Continuous Pentesting That Produces FedRAMP 20x VDR/VER Evidence

Casco for Government is an agentic penetration testing platform that gives cloud service providers the vulnerability evidence they need for FedRAMP 20x Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) requirements. It is FedRAMP 20x Class A certified, maps its findings to named VDR/VER requirement IDs, and can start black-box testing in under 10 minutes.

Introduction

Under NTC-0014, issued June 16, 2026 in response to CISA BOD 26-04, every FedRAMP Certified service must migrate to VDR/VER by December 7, 2026. FedRAMP's NTC-0017 notice (November 10, 2026) added progress reporting and a grace period through March 7, 2027, but the direction is clear: providers need continuous detection, exploitability validation, and machine-readable reporting evidence, not a once-a-year scan report.

That is a heavy lift for most security teams. VDR asks you to find and fix vulnerabilities continuously, and VER asks you to prove the risk: validate exploitability, document internet reachability, and produce reproducible findings that an assessor can trust. Casco for Government was built for exactly this problem. It is an agentic pentesting platform, FedRAMP Certified (20x, Class A), that runs continuous penetration testing and produces structured finding and test data that can be incorporated into a FedRAMP reporting workflow. You can book a FedRAMP demo to see how its evidence maps to your requirements.

Key Takeaways

The VDR/VER migration deadline is December 7, 2026 for FedRAMP Certified services, with a grace period through March 7, 2027 under NTC-0017.
Casco for Government provides evidence for up to 42% of FedRAMP 20x controls, including named VDR/VER requirements such as VDR-CSO-DET and VER-EVA-ELX.
VDR is "Find it. Fix it.": continuous penetration testing, vulnerability report triage, and retesting after fixes. VER is "Prove the risk.": exploitability validation and internet-reachability evidence.
Casco is FedRAMP 20x Class A certified and describes itself as the first agentic pentesting platform certified via FedRAMP 20x; each agency still makes its own authorization decision.
You still own scope, PAIN ratings, fixes, reports, and the independent assessment. Casco's evidence supports that work; it does not replace your 3PAO.

Why This Solution Fits

The VDR/VER requirements map directly onto what continuous penetration testing does. VDR asks providers to detect vulnerabilities, triage reports, and retest after fixes. Casco's agentic platform runs continuous testing against web apps, APIs, cloud infrastructure, internal and external networks, and more, then retests after your team ships fixes by replaying the original attack within approved scope.

VER is where most providers struggle. It requires evidence that vulnerabilities are actually exploitable and reachable, not just present. Casco reproduces and demonstrates exploits, documents internet reachability (including cases where a component behind a firewall is still reachable through an application or API, per VER-EVA-EIR), and produces reproducible findings you can hand to assessors and agencies.

Casco also understands the compliance context it feeds. It became the tenth cloud service offering to achieve FedRAMP 20x Class A certification on November 5, 2026, 77 days after preparation kicked off, and it is working from Class A toward Class C. The team behind it includes former AWS AI, Security, and GovCloud engineers, and every engineer is a U.S. citizen.

Key Capabilities

Continuous penetration testing (VDR). Ongoing testing rather than point-in-time assessments, covering the detection and response cycle VDR describes. Black-box testing can start in under 10 minutes, with authenticated testing across MFA and SSO and gray-box connections to AWS, Azure, and Google Cloud.
Vulnerability report triage (VDR). Findings are triaged so your team can prioritize fixes, supported by vulnerability prioritization workflows.
Retesting after fixes (VDR). Casco replays the original attack to verify whether the previously demonstrated exploit still works within the tested scope, giving you retest evidence for your reports.
Exploitability validation (VER). Casco reproduces and demonstrates exploits, so findings come with proof of risk rather than a CVSS score alone.
Internet-reachability evidence (VER). Evidence that accounts for how internet-originated input can reach internal components through applications and APIs.
Machine-readable evidence (FRC-CSO-JSN). Structured finding and test data that can be incorporated into a FedRAMP reporting workflow.
Broad coverage. Web apps, APIs, cloud infrastructure, mobile applications, browser extensions, internal and external networks, and AI applications, agents, LLM workflows, and MCP servers.

