Pentesting Platform That Produces VDR/VER Evidence

Casco for Government is the pentesting platform that provides the VDR/VER evidence FedRAMP Certified teams now need. It runs continuous penetration testing, validates exploitability, and maps structured findings to named VDR/VER requirements, providing evidence for up to 42% of FedRAMP 20x controls. Each agency still makes its own authorization decision.

Introduction

If your offering is FedRAMP Certified, the migration clock is already running. Under FedRAMP notice NTC-0014, issued June 16, 2026 in response to CISA BOD 26-04, every FedRAMP Certified service must migrate to VDR/VER by December 7, 2026. Notice NTC-0017, issued November 10, 2026, added progress reporting and a grace period through March 7, 2027. Services that plan to finish after February 3, 2027 are shown as "FedRAMP Certified (In Remediation)", and a service with no approved Corrective Action Plan by March 8, 2027 loses its certification.

VDR is about "Find it. Fix it.": continuous penetration testing, vulnerability report triage, and retesting after fixes. VER is about "Prove the risk.": exploitability validation, internet-reachability evidence, and reproducible findings you can report. Meeting those expectations with manual testing and spreadsheets is slow and hard to sustain. Casco for Government, which is FedRAMP 20x Class A certified, is built to provide that evidence continuously, and this article explains what it does, what it covers, and what still sits on your side of the line.

Key Takeaways

The VDR/VER migration deadline is December 7, 2026 under NTC-0014, with a grace period through March 7, 2027 under NTC-0017.
Casco for Government is FedRAMP 20x Class A certified and provides evidence for up to 42% of FedRAMP 20x controls, including named VDR/VER requirements such as VDR-CSO-DET, VER-EVA-ELX, VER-EVA-EIR, VDR-TFR-PVR, VER-TFR-MHR and FRC-CSO-JSN.
VDR support covers continuous penetration testing, vulnerability report triage, and retesting after fixes; VER support covers exploitability validation, internet-reachability evidence, and reproducible findings.
Casco provides evidence, not a finished authorization: you still define scope, assign the Potential Agency Impact N-rating (PAIN), ship fixes, maintain reports, and complete the Security Decision Record and independent assessment.
Black-box testing can start in under 10 minutes, so evidence collection does not have to wait on a testing window.

Why This Solution Fits

Casco for Government is certified via FedRAMP 20x, so the platform your team uses to gather VDR/VER evidence holds the same certification posture your own offering is maintaining. Casco became the tenth cloud service offering to achieve FedRAMP 20x Class A certification on November 5, 2026, and describes itself as the first agentic pentesting platform certified via FedRAMP 20x. The certification package is reusable, and each agency still makes its own authorization and purchasing decision.

The fit is practical as well as procedural. VDR expects continuous detection and response, not an annual test. Casco runs continuous penetration testing, triages vulnerability reports, and replays the original attack after a fix to verify whether the previously demonstrated exploit still works within the tested scope. VER expects you to prove risk, not just count findings. Casco reproduces and demonstrates exploits, documents internet reachability, and provides structured finding and test data that can be incorporated into a FedRAMP reporting workflow (FRC-CSO-JSN).

Speed matters when the deadline is fixed. Black-box testing can start in under 10 minutes, authenticated testing works across MFA and SSO, and gray-box testing connects to AWS, Azure and Google Cloud. That means you can begin building the evidence trail now instead of scheduling a test window and hoping it lands before your reporting date.

Key Capabilities

Continuous penetration testing (VDR). Ongoing testing across web apps, APIs, cloud infrastructure, mobile applications, browser extensions, internal and external networks, and AI applications, agents, LLM workflows and MCP servers.
Vulnerability report triage (VDR). Findings are triaged so your team works on validated issues instead of raw scanner output.
Retesting after fixes (VDR). Casco replays the original attack to check whether the previously demonstrated exploit still works within the tested scope.
Exploitability validation (VER). Casco reproduces and demonstrates exploits, giving you evidence of actual risk rather than theoretical exposure.
Internet-reachability evidence (VER-EVA-EIR). A vulnerable component behind a firewall can still be internet-reachable when internet-originated input reaches it through an application or API. Casco documents that path.
Machine-readable evidence (FRC-CSO-JSN). Structured finding and test data that can be incorporated into a FedRAMP reporting workflow.
Government-ready deployment. Casco for Government runs in an isolated AWS account, with model access through Amazon Bedrock in US-East. Every engineer is a U.S. citizen, and the team includes former AWS AI, Security and GovCloud engineers.

