-behind-industrial-operations-ridge-security-discovers-cve-2026-42542/

Everyone wants to know which AI model is smartest. But which one is actually best at hacking?

Ridge Security just published what it says is the first-of-its-kind public benchmark putting eight leading models head-to-head as autonomous pentesters. 96 tests across four vulnerable environments. And the results weren’t what you’d expect from a typical AI leaderboard.

Grok 4.5 led on coverage at 77%. Gemini 3 Flash hit 52% at just $5.42 a run. GPT-OSS-120B was the efficiency winner.

But here’s the more interesting part: the model itself may matter less than what you build around it. Ridge found that an agent’s ability to execute, recover when attacks fail and verify its own findings can make a huge difference.

They also found frontier models sometimes refusing to generate payloads or take exploitation steps even during authorized testing. A pretty interesting problem when you’re asking AI to actually do the hacking.

You can read the press release here: Ridge Security Publishes First-of-Its-Kind Benchmark Comparing Leading AI Models for Autonomous Red Teaming

Here’s a question Ridge Security has been digging into: Can an agent use a secret, like a password or token, without its underlying LLM ever having to see that secret?

Ridge’s answer is yes – but getting there means confronting a real problem with how agents are typically built today.

If a pentest agent’s LLM sees raw secrets, that value doesn’t stay contained to one conversation. It can leak into debug logs, error reports, caches, retries, or saved reports. And once it’s already in the LLM’s context, it’s too late to filter out. It also widens the attack surface, since the value now passes through model infrastructure and becomes a target for prompt injection, where a malicious input could trick the agent into repeating or leaking it.

Ridge’s security team argues the fix isn’t a better filter, it’s a different architecture. They call it a “Security Harness”: the agent gets permission to use a secret without the LLM ever being shown the secret itself. The real credential stays behind a trusted boundary, and the model works with a safe reference it can reason about and use only when an authorized action calls for it. They lay out the thinking, and how it could work, in this recent blog post.

The core idea, as they put it: just because an agent is authorized to use a credential doesn’t mean every part of the system, including the LLM, needs to see it. Sharing it anyway turns a controlled operation into an avoidable risk.

Ridge Security today announced the availability of RidgeGen™, an enterprise-grade native agentic AI platform for continuous offensive security testing. Unlike traditional automated security testing tools that primarily follow pre-defined catalogs, RidgeGen takes a fundamentally different approach. It’s a multi-agent AI system that fully leverages the reasoning capabilities of modern foundation models. The agents continuously reason, test, validate, and recommend fixes in iterative AI loops. They’re augmented by our proprietary security knowledge base, grounded through specialized toolchains, and protected by a strict three-zone security guardrail architecture to ensure every action stays within the user’s intended scope.

The launch comes as artificial intelligence reshapes both software development and cyberattacks. As AI accelerates code generation and enables attackers to discover and weaponize vulnerabilities faster than ever before, traditional vulnerability scanners and periodic penetration tests are struggling to keep pace. Even existing automated penetration testing tools often fall short, providing limited findings that can leave organizations with a false sense of security. Security teams are increasingly overwhelmed with alerts but lack the evidence needed to determine which vulnerabilities represent real business risks and how to implement rapid remediation.

RidgeGen addresses this challenge by augmenting AI models with Ridge Security’s proprietary security knowledge base, specialized tooling, and enterprise-grade agentic AI framework. It combines AI reasoning with deterministic controls that keep security testing safe, auditable, and explainable. By separating AI reasoning from authority, enforcement, and verification, RidgeGen enables organizations to safely deploy autonomous offensive security while maintaining strict governance over targets, credentials, and testing policies.

Unlike traditional security testing tools that identify potential issues based on signatures or known CVEs, RidgeGen autonomously investigates how attackers could chain together vulnerabilities, business logic flaws and misconfigurations to compromise an environment. Every finding is validated with reproducible evidence before being surfaced, dramatically reducing false positives and false negatives and enabling security teams to prioritize exploitable risk rather than theoretical exposure.

While RidgeGen is designed to be model-agnostic and supports flexible deployment options, including on-premises environments, its development and benchmark testing framework were built on Google Cloud. Throughout the development process, Gemini served as a key baseline model for evaluating performance, reliability, and cost efficiency. Our benchmark testing across multiple leading AI models demonstrated that Gemini delivers a strong balance of performance and cost efficiency, making it a highly effective foundation for enterprise-grade agentic AI security applications.

Key capabilities include:

• Autonomous agentic AI red teaming and offensive security testing
• Evidence-backed verification that eliminates false positives and AI hallucinations
• Discovery of complex multi-step attack chains and business logic vulnerabilities
• Click-away remediation guidance generated from validated findings
• Runtime guardrails that enforce safe, supervised and authorized testing modes
• Secure credential handling through SafeBox, preventing sensitive data from entering AI model prompts or memory
• Model-agnostic architecture supporting leading commercial and self-hosted AI models
• On-premises deployment options that keep customer data and evidence within enterprise environments

RidgeGen complements RidgeBot, Ridge Security’s AI-powered continuous security validation platform. Together, the two solutions provide organizations with continuous visibility across their attack surface while delivering deep, autonomous validation of high-value targets – creating a unified “find, prove and fix” approach to Continuous Threat Exposure Management (CTEM).

