Compliance Automation for SOC 2, ISO 27001 & PCI-DSSPlus Attack Surface & Breach Simulation
Unified GRC platform for SOC 2, ISO 27001, HIPAA, PCI-DSS & NIST — with built-in internal attack surface management (iASM) and breach & attack simulation (BAS).
Purpose-built for CISOs, CPA audit firms & enterprise security teams · 50% below market rate
What is CATAAM?
CATAAM is a compliance automation and security testing platform from TheMarkups Canada Inc. It automates evidence collection and continuous control monitoring for 18 frameworks — SOC 2, SOC 1, ISO 27001, ISO 42001, NIST AI RMF, HIPAA, PCI DSS, GDPR, NIST CSF, COBIT 5, ITIL, India's DPDP Act, the ACSC Essential Eight, the Australian Privacy Principles, APRA CPS 234 and the AML/CFT regimes of Ecuador (SEPS), Colombia (SARLAFT) and Peru (SPLAFT) — from one shared control set, connects to 455 integrations with 130 automated checks, and bundles internal and external attack surface management (iASM/EASM) and breach & attack simulation (BAS) so controls are proven to work, not just documented. Plans are priced in USD from $149 per month with a 14-day free trial.
- Frameworks
- 18, on one shared control set — evidence collected once, reused everywhere.
- Integrations
- 455, with 130 automated checks across AWS, Azure, GitHub, GitLab, Okta, Supabase and more, plus two-way Jira sync.
- Pricing
- From US$149/month, published and self-serve, with a 14-day free trial.
Last updated 2026-10-26.
Everything You Need for Compliance Automation & Security
From automated evidence collection to internal attack surface management and breach simulations — CATAAM covers the full security and compliance lifecycle for organizations and the firms that serve them.
Multi-Framework Compliance
Manage SOC 2, ISO 27001, HIPAA, PCI-DSS, NIST CSF, COBIT 5, ITIL, and more from a single platform. Cross-framework mapping automatically identifies overlapping controls so you implement them once and satisfy multiple standards simultaneously.
- SOC 2 · ISO 27001 · HIPAA · PCI-DSS · NIST
- Automatic cross-framework control mapping
- Real-time audit progress tracking per framework
Evidence Harvesting & Management
Automatically collect evidence from your connected tools — AWS, GitHub, Jira, and more. Define harvest rules once and let the platform continuously pull proof of compliance. Attach evidence directly to controls and requirements, eliminating last-minute audit scrambles.
- Automated evidence collection from integrations
- Rule-based harvesting with schedule control
- Evidence linked directly to controls and requirements
Partner & Multi-Org Management
CISO Resellers and CPA firms can onboard and manage multiple client organizations from a single partner dashboard. Switch between client contexts instantly, enroll clients in frameworks, track their compliance status, and get billed monthly for active enrollments.
- Onboard unlimited client organizations
- Per-client compliance dashboard with context switching
- Post-paid partner billing at $149/framework/month
Executive Reporting & Risk Score
Generate board-ready compliance reports with a live risk score calculated from your control statuses. Track your 90-day compliance trend with sparkline charts, create custom report templates, and export executive summaries for stakeholders and auditors.
- Live risk score with 90-day trend tracking
- Customizable executive report templates
- Exportable PDF and structured compliance summaries
External Attack Surface Monitoring
Continuously discover and monitor your external attack surface. Identify exposed subdomains via certificate transparency logs, check DNS health (SPF, DMARC, DNSSEC), detect open ports and exposed services, and map findings to MITRE ATT&CK techniques.
- Subdomain discovery via crt.sh & DNS analysis
- Email security checks (SPF, DMARC, MX records)
- MITRE ATT&CK technique mapping for findings
Internal Attack Surface Management (iASM)
Discover, map, and secure your internal cloud infrastructure. Connect AWS, Azure, and GCP accounts to auto-discover assets, visualize your attack surface as an interactive attack-path graph, run automated security audits, and track open findings — all from a single pane of glass. Free to explore; credits consumed only when running active scans.
- Auto-discover cloud assets via connector sync
- Interactive attack graph with path simulation
- Automated security audit with open findings tracking
Breach & Attack Simulation (BAS)
Proactively test your defences before attackers do. Simulate real-world attack scenarios against your AWS environment and SSH endpoints. Every BAS run maps findings to CVEs and MITRE ATT&CK techniques, giving your security team actionable intelligence to prioritize remediation — at a fraction of the cost of traditional pen testing.
