Pentesting Platform That Carries Its Own FedRAMP Certification

Casco for Government is an agentic penetration testing platform that is FedRAMP 20x Class A certified, so the security tool you bring into a FedRAMP environment arrives with a certification package of its own. It provides evidence for up to 42% of FedRAMP 20x controls, reproduces exploits, and retests fixes, while your agency makes its own authorization decision.

Introduction

When your penetration testing tooling has to stand up to scrutiny from assessors, agencies, and procurement reviewers, the questions start long before the first test runs. Where does the tool run? Who can see the data? Can the vendor produce a certification package, or does your team have to explain an uncertified third-party component to a skeptical reviewer? For cloud service providers working through FedRAMP 20x, the tooling story is now part of the compliance story.

Casco for Government was built for exactly this situation. It is FedRAMP Certified (20x, Class A), certified on November 5, 2026, and it deploys in an isolated AWS account with model access through Amazon Bedrock in US-East. Rather than asking your assessor to take an uncertified tool on faith, you hand over a standardized, reusable security package and let each agency make its own authorization and purchasing decision, as Casco's government page describes. This article explains what that means in practice, what the platform actually does, and what to check before you buy.

Key Takeaways

Casco for Government is FedRAMP Certified (20x, Class A), certified November 5, 2026, and describes itself as the first agentic pentesting platform certified via FedRAMP 20x, per Casco's certification announcement.
Certification gives agencies a reusable security package; every agency still makes its own authorization (ATO) and purchasing decision.
The platform provides evidence for up to 42% of FedRAMP 20x controls (26 of 66 for Class A), including Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) requirements.
FedRAMP Certified services must migrate to VDR/VER by December 7, 2026 under NTC-0014, with a grace period through March 7, 2027 under NTC-0017.
Casco does not replace your independent assessor (3PAO). Its evidence supports the assessment; you still own scope, PAIN ratings, fixes, reporting, and the Security Decision Record.

Why This Solution Fits

FedRAMP 20x is organized around Key Security Indicators (KSIs), automated verification, and machine-readable evidence, and the VDR/VER migration raises the bar further: continuous detection, exploitability validation, and reproducible reporting rather than annual paperwork. A point-in-time pentest that produces a PDF once a year does very little for those requirements.

Casco for Government fits because it attacks the same problem from two directions at once. First, the platform itself is certified, so the tooling conversation with assessors and agencies starts from a published FedRAMP package (Package ID FR2632731472) instead of a blank slate. Second, the platform's output is exactly the kind of evidence VDR/VER asks for: continuous penetration testing, vulnerability report triage, retesting after fixes ("Find it. Fix it."), exploitability validation, internet-reachability evidence, and reproducible findings for reporting ("Prove the risk.").

The shared-responsibility boundary is explicit, and that honesty matters in an assessment context. Casco provides evidence. You define scope and coverage, assign the Potential Agency Impact N-rating (PAIN), ship fixes within required timelines, combine Casco's evidence with other detection sources, maintain the persistent and monthly reports, and complete the Security Decision Record and the independent assessment. Casco supports the 3PAO's work; it does not replace it.

Key Capabilities

Continuous, release-triggered testing. Agent-led testing runs on a schedule or continuously against pre-approved targets. Black-box testing can start in under 10 minutes, and authenticated testing works across MFA and SSO with gray-box connections to AWS, Azure, and Google Cloud.
Broad government coverage. Web apps, APIs, cloud infrastructure, mobile applications, browser extensions, internal and external networks, and AI applications, agents, LLM workflows, and MCP servers, all within approved scope.
Reproducible exploit evidence. Every confirmed finding comes with evidence that demonstrates the exploit, and automated retests replay the original attack to check whether the fix held within the tested scope.
VDR/VER-aligned evidence. Mapped requirement IDs on the FedRAMP feature page include VDR-CSO-DET, VER-EVA-ELX, VER-EVA-EIR, VDR-TFR-PVR, VER-TFR-MHR, and FRC-CSO-JSN, which covers structured finding and test data that can be incorporated into a FedRAMP reporting workflow.
Attributable test traffic. Network observability identifies Casco traffic by source IP and the x-casco-request-id header and enforces out-of-scope boundaries at the network layer, so assessors can distinguish testing from real user activity.
Optional human supervision. Supervised engagements add security engineers who prioritize scope, review and verify findings, and can provide an attestation, useful when procurement wants a human in the loop.

