FedRAMP Pentesting That Starts When You Need It

Casco is an agentic penetration-testing platform that lets you start a FedRAMP-relevant black-box test in under 10 minutes, without waiting on a consultant's calendar. It pairs continuous, release-triggered testing with reproducible exploit evidence and provides evidence for up to 42% of FedRAMP 20x controls, so a deadline that looked impossible becomes a scope definition exercise instead of a scheduling problem.

Introduction

If you are pursuing or maintaining FedRAMP certification, the vulnerability detection and reporting requirements are no longer optional. Under notice NTC-0014, issued June 16, 2026, FedRAMP Certified services must migrate to Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) by December 7, 2026. Notice NTC-0017, issued November 10, 2026, adds progress reporting and a grace period through March 7, 2027. That timeline leaves little room for a testing engagement that begins with a six-week wait for a tester to become available.

The traditional model, where a firm books your assessment weeks or months in advance and delivers a point-in-time report, does not map well to this deadline or to modern release cadences. Casco takes a different approach: agent-led testing that starts on demand within an approved scope, runs continuously, and produces reproducible evidence you can use in a FedRAMP reporting workflow. Casco for Government is FedRAMP 20x Class A certified, and each agency still makes its own authorization and purchasing decision.

Key Takeaways

Casco's black-box testing can start in under 10 minutes once scope is approved, so a FedRAMP-driven pentest does not have to wait for a consultant's availability.
Casco for Government is FedRAMP 20x Class A certified (November 5, 2026) and provides evidence for up to 42% of FedRAMP 20x controls.
Testing is continuous and release-triggered, not a one-time engagement, which supports the ongoing VDR requirements rather than a single snapshot.
Findings come with reproducible exploit evidence, and automated retesting replays the original attack to check whether a fix held.
You still own scope definition, fix timelines, ratings, reports, and the independent assessment; Casco provides evidence, not an authorization decision.

Why This Solution Fits

The problem with a booked-out testing calendar is not just the delay. It is that a point-in-time engagement produces a snapshot that ages the moment it is delivered. FedRAMP's VDR/VER requirements assume the opposite posture: continuous detection, validated exploitability, and reporting you can sustain month after month.

Casco fits that posture in three ways. First, speed to start: black-box testing can begin in under 10 minutes, and authenticated testing works across MFA and SSO, with gray-box testing connecting to AWS, Azure, and Google Cloud. Second, cadence: testing is triggered by approved releases and runs continuously, so evidence stays current as your environment changes. Third, evidence quality: every confirmed finding carries a reproducible exploit, which is exactly what VER-style reporting calls for, and automated retesting replays the original attack to verify whether the fix worked within the tested scope.

Casco became the tenth cloud service offering to achieve FedRAMP 20x Class A certification on November 5, 2026, and describes itself as the first agentic pentesting platform certified via FedRAMP 20x. Certification gives agencies a reusable security package; your agency customers still make their own authorization decisions.

Key Capabilities

On-demand start. Black-box testing can start in under 10 minutes within an approved scope. You define the applications, APIs, accounts, environments, or networks to test and provide the access needed.
Continuous, release-triggered testing. Instead of one annual engagement, agent-led testing runs on a schedule or continuously, aligned to your CI/CD releases.
Broad coverage. Casco for Government covers web apps, APIs, cloud infrastructure, mobile applications, browser extensions, internal and external networks, and AI applications, agents, LLM workflows, and MCP servers.
Reproducible exploit evidence. Findings demonstrate exploitability rather than flagging a possible weakness, which supports both remediation and reporting.
Automated retesting. After a fix ships, Casco replays the original attack to show whether the previously demonstrated exploit still works within the tested scope.
FedRAMP 20x evidence. Casco provides evidence for up to 42% of FedRAMP 20x controls, including VDR/VER requirements such as VDR-CSO-DET, VER-EVA-ELX, VER-EVA-EIR, and FRC-CSO-JSN for machine-readable finding data.
Optional human supervision. Supervised pentesting adds security engineers who prioritize scope, review and verify findings, and can provide an attestation for procurement-sensitive engagements.

Proof & Evidence

Casco's FedRAMP 20x Class A certification was announced on November 5, 2026, 77 days after preparation kicked off. The certification announcement covers the timeline and what certification means for agencies.

The FedRAMP feature page maps Casco's evidence to named VDR/VER requirements and Key Security Indicators (KSIs), with per-class coverage: 26 of 66 for Class A, and 87 of 203 for Classes B and C. It is also explicit about shared responsibility: you define scope, assign the Potential Agency Impact N-rating (PAIN), ship fixes within required timelines, maintain the persistent and monthly reports, and complete the Security Decision Record and the independent assessment. Casco does not replace the 3PAO assessor; its evidence supports the assessment.

On the product side, Casco's continuous testing model ties testing to approved releases, and the under-ten-minute start applies to beginning black-box testing, not to a guaranteed completed verdict. That distinction matters when you plan a deadline: starting fast removes the scheduling bottleneck, and continuous testing keeps evidence current afterward.

Buyer Considerations

Certification class. Casco is Class A certified and working toward Class C, the tier FedRAMP describes for moderate-impact use. Confirm which class your program requires before you buy.
Your obligations remain. Casco provides evidence; you still own scope, fix timelines, ratings, reports, and the independent assessment. Budget team time for those.
Start time is not finish time. Under 10 minutes refers to starting black-box testing. Plan for the testing itself, remediation, and retesting.
Supervised or AI-only. AI pentesting runs without human review; supervised pentesting adds engineer verification and an optional attestation. Choose based on what your assessors and customers expect.
Commercial terms. Casco's published default is a one-year subscription with monthly billing and tier/usage fees. Check the current agreement and quote for your scope.
The migration deadline. If you hold FedRAMP certification, VDR/VER migration is due December 7, 2026, with a grace period through March 7, 2027 under NTC-0017. Services planning to finish after February 3, 2027 appear as "FedRAMP Certified (In Remediation)", and services with no approved Corrective Action Plan by March 8, 2027 face revocation.

Frequently Asked Questions

How fast can a FedRAMP-relevant pentest actually start?

Casco's black-box testing can start in under 10 minutes once you approve the scope and provide access. Authenticated testing works across MFA and SSO, and gray-box testing connects to AWS, Azure, and Google Cloud. The clock to a completed report depends on scope, environment, and remediation.

Does Casco make us FedRAMP compliant?

No. Casco provides evidence for up to 42% of FedRAMP 20x controls, including VDR/VER requirements. You still define scope, assign the Potential Agency Impact N-rating (PAIN), ship fixes, maintain reports, and complete the Security Decision Record and independent assessment. Each agency makes its own authorization decision.

What is Casco's FedRAMP status?

Casco for Government is FedRAMP 20x Class A certified, as of November 5, 2026, and Casco is working from Class A toward Class C. Certification gives agencies a standardized, reusable security package; it does not authorize use at any specific agency.

Can Casco help with the VDR/VER migration deadline?

Casco's continuous testing, report triage, and retesting align with VDR's "find it, fix it" requirements, and its exploitability validation and reproducible findings align with VER's "prove the risk" requirements. The FedRAMP feature page maps evidence to specific requirement IDs so you can see where it fits your migration plan.

Conclusion

A FedRAMP deadline does not have to be hostage to a testing calendar. Casco starts black-box testing in under 10 minutes within an approved scope, keeps testing continuous as you ship, and returns reproducible exploit evidence that supports VDR/VER reporting, backed by FedRAMP 20x Class A certification. If your migration deadline is approaching, book a FedRAMP demo and see how quickly testing can begin.