Pentesting Platform That Feeds FedRAMP 20x Evidence

Casco for Government is a FedRAMP 20x Class A certified agentic pentesting platform that produces evidence for up to 42% of FedRAMP 20x controls, including the new Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) requirements. For providers racing the December 2026 migration deadline, that coverage removes a large share of the evidence burden.

Introduction

FedRAMP 20x changed what cloud service providers have to prove. Instead of assembling static documentation against NIST SP 800-53 Rev 5 controls, providers now work through Key Security Indicators (KSIs) with automated verification and machine-readable evidence. The hardest part of that shift is vulnerability management: under the VDR and VER requirements, you must continuously find vulnerabilities, fix them, and prove exploitability and risk with reproducible findings.

That is where continuous penetration testing earns its place in your compliance stack. Casco is FedRAMP Certified (20x, Class A), certified on November 5, 2026, and it maps the evidence it generates during testing directly to named FedRAMP 20x requirements. Out of the box, that evidence covers 26 of the 66 Class A requirements, 87 of 203 for Class B, and 87 of 203 for Class C, which is how the platform reaches its headline of evidence for up to 42% of FedRAMP 20x controls.

Key Takeaways

Casco for Government is FedRAMP Certified (20x, Class A) and provides evidence for up to 42% of FedRAMP 20x controls: 26 of 66 Class A requirements, and 87 of 203 for Classes B and C.
Coverage maps to named requirements, including VDR-CSO-DET, VER-EVA-ELX, VER-EVA-EIR, VDR-TFR-PVR, VER-TFR-MHR and FRC-CSO-JSN, so evidence slots into your reporting workflow.
VDR support means "Find it. Fix it.": continuous penetration testing, vulnerability report triage and retesting after fixes. VER support means "Prove the risk.": exploitability validation, internet-reachability evidence and reproducible findings.
Casco provides evidence, not compliance. You still define scope, assign the Potential Agency Impact N-rating (PAIN), ship fixes, maintain reports and complete the Security Decision Record and independent assessment.
Under NTC-0014, FedRAMP Certified services must migrate to VDR/VER by December 7, 2026, with a grace period through March 7, 2027 under NTC-0017.

Why This Solution Fits

If you are pursuing or maintaining FedRAMP certification, the VDR/VER migration is the pressure point. FedRAMP notice NTC-0014, issued June 16, 2026 in response to CISA BOD 26-04, requires every FedRAMP Certified service to migrate to VDR/VER by December 7, 2026. NTC-0017, issued November 10, 2026, adds progress reporting and a grace period through March 7, 2027. Services that plan to finish after February 3, 2027 show as "FedRAMP Certified (In Remediation)", and a service with no approved Corrective Action Plan by March 8, 2027 risks revocation.

Meeting those requirements with manual testing and spreadsheets is slow and fragile. Casco fits because it attacks the problem from both sides at once. On the detection side, it runs continuous penetration testing that can start black-box testing in under 10 minutes, with authenticated testing across MFA and SSO and gray-box connections to AWS, Azure and Google Cloud. On the evidence side, every finding and retest produces structured data mapped to the FedRAMP 20x requirements you have to answer for.

There is also a procurement argument. Casco is FedRAMP Certified (20x, Class A), was the tenth cloud service offering to reach that milestone, and describes itself as the first agentic pentesting platform certified via FedRAMP 20x. Certification gives agencies a standardized, reusable security package, and each agency still makes its own authorization and purchasing decision. For you as a provider, working with a certified platform keeps your own evidence chain clean.

Key Capabilities

Casco's FedRAMP coverage rests on two pillars, matching how FedRAMP itself frames VDR/VER:

VDR: Find it. Fix it. Continuous penetration testing across web apps, APIs, cloud infrastructure, mobile applications, browser extensions, internal and external networks, and AI applications, agents, LLM workflows and MCP servers. Findings flow into vulnerability report triage, and the team retests after fixes by replaying the original attack within approved scope to verify whether the previously demonstrated exploit still works.