- AWS IAM privilege escalation & lateral movement simulations
- SSH brute-force, cipher weakness, and exposure probes
- CVE and MITRE ATT&CK technique mapping for every finding
Marketplace & Vendor Risk
Discover vetted compliance service providers in the CATAAM marketplace. Partners can list their services, connect with prospects, and manage leads. Organizations can assess and monitor vendor security posture through integrated vendor risk questionnaires.
- Compliance partner discovery marketplace
- Vendor risk questionnaires and assessments
- Lead management for partner firms
See Internal Attack Surface & Breach Simulation in Action
Internal attack surface management and breach simulation — purpose-built for CISOs, CPA auditors, and security teams. 50% cheaper than every comparable platform.
↑ Auto-discover every cloud asset across AWS, Azure, and GCP — connectors sync your infrastructure on demand.
Free to Explore
Connect cloud accounts, discover assets, and browse your attack surface graph at no cost. Credits are only consumed when you take action — run a scan, trigger BAS, or simulate an attack path.
50% Below Market Rate
Commercial iASM platforms charge $2,000–$5,000/month. CATAAM delivers the same coverage with a full monthly run — sync, audit, and BAS — for $1,999 on the Standard pack.
CISO & CPA Partners
Platform admin can grant credits to any client org. CISOs and CPA partners receive 100 free onboarding credits and post-paid billing — no upfront payment required to get clients running.
How It Works
Achieve compliance with our streamlined process
Connect & Enroll
Connect your AWS, Azure, or GCP account and enroll in your target framework — SOC 2, ISO 27001, HIPAA, or PCI-DSS. CATAAM maps controls automatically and launches your compliance workspace in minutes.
Collect Evidence
Step 02Define harvest rules once — CATAAM continuously pulls proof of compliance from AWS, GitHub, and Jira. Evidence is automatically linked to controls, eliminating last-minute audit scrambles.
Remediate & Report
Track open findings, assign controls to team members, and close gaps with iASM and BAS insights. Generate board-ready executive reports and export audit packages when you're ready for the auditor.
Who It's For
CATAAM is built for every role in the compliance ecosystem — from solo CISOs to large CPA firms managing hundreds of client audits.
CISO Resellers
🎁 100 free iASM credits on sign-upManage compliance and attack surface security for your entire client portfolio from one dashboard. Onboard clients, enroll them in frameworks, run iASM scans on their cloud infrastructure, trigger BAS simulations, and deliver findings reports — all under your brand. Post-paid billing at $149/framework/month. New CISO partners receive 100 free iASM credits per client org.
CPA & Audit Firms
🎁 100 free iASM credits + no upfront billingRun SOC 2, ISO 27001, and HIPAA engagements end-to-end. Manage audit evidence, track control status, and issue findings directly in the platform. Now include internal attack surface reports — powered by iASM — as a value-added service to your audit clients. New CPA partners receive 100 free iASM credits and no upfront commitment.
Enterprise Security Teams
Automate compliance across multiple frameworks simultaneously. Harvest evidence from AWS, GitHub, and Jira integrations. Discover your entire internal cloud attack surface with iASM, simulate adversary TTPs with BAS, and generate executive-ready reports with a live risk score — at 50% below the cost of Qualys, Rapid7, or Tenable.
Compliance Officers
Stay ahead of audits with real-time control tracking, automated remediation workflows, and document management. Assign controls to team members, respond to auditor requests, and maintain a continuous compliance posture. Use iASM findings to close security control gaps before auditors ask for evidence.
Free Security Tools & Compliance Templates
Practical scripts that produce audit-ready evidence — each one maps findings to a compliance framework so your team can act immediately. Free, open-source, and maintained by the Cataam team.
Prompt Guard — keep secrets out of public LLMs
Local-first redaction that strips API keys, secrets and PII from a prompt before it reaches ChatGPT, Claude or Gemini — reversibly, so the answer stays useful — with auditor-ready ISO 42001 / EU AI Act evidence.
env-hardener.sh
CIS Linux Hardening
Audits and remediates CIS Benchmark Level 1 & 2 controls on Linux hosts. Exports audit-ready JSON findings per control.
cve-scanner.py
CVE Scanner
Queries the NVD API for CVEs affecting a product or version, scores them with CVSS v3, and maps each finding to ISO 27001 and SOC 2 controls.
cloud-posture-check.py
AWS Cloud Posture
Audits AWS accounts against the CIS AWS Foundations Benchmark v1.5 — covering IAM, S3, CloudTrail, VPC Flow Logs, and security groups.
ssl-tls-audit.py
TLS / SSL Audit
Checks TLS protocol versions, cipher suite strength, and certificate validity. Applies PCI DSS 4.0 Requirement 4.2 pass/fail thresholds.
