Casco

Casco provides autonomous security testing for web applications, APIs, infrastructure and AI systems, with optional human supervision. Development and security teams use it for continuous testing and penetration-test reports supporting SOC 2 and ISO 27001 compliance. Its reports include reproduction steps, risk explanations and remediation guidance. The Casco MCP server brings validated findings into assistants such as Claude Code, Codex and Cursor, allowing teams to assess impact and draft fixes through read-only, organization-scoped access.

Founded in 2025 by CEO Rene Brandel and CTO Ian Saultz, Casco grew out of the founders’ work on AWS’s generative AI team. Its agentic testing devises and executes multi-step attacks against AI agents and applications. Its vulnerability research includes discovering SQL injection in ElectricSQL’s Shape API during an authorized customer assessment. Casco traced the flaw to permissive syntax-tree validation that allowed arbitrary SQL expressions through to PostgreSQL; ElectricSQL subsequently fixed the issue.

As of August 2026, Casco reported adoption by 300+ companies, spanning startups and enterprises. In July 2026, Casco announced a Series A led by Standard Capital at a $100 million valuation, bringing cumulative funding to $17 million. FundersClub, Y Combinator and Rebel Fund also participated.