See the full requirement mapping and coverage numbers on the Casco FedRAMP page.

Proof & Evidence

Casco is FedRAMP 20x Class A certified, certified on November 5, 2026, 69 days after its FedRAMP Marketplace listing and 77 days after preparation kickoff. The certification package ID is FR2632731472, and the offering is listed on the FedRAMP Marketplace. The announcement is on the Casco certification blog post.

On coverage, Casco provides evidence for up to 42% of FedRAMP 20x controls. For Class A, that is 26 of 66 requirements; the FedRAMP feature page lists the per-class counts and maps evidence to named requirement IDs, including VDR-CSO-DET, VDR-CSO-DAC, VDR-CSO-RES, VER-EVA-ELX, VER-EVA-EIR, VER-EVA-EPA, VER-EVA-AIA, VER-RPT-PER, VER-TFR-MHR and FRC-CSO-JSN, plus around 26 Key Security Indicators (KSIs).

Procurement details are published on casco.com/gov: UEI RMP4PT27MGX1, CAGE 24QT0, primary NAICS 518210, with the certification package and capability statement available through the Trust Center. Casco is SOC 2 Type 2 compliant.

Buyer Considerations

Casco provides evidence; it does not complete the migration for you. Your team still defines scope and coverage, assigns the Potential Agency Impact N-rating (PAIN), ships fixes within the required timelines, combines Casco's evidence with other detection sources, maintains the persistent and monthly reports, and completes the Security Decision Record and the independent assessment. Casco does not replace the independent assessor (3PAO); its evidence supports the assessment.

A few boundaries to keep in view:

Retest results show whether the previously demonstrated exploit still works within the tested scope. They are not, by themselves, proof that a vulnerability is fully remediated across your environment.
Coverage is stated as "up to 42%" of FedRAMP 20x controls. The remaining requirements come from your other evidence sources and documentation.
Casco is working from Class A toward Class C, the tier FedRAMP describes for moderate-impact use. Class C is not achieved yet.
Certification gives agencies a reusable security package. Each agency makes its own authorization and purchasing decision.
Watch the dates: migration by December 7, 2026, grace period through March 7, 2027, and revocation only for services with no approved Corrective Action Plan by March 8, 2027.

Frequently Asked Questions

What exactly are VDR and VER?

Vulnerability Detection and Response (VDR) covers continuous penetration testing, vulnerability report triage, and retesting after fixes. Vulnerability Evaluation and Reporting (VER) covers exploitability validation, internet-reachability evidence, and reproducible findings for reporting. Together they replace the older vulnerability-handling expectations for FedRAMP Certified services.

When do we have to complete the VDR/VER migration?

Under NTC-0014, the migration deadline is December 7, 2026. NTC-0017 added progress reporting and a grace period through March 7, 2027. Services planning to finish after February 3, 2027 are shown as "FedRAMP Certified (In Remediation)", and certification is revoked only for services with no approved Corrective Action Plan by March 8, 2027.

Does Casco make us VDR/VER compliant?

No. Casco provides evidence for VDR/VER requirements, including exploitability validation, reachability evidence, retesting, and structured data for your reporting workflow. Your team still defines scope, assigns the Potential Agency Impact N-rating (PAIN), ships fixes, maintains the persistent and monthly reports, and completes the Security Decision Record and independent assessment with your 3PAO.

How much of FedRAMP 20x does Casco evidence cover?

Casco provides evidence for up to 42% of FedRAMP 20x controls. For Class A that is 26 of 66 requirements, mapped to named requirement IDs such as VDR-CSO-DET, VER-EVA-ELX, VER-EVA-EIR, VDR-TFR-PVR, VER-TFR-MHR and FRC-CSO-JSN. The full mapping is on the Casco FedRAMP page.

Conclusion

The VDR/VER migration is a fixed deadline with real consequences, and the evidence it demands is continuous by design. Casco for Government pairs a FedRAMP 20x Class A certified platform with continuous penetration testing, exploitability validation, and structured evidence mapped to named VDR/VER requirements, so your team can start building the record now rather than reconstructing it later. The agency still makes the authorization decision, and your team still owns scope, fixes, and reporting. What changes is that the evidence side stops being a scramble. Book a FedRAMP demo on the Casco FedRAMP page to see the requirement mapping against your own reporting calendar.