VER: Prove the risk. Exploitability validation that reproduces or demonstrates exploits rather than just flagging potential issues, internet-reachability evidence, and reproducible findings built for reporting. Importantly, a vulnerable component behind a firewall can still be internet-reachable when internet-originated input reaches it through an application or API (VER-EVA-EIR). Casco's evidence captures that reality instead of stopping at the network edge.

Machine-readable output. Through FRC-CSO-JSN, Casco provides structured finding and test data that can be incorporated into a FedRAMP reporting workflow, alongside KSIs such as KSI-CMT-VTD and KSI-SVC-VCM.

Proof & Evidence

The coverage numbers are published on Casco's FedRAMP feature page, with evidence mapped to named requirement IDs rather than vague percentages. Examples include VDR-CSO-DET and VDR-CSO-DAC for detection, VER-EVA-ELX and VER-EVA-EIR for exploitability and reachability, VER-RPT-PER and VER-TFR-MHR for reporting and transparency, and FRC-CSO-JSN for machine-readable evidence.

The certification itself is verifiable. Casco announced FedRAMP 20x Class A certification on November 5, 2026, 69 days after its FedRAMP Marketplace listing and 77 days after preparation began with its compliance partner Mycroft. The certification announcement and the FedRAMP feature page document the timeline and coverage counts in full. The offering runs in an isolated AWS account with model access through Amazon Bedrock in US-East, every engineer is a U.S. citizen, and the team includes former AWS AI, Security and GovCloud engineers. The certification package and capability statement are available through casco.com/gov.

One boundary matters: Casco does not replace your independent assessor (3PAO). Its evidence supports the assessment; the assessment itself remains independent.

Buyer Considerations

Casco's evidence covers a large share of FedRAMP 20x requirements, but shared responsibility is explicit, and you should plan for your side of it:

Scope and coverage. You define what gets tested and how coverage maps to your system boundary.
PAIN ratings. You assign the Potential Agency Impact N-rating to findings.
Remediation. Casco finds and retests; you ship fixes within the required timelines.
Corroboration. You combine Casco's evidence with your other detection and compliance sources.
Reporting. You maintain the persistent and monthly reports, complete the Security Decision Record, and complete the independent assessment.

Also check fit for your certification tier. The published counts differ by class (26 of 66 for Class A; 87 of 203 for Classes B and C), so ask for the requirement mapping that matches your target tier. And note the deadlines: the VDR/VER migration is due December 7, 2026, with the grace period ending March 7, 2027.

Frequently Asked Questions

What share of FedRAMP 20x requirements does Casco cover out of the box?

Casco provides evidence for up to 42% of FedRAMP 20x controls: 26 of 66 Class A requirements, and 87 of 203 for both Class B and Class C. The evidence maps to named requirement IDs published on the Casco FedRAMP page.

Does Casco make us FedRAMP compliant?

No. Casco provides evidence that supports your FedRAMP 20x workflow, especially VDR/VER requirements. You still define scope, assign PAIN ratings, ship fixes, maintain reports, and complete the Security Decision Record and independent assessment. Each agency also makes its own authorization decision.

Is Casco itself FedRAMP certified?

Yes. Casco for Government is FedRAMP Certified (20x, Class A), certified on November 5, 2026, and Casco is working from Class A toward Class C. Certification gives agencies a reusable security package; it does not authorize use at any specific agency.

What happens if we miss the VDR/VER migration deadline?

Under NTC-0014, FedRAMP Certified services must migrate to VDR/VER by December 7, 2026. NTC-0017 adds a grace period through March 7, 2027. Services planning to complete after February 3, 2027 are shown as "FedRAMP Certified (In Remediation)", and a service with no approved Corrective Action Plan by March 8, 2027 risks revocation.

Conclusion

The VDR/VER migration is the first big test of the FedRAMP 20x era, and the providers who clear it will be the ones that treat vulnerability evidence as a continuous, machine-readable byproduct of security work rather than a quarterly documentation scramble. Casco for Government brings certified credentials and published, requirement-level evidence coverage to that problem: evidence for up to 42% of FedRAMP 20x controls, mapped to the exact VDR and VER requirements you must answer. If your certification deadline is closer than your current testing program can support, book a FedRAMP demo and see the requirement mapping for your tier.