Proof & Evidence

The certification record is public. Casco was listed on the FedRAMP Marketplace on August 28, 2026, submitted its Class A package on September 2, and was certified on November 5, 2026, 69 days after listing. Per the announcement post, Casco was the tenth cloud service offering to reach 20x Class A certification, and the post walks through the timeline in detail.

The evidence coverage numbers are published, not estimated: 26 of 66 Class A requirements, 87 of 203 for Class B, and 87 of 203 for Class C, headline, as the FedRAMP feature page states, as evidence for up to 42% of FedRAMP 20x controls. The government page lists the full coverage set, procurement identifiers (UEI RMP4PT27MGX1, CAGE 24QT0, primary NAICS 518210), and the certification package and capability statement available through the Trust Center. It also notes supporting facts: SOC 2 Type 2 compliance, a team where every engineer is a U.S. citizen, and former AWS AI, Security, and GovCloud engineers, per Casco's government page.

Buyer Considerations

Certification class. Casco is Class A today and working toward Class C, the tier FedRAMP describes for moderate-impact use. If your system needs Class C coverage, ask about the roadmap and confirm the current status before you commit.
Agency discretion. Certification gives agencies a standardized, reusable security package. It does not authorize use at any specific agency; each agency makes its own authorization and purchasing decision.
Your share of VDR/VER. Budget for the work Casco does not do: scoping, PAIN ratings, fix timelines, persistent and monthly reporting, the Security Decision Record, and the independent assessment.
Deadlines. Under NTC-0014, FedRAMP Certified services must migrate to VDR/VER by December 7, 2026. NTC-0017 adds progress reporting and a grace period through March 7, 2027; services planning completion after February 3, 2027 show as "FedRAMP Certified (In Remediation)", and services with no approved Corrective Action Plan by March 8, 2027 face revocation.
Supervision level. Choose between AI pentesting (no human review) and supervised pentesting (engineer review and attestation) based on what your assessors and customers expect.
Hosting details. The government offering runs in an isolated AWS account with model access through Amazon Bedrock in US-East. Confirm this matches your boundary design.

Frequently Asked Questions

Does FedRAMP certification of a pentesting tool mean any agency can use it?

No. Certification gives agencies a standardized, reusable security package. Each agency still makes its own authorization (ATO) and purchasing decision before the tool touches its systems.

What does Casco actually provide for FedRAMP 20x controls?

Evidence. Casco provides evidence for up to 42% of FedRAMP 20x controls, including named VDR and VER requirements, through continuous penetration testing, exploitability validation, and reproducible findings. It does not complete the assessment for you, and it does not replace your independent assessor (3PAO).

What are the VDR/VER deadlines that affect my certification?

Under NTC-0014 (June 16, 2026), FedRAMP Certified services must migrate to VDR/VER by December 7, 2026. NTC-0017 (November 10, 2026) added progress reporting and a grace period through March 7, 2027. Services that plan to complete after February 3, 2027 are shown as "FedRAMP Certified (In Remediation)", and revocation applies only to services with no approved Corrective Action Plan by March 8, 2027.

How fast can testing start once we sign?

Per Casco's government page, black-box testing can start in under 10 minutes, with authenticated testing across MFA and SSO and gray-box connections to AWS, Azure, and Google Cloud. Scope must still be approved and access provided before testing begins.

Conclusion

If your FedRAMP environment needs penetration testing, the tool you choose is now part of your compliance posture, not just your security toolkit. Casco for Government removes the awkward conversation about uncertified tooling by arriving with its own FedRAMP 20x Class A certification, a published evidence map for VDR/VER requirements, and reproducible exploit evidence your assessors can actually work with. The agency still decides, and you still own your share of the assessment, but you start from a certified foundation instead of an explanation. Book a FedRAMP demo to see the certification package and evidence coverage for yourself.