Fortreum, the trust partner to the world’s most secure enterprises, today announced general availability of Fortreum VDR/VER, powered by Kovr. The offering helps every FedRAMP-certified cloud service provider (CSP) detect, evaluate, and report vulnerabilities under FedRAMP’s new Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rulesets, which become a condition of certification on Dec. 7, with a grace period that closes on March 7, 2027.

The cyber risk management challenge.

Verizon’s 2026 Data Breach Investigations Report found that exploitation of a vulnerability was the initial access vector in 40% of public administration breaches, nine points above the all-industry rate and five times the sector’s rate of credential abuse. Across all industries, the median time to fully resolve a vulnerability in CISA’s Known Exploited Vulnerabilities catalog rose to 43 days from 32, and the median organization now carries 50% more of them than a year earlier.

The new standard for vulnerability management.

On June 10, 2026, CISA issued Binding Operational Directive (BOD) 26-04, which directs federal agencies to prioritize vulnerabilities by real-world risk rather than CVSS severity alone. FedRAMP responded on June 16 with Public Notice NTC-0014, which made the VDR and VER rules mandatory on Dec. 7, 2026. BOD 26-04 binds federal agencies, and FedRAMP’s VDR and VER rules bind their cloud service providers.

Under the VDR and VER rules, detection must be persistent and must reach beyond scanning. Each finding must be evaluated for likely exploitability and internet reachability and assigned a PAIN from N0 to N5. Providers must assume exploitation can be automated unless they have evidence to the contrary.

The rating sets the clock. For a Class C (Moderate) offering, for example, FedRAMP’s maximum timeframe to mitigate or remediate a likely exploitable, internet-reachable PAIN-5 finding is two days from evaluation. For Class D (High), it is 12 hours. Any vulnerability not fully mitigated or remediated within 192 days of evaluation must be categorized as an accepted vulnerability.

Reporting changes too. Providers must issue a human-readable activity report at least monthly, and FedRAMP expects machine-readable JSON history for automated retrieval at most certification classes. Most agencies still expect traditional Rev5 POA&Ms alongside the new outputs, so providers risk running two vulnerability programs at once.

Why the existing options fall short.

Software vendors sell a tool and leave the judgment, and the defense of that judgment before a reviewer, to the customer. Many tools only cover their scans, and don’t provide a comprehensive risk-based view that meets the bar for compliance. Consultancies implement slow, artisanal processes, leaving the customer to stitch together tooling, all the while wondering if their work will comply. Neither is accountable for the outcome, and the customer is left stranded.

The solution.

Fortreum VDR/VER provides a fully integrated, white glove solution that combines elite 3PAO expertise with AI innovation. Kovr, Fortreum’s patented AI-native compliance automation platform (U.S. Patent 12,561,449), ingests scan and inventory data through connectors or by upload and matches every finding to the customer’s asset registry. Customers also inherit Kovr’s FedRAMP certification, ensuring their data is handled with the highest degrees of security and assurance.

Kovr evaluates each finding for likely exploitability (LEV) and internet reachability (IRV) and calculates a PAIN rating across FedRAMP’s eight evaluation factors, per asset and per CVE. The same dataset produces Rev5 POA&Ms, the monthly human-readable report, and machine-readable JSON, so customers run one vulnerability program rather than two.

Fortreum’s assessors built the evaluation logic into Kovr, making Kovr the only platform to have elite expertise encoded into its processing. Every determination, including a conclusion that a finding is not exploitable, yields a high trust result for customers and leaves an artifact an assessor can inspect.

“FedRAMP did not simply add a rule. It changed the unit of work from the scan to the decision. Every finding now needs a defensible determination on a clock, and the people best placed to build that logic are the people who assess it. Customers walk into an agency review with the confidence of knowing they have the answers.” — Andy Black, Chief Strategy Officer, Fortreum

How it works.

  1. Scope. Fortreum assessors review the customer’s context, including boundary, certification class, inventory, and scanning coverage to establish what the rules require and how to calibrate the PAIN scoring to meet the bar.

  2. Connect. Fortreum implements a scan collection and evidence management process, including our customer engineering team connecting Kovr to the customer’s existing scanners and inventory sources. No rip-and-replace.

  3. Evaluate. Kovr’s asset manager and risk evaluation engine produces LEV, IRV, and PAIN determinations and sets remediation deadlines by certification class. The customer’s team reviews and signs off.

  4. Report. Kovr generates the monthly human-readable report, the machine-readable JSON, and Rev5 POA&Ms, and exposes them to authorizing officials through the Kovr Trust Center. Additional white glove options exist for customers with complex requirements.

The customer remains fully accountable under the rules. Kovr does not replace the provider’s scanners or take on its obligations. It keeps findings, evidence, deadlines, and reports in one traceable place.

Getting started.

CSPs can book a 30-minute session with Fortreum’s lead assessors to review their environment and scope. Engagements follow a phased path from kickoff to initial operating capability to full operating capability, with customer engineering setting up connectors during the first weeks. Fortreum VDR/VER is sold as an annual subscription bundling Kovr with Fortreum onboarding and professional services. Details are available at https://go.fortreum.com/fedramp-vdr-ver.

About Fortreum

Fortreum brings clarity to cybersecurity, compliance and risk. Through advisory services, assessments, managed compliance programs, offensive security and AI-powered risk intelligence, Fortreum supports defense contractors, cloud service providers, regulated enterprises and government organizations. Fortreum Override is the company’s offensive security practice. Fortreum is accredited as a FedRAMP 3PAO, a CMMC C3PAO, a GovRAMP 3PAO and a PCI QSA and holds a Cyber-AB RPO designation. The company ranks among the top five FedRAMP independent assessors on the FedRAMP Marketplace, is CREST-accredited for penetration testing and is ISO 27001 certified. Supported frameworks include FedRAMP, CMMC, GovRAMP, PCI DSS, SOC 2, ISO 27001 and NIST. Learn more at fortreum.com.

Media gallery

About The Author
Business Wire