The platform is available immediately for enterprise organizations and managed security service providers worldwide.

Ridge Security today announced that it has achieved ISO/IEC 27001 certification, the globally recognized standard for information security management systems (ISMS). The certification comes ahead of the company’s upcoming RidgeBot 6.0 platform release, which introduces enterprise-scale enhancements for AWS and Windows security validation.

ISO/IEC 27001 certification provides Ridge Security with a competitive advantage by meeting these rigid requirements, helping accelerate sales cycles and supporting expansion into new global markets. Achieving this certification validates Ridge Security’s commitment to safeguarding sensitive information, continuously improving its security posture, and operating with long-term resilience and accountability.

The new certification applies to all Ridge Security products, including the company’s flagship platform, the upcoming RidgeBot 6.0, a leading agentic AI-based adversarial risk validation platform that supports continuous threat exposure management programs. It is designed for continuous security validation and risk-based vulnerability management, scanning IT environments, discovering attack surfaces and validating weaknesses using real proof-of-concept exploits with zero false-positives.

Additionally, RidgeBot can safely simulate real-world adversarial attacks. RidgeBot 6.0 integrates with AI frameworks such as RidgeGen, enabling advanced capabilities including exploit chaining, contextual reasoning, PII detection, and detailed remediation guidance. These features allow enterprises to conduct frequent, scalable testing beyond traditional manual methods.

More information on RidgeBot 6.0 is available at https://ridgesecurity.ai/ridgebot/.

Ridge Security has made its flagship AI-powered solution, RidgeBot^®, available on the Microsoft Azure Marketplace, Microsoft’s online store providing applications and services for use on Azure. Customers and partners can seamlessly deploy RidgeBot within their Azure environments to perform continuous, AI-driven validation that identifies, validates, and remediates vulnerabilities at scale.

Transforming Security Validation Through Automation

Powered by AI-driven automation, RidgeBot autonomously identifies attack surfaces, safely executes exploitations, and generates actionable reports aligned with OWASP and MITRE frameworks. This enables security and DevOps teams to detect, validate, and remediate vulnerabilities faster, reducing risk exposure and strengthening resilience across hybrid and multi-cloud environments.

By leveraging Azure’s global infrastructure, RidgeBot allows organizations to unify automated penetration testing and continuous security validation under a single cloud platform. The result is a scalable, always-on approach that replaces infrequent manual testing with continuous, data-driven assurance of real-world defenses.

Designed for Enterprises and Partners Alike

RidgeBot on Microsoft Azure Marketplace provides flexible deployment options tailored to different security and operational needs:

• Managed Application (Subscription): Deploy RidgeBot directly from Azure with a simple monthly plan covering one web app or up to twenty IPs, billed through Azure.
• Virtual Machine (BYOL): Deploy RidgeBot as a VM using a license purchased directly from Ridge Security for greater configuration flexibility.
• Microsoft Sentinel Joint Solution: Centrally manage multiple RidgeBot deployments across on-premise and cloud environments for unified alerts and analytics.

These options empower enterprises and partners to scale security validation seamlessly within their Azure ecosystems. Learn more at www.ridgesecurity.ai/azure

Ridge Security, leader in AI-powered offensive security for Continuous Threat Exposure Management (CTEM), today announced that it was the second highest vendor to score a willingness to recommend with 95% in the 2025 Gartner’s Peer Insights “Voice of the Customer” for Adversarial Exposure Validation.

Based on 22 reviews validated by Gartner as of August 2025 Ridge Security recently announced RidgeGen, a comprehensive Agentic AI framework designed to take security validation from automation to autonomy. Powered by RidgeGen, Ridge Security’s flagship product, RidgeBot, covers an organization’s IT infrastructure, including hosts, networks, applications, APIs, and LLMs, making it the platform with the most comprehensive offensive security framework ever developed. We feel like the willingness to recommend score from Gartner Peer Insights™ “Voice of the Customer” is evidence of the company’s growing demand for Adversarial Exposure Validation technology.

According to Gartner, Adversarial Exposure Validation represents a market segment focused on solutions that continuously test, validate, and measure an organization’s security posture by emulating real-world attacker behaviors. These technologies operationalize adversarial techniques to assess and prioritize exposures with precision and repeatability.

Within this framework, Gartner Peer Insights defines willingness to recommend as the percentage of verified end users who indicate they would endorse a vendor solution to their peers, a key measure of customer advocacy. Derived from 18 months of practitioner reviews, this metric offers an evidence-based view of user confidence and satisfaction with Ridge Security’s flagship product, RidgeBot.