How Casco got FedRAMP listed and on the path to 20x Class C with Mycroft

Casco is an agentic offensive security platform. Its AI agents test applications, APIs, cloud infrastructure, networks and AI systems, reproduce real impact, and replay proven attacks to confirm fixes work. The result is evidence defenders can act on, not more alerts. With Casco for Government, now FedRAMP 20x Class A certified, it brings continuous offensive security to federal agencies and public-sector security teams.

At a glance

• FedRAMP Marketplace listed: and, based on Casco’s review of public listings as of August 31, 2026, the first standalone listing for an agentic offensive security platform
• 46 Key Security Indicators instead of 300+ control narratives under the legacy Rev5 process
• Class C ready by design: the tier that requires at least two automated validation methods behind every indicator

Government wasn’t part of Casco’s original plan. “When Ian and I started Casco, federal agencies were not on our roadmap,” says Founder and CEO René Brandel. “Then government security teams started showing up at our conference booths.”

The conversations followed a pattern. Agencies’ software was growing at an unprecedented rate, their attack surface was changing faster than annual assessments could track, and their adversaries were adopting AI. They needed a stronger force on their side, and Casco was built to be one.

But selling to agencies means FedRAMP, and the legacy path was the opposite of everything Casco stands for: hundreds of control narratives, a static System Security Plan and timelines that often stretch past a year. For a company built on continuous security, a paperwork-heavy snapshot didn’t fit.

An annual point-in-time test cannot match an adversary operating at AI speed. Defense has to become continuous.

Casco also set a high bar for itself: FedRAMP 20x Class C, the tier for enterprise services used across an entire agency or supporting important government services. Class C requires at least two automated methods to persistently verify each Key Security Indicator, plus historical validation metrics, frequent machine-readable reporting, and verification of machine-based resources at least every three days.

FedRAMP 20x was the natural fit. “We chose FedRAMP 20x because it replaces static, paperwork-heavy assurance with continuous evidence (just like Casco does for pentesting!),” René explains.

Instead of narratives for hundreds of controls, 20x asks providers to demonstrate 46 Key Security Indicators with machine-readable evidence, automated wherever possible. Casco already believed in that model. It needed a partner to make it real inside its own environment.

Casco partnered with Mycroft to design, implement, operate, monitor and document its internal controls. Mycroft’s platform pulls evidence from cloud, code and identity systems from day one, so nobody spends the week before an assessment chasing screenshots. Mycroft’s team works alongside Casco on the program itself, mapping indicators to what Casco already does, keeping records current and preparing for the independent assessment Class C requires.

They have treated this as an engineering journey, not a paperwork exercise, and they have been an exceptional partner through every step so far.

For a team of engineers who have previously built AWS GovCloud, AI and security services, that distinction mattered. Casco knows its security posture has to be demonstrated through architecture, operating discipline, independent assessment and transparent evidence. With Mycroft, compliance is built the same way.

Casco for Government is now listed on the FedRAMP Marketplace. When it was listed, Casco for Government became what Casco describes as the first standalone FedRAMP Marketplace listing for an agentic offensive security platform.

We would not be at this milestone without Mycroft.

That listing mattered early. With FedRAMP 20x no longer requiring an agency sponsor, Casco didn’t have to wait for a signed federal customer to get started, and federal buyers could find it on the Marketplace while certification work continued.

Under the hood, evidence collection is continuous rather than assembled at audit time, which is exactly what Class C’s automated validation and historical metrics depend on. And Casco is doing it in the open, publishing progress through its Trust Center and keeping its Marketplace status honest.

As René puts it, “FedRAMP 20x gives us a rigorous way to do that in public.”

Casco tests other companies’ defenses for a living, so it needed a compliance partner held to the same standard: continuous, evidence-based and engineered, not documented after the fact.

Mycroft has been through FedRAMP 20x itself. The Mycroft GRC Platform is FedRAMP 20x Certified and one of the only GRC platforms on the Marketplace, so Casco got a team that had already run the process on its own platform, not one learning it alongside them.

Mycroft doesn’t hand over a dashboard and walk away. The team writes the records, works with the assessor, and keeps everything current after certification, from quarterly Ongoing Certification Reports to monthly vulnerability reporting. One team, one platform, from SOC 2 to Class A to Class D, with controls cross-mapped so no work is done twice.

Their platform supports the continuous evidence collection and compliance automation that a 20x program demands.

• No agency sponsor required. You can get listed on the FedRAMP Marketplace before any agency signs with you.
• Already have SOC 2? Class A builds on a SOC 2 Type II from the past 12 months, and with Mycroft it can take as little as 30 days from kickoff to a submitted certification package.
• Class B and C are open now. The Class B and C pipelines opened August 31, 2026.
• The old path is closing. FedRAMP stops accepting new Rev5 applications on June 11, 2027.