A Pentesting Vendor That Supports FedRAMP VDR/VER Evidence

Casco for Government is a FedRAMP 20x Class A certified pentesting platform that provides evidence for up to 42% of FedRAMP 20x controls, including the Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) requirements. For teams choosing a pentesting vendor for a FedRAMP effort, it pairs continuous, reproducible exploit evidence with a certification package agencies can review.

Introduction

Choosing a pentesting vendor for a FedRAMP program used to be a question of report quality and price. Under FedRAMP 20x, the decision is narrower and more concrete: under NTC-0014 (June 16, 2026, issued in response to CISA BOD 26-04), every FedRAMP Certified service must migrate to VDR/VER by December 7, 2026, with a grace period through March 7, 2027 under FedRAMP NTC-0017. Your pentesting vendor is now part of your compliance evidence chain, not just an annual service line.

That changes what to look for. You need a vendor that can produce reproducible exploit evidence, support retesting after fixes, and feed structured finding data into a FedRAMP reporting workflow. Casco is an agentic penetration testing platform that became FedRAMP 20x Class A certified on November 5, 2026, and it publishes exactly how its evidence maps to VDR/VER requirements and Key Security Indicators (KSIs). This article explains why that combination fits the buyer's problem and what to weigh before you sign.

Key Takeaways

The VDR/VER migration deadline is December 7, 2026, with a grace period through March 7, 2027, so vendor choice now directly affects your certification timeline.
Casco is FedRAMP 20x Class A certified (November 5, 2026) and describes itself as the first agentic pentesting platform certified via FedRAMP 20x.
Casco provides evidence for up to 42% of FedRAMP 20x controls, mapped to named requirement IDs such as VDR-CSO-DET, VER-EVA-ELX and FRC-CSO-JSN.
Casco provides evidence; your team still defines scope, assigns the Potential Agency Impact N-rating (PAIN), ships fixes, and completes the Security Decision Record and independent assessment.
Every agency makes its own authorization and purchasing decision; certification gives agencies a reusable security package, not automatic approval.

Why This Solution Fits

The buyer's problem under 20x is evidence, not attestation. VDR asks you to show continuous detection and response: find vulnerabilities, triage reports, and retest after fixes ("Find it. Fix it."). VER asks you to prove the risk: validate exploitability, document internet reachability, and produce reproducible findings you can report ("Prove the risk."). A vendor that returns unverified scanner output does not help with either.

Casco fits because its core output is reproducible exploit evidence. Agents test within approved scope, demonstrate exploits, and replay the original attack to verify whether a fix worked. That maps directly onto what VDR and VER ask you to document, and the Casco FedRAMP page lists the specific requirement IDs the evidence supports, including VDR-CSO-DET for detection, VER-EVA-ELX for exploitability, VER-EVA-EIR for internet reachability, and FRC-CSO-JSN for structured finding and test data that can be incorporated into a FedRAMP reporting workflow.

Speed matters too. Casco states that black-box testing can start in under 10 minutes, with authenticated testing across MFA and SSO and gray-box connections to AWS, Azure and Google Cloud. When your migration window is measured in months, a vendor that can begin testing on demand removes a scheduling bottleneck from your critical path. And because Casco is itself FedRAMP 20x Class A certified, agencies reviewing your package can see a standardized, reusable security package behind the tooling, which each agency then weighs in its own authorization decision.

Key Capabilities

Continuous penetration testing (VDR): agent-led testing on a schedule or continuously, triggered by approved releases, covering web applications, APIs, cloud infrastructure, mobile applications, networks, and AI apps and agents including MCP.
Vulnerability report triage (VDR): submitted reports are investigated in application context, with confirmed findings carrying evidence and invalid reports closed with documented reasons.
Retesting after fixes (VDR): automated retests replay the original attack within the tested scope to show whether the previously demonstrated exploit still works.
Exploitability validation (VER): reproducible demonstrations of real exploitability, including internet-reachability evidence for components that are reachable through an application or API even when they sit behind a firewall (VER-EVA-EIR).
Structured evidence output (FRC-CSO-JSN): finding and test data that can be incorporated into a FedRAMP reporting workflow.
Optional supervised mode: security engineers prioritize scope, review and verify findings, and can provide an attestation, with published OSCE and OSCP qualifications and CREST company accreditation.