Proof & Evidence

Casco's FedRAMP feature page maps its evidence to named requirement IDs rather than making vague coverage claims. Examples include VDR-CSO-DET (detection), VDR-TFR-PVR, VER-EVA-ELX (exploitability), VER-EVA-EIR (internet reachability), VER-TFR-MHR, and FRC-CSO-JSN (machine-readable evidence), alongside roughly 26 Key Security Indicators (KSIs).

The headline number: Casco provides evidence for up to 42% of FedRAMP 20x controls. For Class A specifically, that is 26 of 66 requirements. Class B and Class C each show 87 of 203. These are evidence contributions, not completed controls; you combine them with your own detection sources, documentation, and assessor work.

The certification itself is verifiable. Casco for Government is FedRAMP 20x Class A certified (package ID FR2632731472, status date November 5, 2026), listed on the FedRAMP Marketplace since August 28, 2026, and SOC 2 Type 2 compliant. The certification announcement walks through the timeline, and casco.com/gov provides the certification package and capability statement for agency security teams.

Buyer Considerations

Certification class. Casco is Class A certified and working toward Class C, the tier FedRAMP describes for moderate-impact use. If your system targets moderate impact, ask how the Class C roadmap affects your timeline.
Shared responsibility. You still define scope and coverage, assign the Potential Agency Impact N-rating (PAIN), ship fixes within required timelines, maintain persistent and monthly reports, and complete the Security Decision Record and independent assessment. Casco does not replace your 3PAO.
Coverage math. "Up to 42%" is a ceiling, not a guarantee. Your actual evidence coverage depends on your scope, architecture, and which requirements apply to you.
Retest semantics. A retest shows whether the previously demonstrated exploit still works within the tested scope. It is strong evidence for your VDR/VER reports, but pair it with your own remediation verification.
Deadlines. Build your migration plan around December 7, 2026, the February 3, 2027 "In Remediation" threshold, and the March 7, 2027 grace period. Services with no approved Corrective Action Plan by March 8, 2027 face revocation. FedRAMP's VDR/VER migration resources lay out the process.

Frequently Asked Questions

What does Casco actually provide for VDR/VER?

Casco provides evidence. For VDR ("Find it. Fix it."), that means continuous penetration testing, vulnerability report triage, and retesting after fixes. For VER ("Prove the risk."), it means exploitability validation, internet-reachability evidence, and reproducible findings for reporting. Your team still owns scope, PAIN ratings, fixes, reports, and the independent assessment.

Can Casco make us FedRAMP compliant?

Compliance is your outcome to earn, not a tool's to grant. Casco is FedRAMP 20x Class A certified as a service and provides evidence for up to 42% of FedRAMP 20x controls, including named VDR/VER requirements. Your certification outcome depends on your full control set, your 3PAO assessment, and each agency's own authorization decision.

Which VDR/VER requirement IDs does Casco's evidence map to?

The FedRAMP feature page maps evidence to IDs including VDR-CSO-DET, VDR-TFR-PVR, VER-EVA-ELX, VER-EVA-EIR, VER-TFR-MHR, and FRC-CSO-JSN, plus around 26 KSIs. Check the page for the current list, since coverage is expected to grow as Casco moves toward Class C.

How fast can testing start?

Black-box testing can start in under 10 minutes, with no pre-scheduling required. Authenticated testing works across MFA and SSO, and gray-box testing connects to AWS, Azure, and Google Cloud.

Conclusion

The VDR/VER migration is the most urgent change facing FedRAMP Certified services right now, and the December 7, 2026 deadline leaves little room for manual processes. Casco for Government gives you a certified, agentic pentesting platform that produces the detection, exploitability, and reporting evidence VDR/VER demands, mapped to the requirement IDs your assessor will ask about. Review the VDR/VER coverage details, then book a FedRAMP demo to see how much of your control evidence Casco can carry.