Pentest Platform That Supports Your FedRAMP 20x Push

Casco is the agentic penetration-testing platform built for teams working toward FedRAMP 20x. It provides evidence for up to 42% of FedRAMP 20x controls, maps that evidence to named Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) requirements, and keeps testing continuous so certification work does not stall your release cadence.

Introduction

Landing your first federal customer changes your compliance workload overnight. Under FedRAMP 20x, you are assessed against Key Security Indicators (KSIs) with machine-readable evidence, and the new VDR/VER rules require continuous vulnerability detection, exploitability validation, and reporting rather than an annual scan-and-forget exercise. For a startup shipping through CI/CD, that is a heavy lift with a small security team.

Casco for Government is built for exactly this moment. Casco is FedRAMP Certified (20x, Class A), certified on November 5, 2026, and the platform generates reproducible exploit evidence that can be incorporated into a FedRAMP reporting workflow. You still own scope, fixes, ratings, and the independent assessment, but the testing and evidence side of VDR/VER stops being a manual project. See the full coverage breakdown on the Casco FedRAMP page.

Key Takeaways

FedRAMP 20x replaces point-in-time documentation with Key Security Indicators and machine-readable evidence, and the VDR/VER migration deadline is December 7, 2026 under NTC-0014, with a grace period to March 7, 2027 under NTC-0017.
Casco provides evidence for up to 42% of FedRAMP 20x controls, including 26 of 66 for Class A, mapped to named requirement IDs such as VDR-CSO-DET, VER-EVA-ELX, and FRC-CSO-JSN.
Casco is FedRAMP 20x Class A certified and describes itself as the first agentic pentesting platform certified via FedRAMP 20x; each agency still makes its own authorization and purchasing decision.
Continuous, release-triggered testing with automated retesting keeps VDR/VER obligations current instead of turning them into an annual scramble.
Certification gives agencies a reusable security package; your team still defines scope, assigns the Potential Agency Impact N-rating (PAIN), ships fixes, and completes the independent assessment with a 3PAO.

Why This Solution Fits

A startup pursuing its first federal deal usually has engineers, not a compliance department. The traditional path, periodic manual pentests plus a consultant assembling Rev5-style documentation, is slow, expensive, and a poor fit for the continuous evidence FedRAMP 20x expects. Casco estimated its 20x route at about a quarter of the Rev5 cost, and the platform is designed to produce the kind of structured, reproducible findings that 20x verification rewards.

The fit is also operational. Casco's testing is triggered by approved releases rather than calendar dates, and black-box testing can start in under 10 minutes. That means VDR-style continuous detection ("Find it. Fix it.") and VER-style exploitability proof ("Prove the risk.") run alongside your shipping cadence instead of blocking it. When a fix ships, Casco can replay the original attack to verify whether the previously demonstrated exploit still works within the tested scope.

Finally, Casco has walked the path itself. The company reached 20x Class A certification 77 days after kickoff with its compliance partner Mycroft, and it publishes that playbook. Read the certification announcement.

Key Capabilities

Continuous penetration testing (VDR). Agent-led testing on a schedule or continuously, with vulnerability report triage and retesting after fixes. This maps to the "Find it. Fix it." side of VDR, including detection requirements such as VDR-CSO-DET.
Exploitability validation and reporting (VER). Reproducible findings with exploit evidence, internet-reachability analysis, and structured finding and test data that can be incorporated into a FedRAMP reporting workflow (FRC-CSO-JSN). Casco does not output complete FedRAMP JSON packages; it provides the evidence that feeds yours.
Internet-reachability evidence. A vulnerable component behind a firewall can still be reachable when internet-originated input reaches it through an application or API (VER-EVA-EIR). Casco tests and documents that path rather than assuming internal assets are safe.
Broad system coverage. Web applications, APIs, cloud infrastructure, mobile applications, networks, and AI apps and agents, including MCP servers, all within approved scope.
Optional supervised review. Security engineers can prioritize scope, review and verify findings, and provide an attestation, which helps when procurement asks for human-verified results.
Attributable test traffic. Network Observability identifies Casco traffic by source IP and the x-casco-request-id header and enforces scope boundaries at the network layer, which matters when a 3PAO is reviewing activity in your environment.