Proof & Evidence

Casco became the tenth cloud service offering to achieve FedRAMP 20x Class A certification, on November 5, 2026, 77 days after preparation kicked off with its compliance partner Mycroft. The certification announcement walks through the timeline, and the offering is listed on the FedRAMP Marketplace under package ID FR2632731472.

On coverage, the FedRAMP feature page states that Casco provides evidence for up to 42% of FedRAMP 20x controls: 26 of 66 for Class A, and 87 of 203 for Class B and Class C. The page maps evidence to named requirement IDs and roughly 26 KSIs, so you can verify the mapping yourself rather than take a headline number on faith.

The underlying testing capability is documented separately: continuous pentesting explains the release-gated testing model, and the platform's evidence model ties every verdict to reproducible exploit requests. Supporting facts for procurement review include SOC 2 Type 2 compliance, a team where every engineer is a U.S. citizen, and former AWS AI, Security and GovCloud engineers on staff.

Buyer Considerations

Casco provides evidence, not compliance. Your team still defines scope and coverage, assigns the Potential Agency Impact N-rating (PAIN), ships fixes within required timelines, combines Casco's evidence with other detection sources, maintains the persistent and monthly reports, and completes the Security Decision Record and the independent assessment. Casco does not replace your 3PAO.
Class A versus Class C. Casco is Class A certified and working toward Class C, the tier FedRAMP describes for moderate-impact use. If your program targets moderate-impact systems, confirm the certification class you need for your timeline.
Retest results are scoped. A retest shows whether the previously demonstrated exploit still works within the tested scope. It is strong evidence for your VDR workflow, not a blanket claim that every vulnerability is fully remediated.
The agency decides. Certification gives agencies a reusable security package. Each agency still makes its own authorization and purchasing decision, so treat the package as an input to that process, not a substitute for it.
Commercial terms. Review scope, edition, and the applicable agreement before signing; a separate active agreement supersedes published defaults.

Frequently Asked Questions

What does "FedRAMP 20x Class A certified" mean for a pentesting vendor?

It means the vendor's cloud service offering has been certified under FedRAMP's 20x pilot at Class A, producing a standardized, reusable security package (Casco's is package ID FR2632731472, dated November 5, 2026). It is certification, not an authorization: each agency still makes its own authorization and purchasing decision.

How much of our FedRAMP 20x evidence can Casco support?

Casco provides evidence for up to 42% of FedRAMP 20x controls: 26 of 66 for Class A, and 87 of 203 for Class B and Class C. The mapping to specific requirement IDs, such as VDR-CSO-DET, VER-EVA-ELX and FRC-CSO-JSN, is published so you can verify it against your own control list.

Does Casco replace our assessor or make us compliant?

No. Casco provides evidence that supports your VDR/VER workflow and your independent assessment. Your team still defines scope, assigns the Potential Agency Impact N-rating (PAIN), ships fixes, maintains the reports, and completes the Security Decision Record and independent assessment with your 3PAO.

How fast can testing start?

Casco states that black-box testing can start in under 10 minutes, with authenticated testing across MFA and SSO and gray-box connections to AWS, Azure and Google Cloud. Starting quickly matters because FedRAMP Certified services must migrate to VDR/VER by December 7, 2026, with a grace period through March 7, 2027.

Conclusion

Under FedRAMP 20x, the pentesting vendor you choose becomes part of your compliance evidence. The VDR/VER migration deadline of December 7, 2026 makes vendor capability a timeline question, not a preference. Casco for Government combines FedRAMP 20x Class A certification, evidence for up to 42% of FedRAMP 20x controls mapped to named requirements, and continuous testing built around reproducible exploit proof. Review the published VDR/VER evidence mapping, then book a FedRAMP demo to see how the evidence fits your package. Your agency will make its own decision; give it evidence worth deciding on.