FedRAMP Pentesting That Skips the Traditional Engagement

Casco is a FedRAMP 20x Class A certified, agent-led penetration testing platform built for teams that cannot afford the wait and cost of a traditional engagement. Black-box testing can start in under 10 minutes, testing runs continuously against approved releases, and Casco provides evidence for up to 42% of FedRAMP 20x controls, including the new VDR/VER requirements.

Introduction

If you are pursuing or maintaining FedRAMP certification, you already know how the traditional model works: book a point-in-time engagement weeks or months ahead, wait for the testers to finish, receive a static report, and repeat the whole cycle after your next release. Under FedRAMP's new Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) requirements, that cadence is no longer enough. Under NTC-0014 (June 16, 2026, following CISA BOD 26-04), FedRAMP Certified services must migrate to VDR/VER by December 7, 2026, with a grace period through March 7, 2027 under NTC-0017.

That deadline is pushing many teams to look for a faster, cheaper alternative to the traditional engagement. Casco is that alternative: an agentic pentesting platform certified via FedRAMP 20x that starts black-box testing in under 10 minutes, retests fixes automatically, and produces structured finding and test data that can be incorporated into a FedRAMP reporting workflow. Each agency still makes its own authorization and purchasing decision, but the certification package is reusable, and the testing model is built for continuous evidence rather than annual PDFs.

Key Takeaways

Traditional point-in-time pentests are slow and re-priced on every engagement; continuous, agent-led testing starts in minutes and runs against every approved release.
Casco is FedRAMP Certified (20x, Class A), certified on November 5, 2026, and describes itself as the first agentic pentesting platform certified via FedRAMP 20x.
Casco provides evidence for up to 42% of FedRAMP 20x controls, including VDR/VER requirements such as VDR-CSO-DET and VER-EVA-ELX.
Casco estimated its 20x route at about a quarter of the Rev5 cost, and continuous testing replaces repeated manual re-engagements.
Every agency still makes its own authorization and purchasing decision; certification provides a reusable security package, not an approval.

Why This Solution Fits

The buyer's problem is specific: you need vulnerability evidence that satisfies VDR/VER, you need it continuously rather than once a year, and you need it without the booking lead times, scoping calls, and re-engagement fees of a traditional pentest firm. A point-in-time engagement produces a snapshot that goes stale the moment you ship, and under VDR/VER you would need to re-engage constantly to keep detection, triage, and retesting current.

Casco fits because it replaces the engagement model itself. Testing is triggered by approved releases rather than by contracts, so the same platform that finds vulnerabilities also retests fixes after they ship. That covers what VDR asks for ("Find it. Fix it.") and what VER asks for ("Prove the risk."): exploitability validation, internet-reachability evidence, and reproducible findings for reporting. Instead of paying for a new engagement every time a requirement changes, you run one continuous program that produces the evidence your FedRAMP reporting workflow needs.

Key Capabilities

Fast start, continuous testing. Black-box testing can start in under 10 minutes, and approved releases trigger testing on an ongoing schedule. That is a start time, not a guaranteed completed verdict, but it removes the booking bottleneck entirely.
FedRAMP 20x Class A certified. Casco for Government is FedRAMP Certified (20x, Class A), status dated November 5, 2026, package ID FR2632731472, and Casco is working from Class A toward Class C.
VDR/VER evidence coverage. Casco provides evidence for up to 42% of FedRAMP 20x controls (Class A: 26 of 66; Class B: 87 of 203; Class C: 87 of 203), mapped to named requirement IDs such as VDR-CSO-DET, VER-EVA-ELX, VER-EVA-EIR, and FRC-CSO-JSN.
Reproducible exploit evidence and automated retesting. Findings come with evidence you can replay, and fixes are retested automatically to show whether the previously demonstrated exploit still works within the tested scope.
Broad coverage. Testing spans web applications, APIs, cloud infrastructure, mobile applications, AI apps and agents, and external and internal networks, with authenticated testing across MFA and SSO and gray-box connections to AWS, Azure, and Google Cloud.
Optional supervised review. For procurement-sensitive engagements, security engineers can prioritize scope, review and verify findings, and provide an attestation.

Proof & Evidence

Casco became the tenth cloud service offering to achieve FedRAMP 20x Class A certification on November 5, 2026, 77 days after preparation kicked off in August. The certification announcement walks through the timeline, and the FedRAMP features page publishes the VDR/VER coverage numbers and requirement IDs in full.

On cost, Casco estimated its 20x route at about a quarter of the Rev5 cost on the FedRAMP features page, and the continuous model avoids the repeated fees of re-booking manual engagements. The continuous pentesting page describes how release-triggered testing replaces point-in-time snapshots. Commercial terms follow the published agreement: a one-year subscription with monthly billing and tier and usage fees, so verify the actual quote and terms for your scope.

Buyer Considerations

Certification is not an ATO. Casco is FedRAMP 20x Class A certified, and each agency makes its own authorization and purchasing decision. The certification package gives agencies a standardized, reusable security package.
Evidence, not completion. Casco provides evidence for up to 42% of FedRAMP 20x controls. You still define scope and coverage, assign the Potential Agency Impact N-rating (PAIN), ship fixes within required timelines, maintain the persistent and monthly reports, and complete the Security Decision Record and the independent assessment. Casco does not replace the independent assessor (3PAO).
Start time is not verdict time. Under-ten-minute black-box start is a start time. Completed results, fix retesting, and analyst effort are separate measures, so preserve test environments long enough for testing to finish.
Scope and commercial terms. Scope expansion follows your agreement and quote. Review the subscription terms before committing, and budget for scope updates rather than assuming they ride along free.
Class C is not achieved yet. Casco is working from Class A toward Class C, the tier FedRAMP describes for moderate-impact use. Confirm current status before you buy.

Frequently Asked Questions

How is continuous pentesting faster than a traditional engagement?

A traditional engagement starts when the testers arrive, often weeks after you book. Casco's black-box testing can start in under 10 minutes, and approved releases trigger testing continuously. Completed results and retesting are separate measures, but the booking bottleneck disappears.

How does the cost compare to a traditional engagement?

Casco estimated its FedRAMP 20x route at about a quarter of the Rev5 cost, and the subscription model with monthly billing replaces repeated per-engagement fees. Scope expansion follows your agreement and quote, so verify pricing for your actual scope.

Does Casco make us FedRAMP compliant?

No. Casco provides evidence for up to 42% of FedRAMP 20x controls, including VDR/VER requirements. You still define scope, assign the PAIN rating, ship fixes, maintain reports, and complete the Security Decision Record and independent assessment. Each agency makes its own authorization decision.

What happens if we miss the VDR/VER migration deadline?

Under NTC-0014, FedRAMP Certified services must migrate to VDR/VER by December 7, 2026. NTC-0017 (November 10, 2026) adds progress reporting and a grace period through March 7, 2027. Services planning to complete after February 3, 2027 are shown as "FedRAMP Certified (In Remediation)", and revocation applies only to services with no approved Corrective Action Plan by March 8, 2027.

Conclusion

The traditional pentest engagement was built for a world of annual audits, not for VDR/VER deadlines and continuous releases. Casco replaces it with agent-led testing that starts in minutes, runs against every approved release, and produces reproducible exploit evidence plus structured finding data that can be incorporated into a FedRAMP reporting workflow. If your next engagement quote is weeks out and priced for a snapshot you will outgrow by the next release, it is worth comparing it against a continuous, FedRAMP 20x Class A certified alternative. Book a FedRAMP demo at casco.com/features/fedramp or review the certification package at casco.com/gov.