Email Triage
MCP Workflows
Slack Bot
Casco becomes the First Agentic Pentesting Platform Certified via FedRAMP 20x
On November 5, 2026, Casco for Government became the tenth cloud service offering to achieve FedRAMP 20x Class A (Pilot) certification.
When Ian and I started Casco, the government wasn’t part of our original customer profile. Then federal security teams started approaching us at conference booths, asking whether they could use Casco for continuous, agentic pentesting. We decided to pursue FedRAMP so federal agencies could evaluate Casco with a security package they could review and reuse.
Why pursue FedRAMP?
Adversaries of the U.S. government can use open-weight models and agents to probe government software around the clock. Federal agencies need to test at the same pace.
Casco continuously tests applications, agents, APIs, cloud environments, mobile apps, browser extensions, and networks. Our agents find exploitable vulnerabilities, demonstrate their impact, and replay attacks to verify fixes within approved targets and test scenarios.
We explored Small Business Innovation Research (SBIR) as a potential contracting route and reviewed federal actions to counter cybercrime. We also needed a security package that agency teams could review.
FedRAMP provides a standardized assessment of a cloud service’s security, with evidence that agencies can reuse. Each agency still makes its own authorization and purchasing decisions.
20x vs. Rev5?
The traditional Rev5 route looked expensive and slow for us. Rev5 assesses a service against applicable NIST SP 800-53 Revision 5 controls through implementation documentation, supporting evidence, and independent testing.
GSA launched FedRAMP 20x in March 2025. It organizes assessment around Key Security Indicators, with an emphasis on automated verification and machine-readable evidence that stays current as the service changes. Both approaches require ongoing monitoring.
Our upfront estimate for starting with 20x was roughly a quarter of the Rev5 option we had priced. Class A is an initial entry point into serving government security buyers and makes pursuing federal customers practical for us at our stage.
Casco for Government: A Match Made in Heaven
Even before we began thinking about FedRAMP’s requirements, we already had centralized MFA, automated account provisioning, default-deny security groups, and CloudTrail operating. Our government offering deploys in an isolated AWS account, with model access through Bedrock in US-East. Our existing stack gave us a head start: it was already built primarily on AWS, with a few subprocessors. For our government product, we had to migrate just three vendors in our stack.
That gave us a head start in our journey from initial preparation to listing on the FedRAMP Marketplace to Class A. We’re now focused on advancing from Class A to Class C, which would provide agencies with additional assurance for use in moderate-impact information systems, subject to their own authorization decisions.
Our Timeline
We began our FedRAMP preparations with Mycroft on August 20. Just eight days later, on August 28, Casco for Government was listed on the FedRAMP Marketplace.
Mycroft submitted our initial Class A package on September 2. Certified status followed on November 5, 69 days after our Marketplace listing.
That’s 77 days from the Mycroft listing kickoff to Class A certification, excluding earlier planning and security preparation.
Shoutout to Mycroft
Mycroft assisted with compliance preparation, submission, and review coordination. I’d like to thank the Mycroft team for helping us reach Class A. We’re continuing to work together toward Class C.
Evaluate Casco for your agency
If you’re on a government security team, book a demo or contact government@casco.com. We’re excited to walk you through our government offering, review the certification package, and discuss an evaluation within your approved testing scope.
René Brandel is co-founder and CEO of Casco.