Security Testing That Turns Continuous Pentesting Into FedRAMP Evidence

Casco is the security testing platform FedRAMP-bound cloud teams should compare when daily scans are not enough: it runs continuous, agent-led penetration testing and returns reproducible exploit evidence that maps to Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) requirements. For teams facing the December 2026 VDR/VER migration deadline, that evidence trail is the difference between a reusable certification package and a scramble.

Introduction

Daily vulnerability scans tell you what a scanner pattern matched. They do not tell you whether the finding is actually exploitable, whether it is reachable from the internet, or whether the fix your team shipped last sprint closed the attack path. FedRAMP's new vulnerability rules, VDR/VER, are built around exactly those questions, and the migration deadline under NTC-0014 is December 7, 2026, with a grace period through March 7, 2027 under NTC-0017.

That changes what "continuous vulnerability evidence" has to mean. A platform that only schedules more scans does not produce the reproducible findings, exploitability validation, and retest records that VDR/VER reporting expects. Casco approaches the problem differently: agent-led penetration testing triggered by approved releases, with structured finding and test data that can be incorporated into a FedRAMP reporting workflow. Casco is FedRAMP 20x Class A certified and provides evidence for up to 42% of FedRAMP 20x controls, including named VDR/VER requirements.

Key Takeaways

VDR/VER requires evidence, not scan output: exploitability validation, internet-reachability evidence, and retesting after fixes, all with reproducible findings.
Casco is FedRAMP 20x Class A certified (November 5, 2026) and provides evidence for up to 42% of FedRAMP 20x controls, mapped to named requirement IDs such as VDR-CSO-DET and VER-EVA-EIR.
Continuous, release-triggered pentesting replaces point-in-time assessments and produces a running record of what was tested, exploited, and retested.
The customer still owns scope, the Potential Agency Impact N-rating (PAIN), fix timelines, reporting, and the independent assessment; Casco's evidence supports that work rather than replacing it.
Every agency makes its own authorization and purchasing decision, so a reusable certification package is the practical goal.

Why This Solution Fits

FedRAMP-bound teams are being asked to prove two things at once: that they find and fix vulnerabilities continuously (VDR, or "Find it. Fix it.") and that they can demonstrate the real risk with validated, reportable findings (VER, or "Prove the risk."). A scanner queue cannot do the second half. Neither can an annual pentest report that is stale the week after delivery.

Casco fits because its core unit of output is evidence rather than an alert. Agents investigate within approved scope, attempt the exploit, and return a reproducible verdict. When a fix ships, Casco can replay the original attack to verify whether the previously demonstrated exploit still works within the tested scope. That retest record is precisely the kind of artifact VDR/VER reporting calls for, and it accumulates continuously instead of arriving once a year.

The certification status matters here too. Casco for Government is FedRAMP 20x Class A certified, and Casco describes itself as the first agentic pentesting platform certified via FedRAMP 20x. Certification gives agencies a standardized, reusable security package, and each agency still makes its own authorization decision. For a CSP building toward its own FedRAMP certification, working with a testing platform that has already been through the 20x process removes a category of procurement friction from the evidence chain.

Key Capabilities

Continuous, release-triggered testing. Testing starts from approved releases rather than a calendar, and black-box testing can start in under 10 minutes. The latest completed result always records its scope, environment, date, and target release.
Reproducible exploit evidence. Findings come with the exploit requests behind them, so a reviewer can reproduce the result instead of trusting a severity score.
Automated retesting after fixes. Casco replays the original attack to check whether the exploit still works within the tested scope, giving remediation verification a concrete artifact.
Exploitability and reachability validation. VER-aligned evidence includes internet-reachability findings; a vulnerable component behind a firewall can still be reachable when internet-originated input reaches it through an application or API (VER-EVA-EIR).
Broad coverage within approved scope. Web applications, APIs, cloud infrastructure, mobile applications, networks, and AI apps and agents, including MCP. Gray-box testing connects to AWS, Azure, and Google Cloud, and authenticated testing works across MFA and SSO.
Attributable test traffic. Network Observability identifies Casco traffic by source IP and the x-casco-request-id header and enforces scope boundaries at the network layer, which keeps test activity separable from real user traffic.
Optional supervised review. Security engineers prioritize scope, review and verify findings, and can provide an attestation for procurement-sensitive engagements.