Compliance Templates
Audit-ready documents you can use directly or import into your GRC workflow.
Knowledge Base
Plain-English control guides mapped to frameworks — reference material for practitioners and auditors.
CVE Lab & Wiki
Detection scripts for major vulnerabilities and a GRC glossary every security practitioner should bookmark.
All tools output structured JSON that maps directly to Cataam platform controls — run them standalone or feed findings straight into your GRC workspace.
Integrations & Compatibility
Seamlessly connect with your existing security and infrastructure tools
AWS
40 automated checks — IAM and MFA, CloudTrail, S3, EC2, GuardDuty and container vulnerabilities
Microsoft Azure
29 automated checks — Entra ID MFA, Defender for Cloud, NSG rules, storage and disk encryption
Supabase
7 automated checks — Row Level Security, dashboard MFA, SSL, backups and network restrictions
Okta
6 automated checks — MFA and sign-on policies, password policy, inactive users and API tokens
CrowdStrike
Checks that every Falcon-managed host runs a fully functional sensor
Splunk
Confirms Splunk is receiving your log data, as log-management evidence
GitHub
12 automated checks — branch protection, pull-request reviews, private repositories and Dependabot vulnerabilities
GitLab
6 automated checks — MFA, branch protection, change reviews and vulnerability scanning
Kubernetes
RBAC, anonymous-access and network-policy checks across your clusters
Cloudflare
End-to-end TLS on every zone and no publicly exposed R2 buckets
Datadog
Infrastructure monitors and alert notifications are in place
Frequently asked questions
- What is CATAAM?
- CATAAM is a compliance automation and security testing platform from TheMarkups Canada Inc. It automates evidence collection and continuous control monitoring for 18 frameworks — SOC 2, SOC 1, ISO 27001, ISO 42001, NIST AI RMF, HIPAA, PCI DSS, GDPR, NIST CSF, COBIT 5, ITIL, India's DPDP Act, the ACSC Essential Eight, the Australian Privacy Principles, APRA CPS 234 and the AML/CFT regimes of Ecuador (SEPS), Colombia (SARLAFT) and Peru (SPLAFT) — from one shared control set, connects to 455 integrations with 130 automated checks, and bundles internal and external attack surface management (iASM/EASM) and breach & attack simulation (BAS) so controls are proven to work, not just documented. Plans are priced in USD from $149 per month with a 14-day free trial.
- How much does CATAAM cost?
- Plans are published in USD: Starter $149/month ($1,490/year) for one framework and 25 users; Professional $699/month ($6,990/year) for up to 5 frameworks, 200 users and 30 iASM credits; Business $1,799/month ($17,990/year) for up to 15 frameworks, 1,000 users and 120 iASM credits with BAS runs; Enterprise is custom. Every paid plan starts with a 14-day free trial and no credit card. iASM credit packs are also priced in USD, from $599.
- Which compliance frameworks does CATAAM support?
- 18 frameworks from one shared control set: SOC 2, SOC 1, ISO 27001, ISO 42001, NIST AI RMF, HIPAA, PCI DSS, GDPR, NIST CSF, COBIT 5, ITIL, India's DPDP Act, the ACSC Essential Eight, the Australian Privacy Principles, APRA CPS 234 and the AML/CFT regimes of Ecuador (SEPS), Colombia (SARLAFT) and Peru (SPLAFT). A control evidenced once satisfies every framework it maps to.
- How is CATAAM different from Vanta, Drata or Secureframe?
- Those platforms automate compliance evidence only, which shows a control exists. CATAAM does the same evidence automation and adds attack surface management, breach and attack simulation and web/API pen-testing, so it also shows the control works. It is self-serve with published pricing at roughly half the cost of sales-led tools.
- What does CATAAM integrate with?
- 455 integrations across cloud, identity, code, devices, HR, security training, ticketing and more. Connectors such as AWS, Microsoft Azure (including Entra ID), GitHub, GitLab, Bitbucket, Okta, Google Workspace, Supabase, Kubernetes and CrowdStrike run 130 automated checks against your real configuration, and Jira syncs findings both ways. See every integration and try a demo at cataam.com/integrations.
- Who is CATAAM for?
- Security and compliance teams at SaaS and cloud companies preparing for or maintaining SOC 2, ISO 27001 and similar certifications; CISOs who need proof controls work; and CPA firms and CISO resellers running compliance for many client organisations from one partner dashboard with post-paid billing at $149 per framework per client per month.
Ready to run your first compliance framework?
Start with GRC at $149/framework/month, or explore your cloud attack surface for free — no upfront commitment required.
Get Started Now