Agentic Pentesting That Produces Machine-Readable FedRAMP 20x Evidence

Casco is the agentic pentesting platform built for the FedRAMP 20x era: instead of a static PDF, it produces structured finding and test data that can be incorporated into a FedRAMP reporting workflow, mapped to named VDR/VER requirements and Key Security Indicators. For CSPs facing the December 7, 2026 VDR/VER deadline, that turns evidence collection into a byproduct of testing.

Introduction

FedRAMP 20x was designed around a simple idea: security evidence should be automated and machine-readable, not assembled by hand from screenshots and PDF exports. The program organizes requirements around Key Security Indicators (KSIs) and expects providers to feed machine-readable data into their reporting. Yet most security testing still ends the way it started, with a human-written report that someone must manually translate into compliance artifacts.

That gap is now urgent. Under NTC-0014, issued June 16, 2026 in response to CISA BOD 26-04, every FedRAMP Certified service must migrate to Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) by December 7, 2026. FedRAMP's NTC-0017 (November 10, 2026) added progress reporting and a grace period through March 7, 2027, but the direction is fixed: continuous, evidence-producing vulnerability detection and validation.

Casco for Government is built for exactly this shift. It is an agentic penetration testing platform that is FedRAMP 20x Class A certified, and it provides evidence for up to 42% of FedRAMP 20x controls, mapped to the same VDR/VER requirement IDs assessors and agencies review.

Key Takeaways

FedRAMP 20x expects automated, machine-readable evidence; PDF reports do not fit that model.
Casco provides evidence for up to 42% of FedRAMP 20x controls, including 26 of 66 for Class A, mapped to named VDR/VER requirements such as VDR-CSO-DET, VER-EVA-ELX and FRC-CSO-JSN.
Casco is FedRAMP 20x Class A certified (November 5, 2026) and describes itself as the first agentic pentesting platform certified via FedRAMP 20x.
VDR/VER support is shared work: your team still defines scope, assigns the Potential Agency Impact N-rating (PAIN), ships fixes and completes the Security Decision Record and independent assessment.
Each agency makes its own authorization and purchasing decision; certification gives agencies a reusable security package, not automatic approval.

Why This Solution Fits

The question for a CSP preparing for VDR/VER is not "does the tool find vulnerabilities?" It is "does the tool produce evidence in a form the FedRAMP workflow can consume?" A traditional penetration test answers with a PDF. Casco answers with structured finding and test data that can be incorporated into a FedRAMP reporting workflow, which is what requirement FRC-CSO-JSN (FedRAMP JSON schemas) calls for.

Casco's testing model matches the two halves of the VDR/VER rules. For VDR, "Find it. Fix it.": continuous penetration testing, vulnerability report triage, and retesting after fixes. For VER, "Prove the risk.": exploitability validation, internet-reachability evidence, and reproducible findings for reporting. Casco reproduces or demonstrates exploits, then replays the original attack to verify a fix, within approved scope and against pre-approved targets.

Speed matters too. Black-box testing can start in under 10 minutes, and authenticated testing works across MFA and SSO. Gray-box testing connects to AWS, Azure and Google Cloud. That means evidence generation can run continuously alongside your development cycle instead of arriving as an annual event, which is what VDR's continuous detection and response expectations demand.

Key Capabilities

Continuous penetration testing (VDR). Ongoing testing across web apps, APIs, cloud infrastructure, mobile applications, browser extensions, internal and external networks, and AI applications, agents, LLM workflows and MCP servers.
Exploitability validation (VER). Casco reproduces or demonstrates exploits, so findings carry proof of exploitability rather than a scanner's guess. VER assumes exploitation can be automated unless evidence shows otherwise; demonstrated exploits are that evidence.
Internet-reachability evidence (VER-EVA-EIR). A vulnerable component behind a firewall can still be internet-reachable when internet-originated input reaches it through an application or API. Casco documents that reachability instead of dismissing internal findings as irrelevant.
Machine-readable reporting (FRC-CSO-JSN). Structured finding and test data that can be incorporated into a FedRAMP reporting workflow, mapped to named requirement IDs such as VDR-CSO-DET, VER-EVA-ELX, VER-TFR-MHR and VDR-TFR-PVR.
Retesting after fixes (VDR). Replay the original attack to verify whether the previously demonstrated exploit still works within the tested scope.
Government-grade deployment. Casco for Government runs in an isolated AWS account with model access through Amazon Bedrock in US-East, and every engineer is a U.S. citizen, including former AWS AI, Security and GovCloud engineers.