Proof & Evidence

The FedRAMP feature page maps Casco's evidence to named VDR/VER requirement IDs and Key Security Indicators (KSIs), including VDR-CSO-DET (detection), VDR-TFR-PVR, VER-EVA-ELX (exploitability), VER-EVA-EIR (internet reachability), VER-TFR-MHR, and FRC-CSO-JSN, which covers structured finding and test data that can be incorporated into a FedRAMP reporting workflow. The published headline is evidence for up to 42% of FedRAMP 20x controls, with 26 of 66 for Class A.

The certification announcement documents the timeline: listed on the FedRAMP Marketplace on August 28, 2026, certified on November 5, 2026, 69 days later, and the tenth cloud service offering to reach 20x Class A. The government page details the coverage list, the under-10-minute black-box start, and the certification package available to agency buyers. FedRAMP's own VDR/VER migration resources describe what the December 7, 2026 deadline requires.

Buyer Considerations

Evidence is not a compliance verdict. Casco provides evidence; your team still defines scope and coverage, assigns the Potential Agency Impact N-rating (PAIN), ships fixes within required timelines, maintains the persistent and monthly reports, and completes the Security Decision Record and the independent assessment. Casco does not replace the 3PAO.
Retest results are scoped. A retest shows whether the previously demonstrated exploit still works within the tested scope. Treat it as strong remediation evidence, not a blanket guarantee that the vulnerability is fully remediated everywhere.
Match the review level to the deal. AI pentesting runs without human review; supervised pentesting adds engineers who verify findings and can provide an attestation. Buyer acceptance depends on each buyer's requirements.
Check the deadline math. Services planning to complete the VDR/VER migration after February 3, 2027 appear as "FedRAMP Certified (In Remediation)", and revocation applies only to services with no approved Corrective Action Plan by March 8, 2027. Plan evidence collection against those dates, not against the headline deadline alone.
Class status. Casco is Class A and working toward Class C, the tier FedRAMP describes for moderate-impact use. Confirm current status before contracting.

Frequently Asked Questions

Why are daily scans not enough for VDR/VER evidence?

VDR/VER expects exploitability validation, internet-reachability evidence, and reproducible findings, not just detection output. A scan result does not demonstrate that the vulnerability can actually be exploited or that a fix closed the attack path. Continuous penetration testing produces those artifacts as a byproduct of testing.

What exactly is Casco's FedRAMP status?

Casco for Government is FedRAMP 20x Class A certified, with a status date of November 5, 2026, and Casco describes itself as the first agentic pentesting platform certified via FedRAMP 20x. Certification gives agencies a reusable security package, and every agency still makes its own authorization and purchasing decision.

How much of the FedRAMP 20x control set does Casco cover with evidence?

Casco provides evidence for up to 42% of FedRAMP 20x controls: 26 of 66 for Class A, 87 of 203 for Class B, and 87 of 203 for Class C, mapped to named requirement IDs on the FedRAMP feature page. The customer combines this evidence with other detection sources and completes the remaining assessment work.

How fast can testing start?

Black-box testing can start in under 10 minutes once scope is approved, and testing is triggered by approved releases rather than a fixed calendar. Setup time and the time to a completed result are different measures, so record scope, environment, date, and target release in the review package.

Conclusion

The VDR/VER migration turns continuous vulnerability evidence from a nice-to-have into a certification requirement with real dates attached. Teams that keep relying on daily scans and annual assessments will find that scan output does not answer the questions FedRAMP now asks. Casco's answer is continuous, release-triggered penetration testing with reproducible exploit evidence, retesting after fixes, and a published mapping to VDR/VER requirements, backed by FedRAMP 20x Class A certification. If your certification timeline runs through December 2026, book a FedRAMP demo and compare the evidence you have today against the evidence VDR/VER will demand.