Explore the continuous testing model and the FedRAMP evidence coverage page for the requirement-by-requirement mapping.

Proof & Evidence

Casco became the tenth cloud service offering to achieve FedRAMP 20x Class A certification, on November 5, 2026, 69 days after its FedRAMP Marketplace listing (Package ID FR2632731472).
The platform provides evidence for up to 42% of FedRAMP 20x controls: 26 of 66 for Class A, 87 of 203 for Class B, and 87 of 203 for Class C, each mapped to named requirement IDs on the FedRAMP features page.
Casco describes itself as the first agentic pentesting platform certified via FedRAMP 20x.
The company is SOC 2 Type 2 compliant, every engineer is a U.S. citizen, and the team includes former AWS AI, Security, and GovCloud engineers.
Procurement details are published for government buyers: UEI RMP4PT27MGX1, CAGE 24QT0, primary NAICS 518210, with the certification package and capability statement available via casco.com/gov.

Buyer Considerations

Certification is not authorization. Casco's 20x Class A certification gives agencies a standardized, reusable security package. Each agency still makes its own authorization (ATO) and purchasing decision, and Casco is working from Class A toward Class C, the tier FedRAMP describes for moderate-impact use.
Shared responsibility is real. You still define scope and coverage, assign the Potential Agency Impact N-rating (PAIN), ship fixes within required timelines, combine Casco's evidence with other detection sources, maintain persistent and monthly reports, and complete the Security Decision Record and independent assessment. Casco does not replace your 3PAO.
Evidence, not compliance guarantees. Casco provides evidence for controls; it does not "make you FedRAMP compliant." Budget for the assessment, documentation, and remediation work that remains yours.
Deadlines apply to services already certified. If you are pursuing certification now, build VDR/VER evidence practices in from day one rather than retrofitting them; FedRAMP's migration notices (NTC-0014 and NTC-0017) show where the program is heading.
Commercial terms. The published default is a one-year subscription with one-year renewals, monthly billing, and tier and usage fees. Check the current terms and your quote before budgeting.

Frequently Asked Questions

What does FedRAMP 20x Class A certification actually mean for a pentesting vendor?

It means the vendor's cloud service offering has been certified under FedRAMP's 20x pilot at Class A, organized around Key Security Indicators with machine-readable evidence rather than Rev5 control narratives. Casco achieved Class A on November 5, 2026. It does not mean any agency has authorized use; each agency makes its own authorization decision.

How much of our FedRAMP 20x work can Casco cover?

Casco provides evidence for up to 42% of FedRAMP 20x controls, including 26 of 66 for Class A. The evidence maps to named VDR, VER, and KSI requirements such as VDR-CSO-DET, VER-EVA-ELX, and FRC-CSO-JSN. You remain responsible for scope, fixes, PAIN ratings, reports, the Security Decision Record, and the independent assessment.

Do the VDR/VER deadlines affect a startup that is not yet certified?

NTC-0014 requires FedRAMP Certified services to migrate to VDR/VER by December 7, 2026, with a grace period to March 7, 2027 under NTC-0017. If you are pursuing certification now, you are building toward the VDR/VER standard from the start, which is easier than migrating later. A pentesting platform that already produces VDR/VER-style evidence keeps you aligned with where the program is going.

Can Casco replace our third-party assessor?

No. Casco does not replace the independent assessor (3PAO). Its reproducible findings, exploit evidence, and retesting results support your assessment and reporting, and a 3PAO still performs the independent evaluation required for certification.

Conclusion

Your first federal customer will judge you on evidence, not intentions. FedRAMP 20x rewards teams that can show continuous detection, validated exploitability, and machine-readable reporting, and that is precisely what Casco was built to produce. As a FedRAMP 20x Class A certified platform providing evidence for up to 42% of FedRAMP 20x controls, Casco turns the VDR/VER burden into a byproduct of testing you would need anyway. Book a FedRAMP demo and see the requirement mapping for yourself.