On-Premise AI Pentesting Tools: What Runs Fully in Your Network (2026)

Vendors use the word for at least three architectures. Ask which one you are buying:

• Local sensor, cloud brain

  A host or virtual appliance runs inside your network and executes the test, but planning, the AI model and the console are in the vendor's cloud. The test needs a live connection.

• Local engine, cloud model

  The platform runs on your hardware but sends prompts to a cloud AI provider, either the vendor's choice or your own API keys. Your data reaches that provider.

• Self-contained

  The engine, the AI model, the evidence and the console all run on hardware you control, and the product keeps working with no internet connection.

Only the third keeps every finding, credential and proof of exploit inside your perimeter. The buyer's guide to on-premise pentest platforms turns this into contract language.

• Zero Hunt

  An autonomous AI red team for networks and infrastructure, delivered as an appliance: a desktop unit for smaller sites or a 2U rack. Its own ZeroHunt Apex models run on the appliance GPU, with no external AI API. Ten specialist agents run black-box and gray-box campaigns, with five autonomy levels and human approval for sensitive actions. Air-gapped mode is documented: updates arrive as signed offline bundles, and public OSINT and source downloads are switched off, so tests run black-box. Evidence records are signed and hash-chained on the appliance. It also maps findings to 34 compliance frameworks across nine regions.

• Aikido Machine

  A 4U GPU server that runs Aikido's AI pentesting inside your network; inference runs on the machine's own GPUs and Aikido describes it as air-gapped by design, with updates by encrypted USB. It tests applications white-box, from source code and runtime, including flaws behind login flows such as IDOR and broken access control. Launched in August 2026; one annual software fee, hardware bought separately.

• Picus Security

  A breach and attack simulation (BAS) platform that documents on-premise, hybrid and fully air-gapped deployment. It simulates attacks and validates attack paths rather than running an LLM pentest agent; ask where any AI features run.

• RidgeGen and RidgeBot (Ridge Security)

  RidgeGen, the agentic product, installs as a self-contained VM and lets you bring your own model: your enterprise keys for a cloud model, or a self-hosted open model. Only the second keeps prompts local. RidgeBot, the automated pentest product, runs on your VMs or bare metal, or from the AWS and Azure marketplaces. We found no documented air-gapped mode for either.

• Pentera Core

  Pentera's internal pentesting product runs inside your network and now includes AI features. Its product page does not state where the AI runs, and we found no documented air-gapped option. Ask.

• FireCompass

  SaaS for external testing; internal network and Active Directory testing run through an on-premise virtual appliance. Where the AI runs and whether it works offline are not documented.

• Penligent

  Lists on-premises deployment with data localization and private model integration through an inference gateway in its Enterprise tier. Its own article (October 2026) says the architecture and delivery timeline are not public yet.

Open-source AI pentesting agents become on-premise when you point them at a model you host. You then own the GPU, the model quality and the guardrails. More on how they work in AI pentesting agents.

• PentAGI

  (MIT). Multi-agent network and service pentesting in a Docker sandbox; works with Ollama, vLLM or any OpenAI-compatible endpoint, and its README lists air-gapped deployments with local inference as a use case. A commercial enterprise edition exists.

• Strix

  (Apache-2.0). Web apps, APIs and code repositories; the model endpoint can be a local model served by Ollama or LM Studio.

• CAI

  (Alias Robotics). Supports local models through Ollama, but the Alias additions are under a research-only licence: commercial use needs a licence, and Alias sells an air-gapped on-premise edition.

• PentestGPT

  (MIT). Its autonomous mode drives Claude Code or Codex, both cloud services; only the older interactive mode runs on a local model.

The gap between these and a product is everything around the agent: scope enforcement, approval gates, evidence integrity, reporting and support. Accuracy depends on the model your hardware can run.

Horizon3.ai NodeZero runs internal tests from a host you deploy (a VM or Docker), but the host is orchestrated from Horizon3's portal and must keep uninterrupted access to its endpoints for the whole test; some web application tests also need cloud AI endpoints. Hosted portals exist in the US, EU and Australia and for FedRAMP High. We found no air-gapped edition. XBOW, Cymulate and XM Cyber are delivered as SaaS. These can be the right choice where data residency in a vendor cloud is acceptable; the ten-platform comparison covers them side by side.

1. 1Write down whether the tool must run with no internet connection. If yes, keep only tools that document air-gapped operation.
2. 2Ask where the AI model runs and who owns it. "Bring your own key" still sends data to a cloud provider.
3. 3Match the scope: network and Active Directory testing, application testing from source code, or attack simulation are different products.
4. 4Ask what is lost offline: threat intelligence, OSINT, source downloads, updates.
5. 5Ask how updates reach an isolated network and how they are signed.
6. 6Ask who approves risky actions and how a test is stopped.
7. 7Ask where evidence is stored and whether you can verify it without the vendor.
8. 8Get every answer in the contract; the buyer's guide has 15 questions to send.

Which AI pentesting tools work fully air-gapped? From vendor documentation checked in November 2026: Zero Hunt (networks and infrastructure; black-box only when air-gapped) and Aikido Machine (white-box application testing) run their AI models locally and document air-gapped operation. Picus documents air-gapped deployment for breach and attack simulation. Open-source PentAGI can run with a local model, and Alias Robotics sells an air-gapped edition of CAI.

Is Horizon3.ai NodeZero on-premise? Partly. The NodeZero host that runs internal tests is deployed in your network, but it is orchestrated from Horizon3's cloud portal and needs uninterrupted access to its endpoints during a test. No air-gapped edition is documented.

Can I run an open-source AI pentesting agent on premise? Yes, if it supports a local model endpoint, as PentAGI and Strix do. You supply the GPU and the model, and you build the scope limits, approvals and evidence handling a commercial platform includes.

Do on-premise AI pentesting tools cost more than SaaS? The cost shape differs: an appliance or GPU server includes hardware, while cloud agents bill by use or by asset. Tools running on your own hardware cost the same however many campaigns you run. See what automated pentesting costs.