Fortreum announced the general availability of Fortreum VDR/VER today. Powered by Kovr, this offering arrives just ahead of strict new federal standards. Specifically, it helps every FedRAMP-certified cloud service provider detect, evaluate, and report vulnerabilities. Furthermore, these new Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rulesets become mandatory under FedRAMP on Dec. 7, with a grace period closing on March 7, 2027.
Verizon’s 2026 Data Breach Investigations Report revealed critical cybersecurity risks. Specifically, vulnerability exploitation served as the initial access vector in 40% of public administration breaches. Meanwhile, the median time to resolve vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog rose to 43 days. Additionally, median organizations now carry 50% more vulnerabilities than a year earlier.
On June 10, 2026, CISA issued Binding Operational Directive (BOD) 26-04. Consequently, FedRAMP responded with Public Notice NTC-0014, making VDR and VER rules mandatory. Under these rules, detection must be persistent and reach beyond basic scanning.VDR/VER Therefore, providers must evaluate each finding for exploitability and internet reachability. Moreover, they must assign a PAIN rating from N0 to N5.
The Integrated Solution and Compliance Automation
Fortreum VDR/VER provides a fully integrated solution combining elite third-party assessment organization (3PAO) expertise with artificial intelligence. Kovr, Fortreum’s patented AI-native compliance automation platform, ingests scan and inventory data seamlessly. Furthermore, customers inherit Kovr’s FedRAMP certification, ensuring maximum data security.
Kovr evaluates each finding for likely exploitability and internet reachability, calculating accurate PAIN ratings. Simultaneously, the platform produces traditional Rev5 POA&Ms, monthly reports, and machine-readable JSON history. Consequently, customers run a single unified vulnerability program.
“FedRAMP did not simply add a rule. It changed the unit of work from the scan to the decision. Every finding now needs a defensible determination on a clock, and the people best placed to build that logic are the people who assess it. Customers walk into an agency review with the confidence of knowing they have the answers.” Andy Black, Chief Strategy Officer, Fortreum
Implementation and Getting Started
Cloud service VDR/VER providers follow a structured, phased path to full operational capability. First, Fortreum assessors review the customer’s environment and scope. Next, the customer engineering team connects Kovr to existing scanners and asset inventories. Finally, Kovr generates required compliance reports and exposes them through the Kovr Trust Center. Ultimately, CSPs can book a consultation session with Fortreum lead assessors to prepare for upcoming FedRAMP mandates.
For related updates on digital trust and cybersecurity, explore our SOC News.
News Source: Businesswire.com