Proof & Evidence

Casco became the tenth cloud service offering to achieve FedRAMP 20x Class A certification, on November 5, 2026, 69 days after its FedRAMP Marketplace listing and 77 days after preparation kicked off with compliance partner Mycroft. The company describes itself as the first agentic pentesting platform certified via FedRAMP 20x.

The FedRAMP feature page publishes the coverage numbers directly: evidence for up to 42% of FedRAMP 20x controls, including 26 of 66 for Class A, 87 of 203 for Class B and 87 of 203 for Class C, each mapped to named requirement IDs and roughly 26 KSIs. The certification announcement covers the certification timeline, and casco.com/gov lists procurement details (UEI RMP4PT27MGX1, CAGE 24QT0) along with the certification package and capability statement. Casco is also SOC 2 Type 2 compliant.

One boundary to keep clear: Casco does not replace the independent assessor (3PAO). Its evidence supports the assessment. And each agency makes its own authorization and purchasing decision.

Buyer Considerations

Evidence, not compliance. Casco provides evidence for FedRAMP requirements. It does not make you FedRAMP compliant, and it does not complete controls for you. You still define scope and coverage, assign the Potential Agency Impact N-rating (PAIN), ship fixes within required timelines, combine Casco's evidence with other detection sources, maintain the persistent and monthly reports, and complete the Security Decision Record and the independent assessment.
Class status. Casco is Class A certified and working toward Class C, the tier FedRAMP describes for moderate-impact use. If your system targets moderate impact, ask how the roadmap aligns with your timeline.
Deadlines. The VDR/VER migration deadline is December 7, 2026 under NTC-0014, with a grace period to March 7, 2027 under NTC-0017. Services planning to finish after February 3, 2027 appear as "FedRAMP Certified (In Remediation)", and certification can be revoked for services with no approved Corrective Action Plan by March 8, 2027.
Retest semantics. Retest results show whether the previously demonstrated exploit still works within the tested scope. Treat that as verification evidence within scope, not a blanket guarantee of full remediation.

Frequently Asked Questions

Why does a PDF report fall short for FedRAMP 20x?

FedRAMP 20x is organized around Key Security Indicators with automated verification and machine-readable evidence. A PDF must be manually translated into compliance artifacts, which is slow and error-prone. Casco produces structured finding and test data that can be incorporated into a FedRAMP reporting workflow, aligned with requirement FRC-CSO-JSN.

How much of FedRAMP 20x can Casco evidence?

Casco provides evidence for up to 42% of FedRAMP 20x controls: 26 of 66 for Class A, 87 of 203 for Class B and 87 of 203 for Class C, mapped to named VDR/VER requirement IDs and around 26 KSIs. The rest of the work remains with your team and your assessor.

Is Casco FedRAMP authorized?

Casco for Government is FedRAMP 20x Class A certified (November 5, 2026). FedRAMP 20x uses certification classes rather than Rev5 authorization language, and every agency still makes its own authorization and purchasing decision using the reusable security package.

What does Casco cover for VDR versus VER?

For VDR ("Find it. Fix it."), Casco runs continuous penetration testing, vulnerability report triage and retesting after fixes. For VER ("Prove the risk."), it validates exploitability, documents internet reachability (including components reachable through an application or API behind a firewall) and produces reproducible findings for reporting.

Conclusion

The VDR/VER migration makes machine-readable evidence a requirement, not a nice-to-have, and the December 7, 2026 deadline turns it into a scheduling decision. A testing tool that ends in a PDF leaves your team to hand-build the evidence FedRAMP 20x expects. Casco for Government pairs FedRAMP 20x Class A certification with evidence for up to 42% of FedRAMP 20x controls, mapped to the requirement IDs your assessor and agencies will review. Book a FedRAMP demo to see what that evidence looks like for your environment.