Compliance Automation for SOC 2, ISO 27001 & PCI-DSSPlus Attack Surface & Breach Simulation
Unified GRC platform for SOC 2, ISO 27001, HIPAA, PCI-DSS & NIST — with built-in internal attack surface management (iASM) and breach & attack simulation (BAS).
Purpose-built for CISOs, CPA audit firms & enterprise security teams · 50% below market rate
What is CATAAM?
CATAAM is a compliance automation and security testing platform from TheMarkups Canada Inc. It automates evidence collection and continuous control monitoring for 14 frameworks — SOC 2, SOC 1, ISO 27001, ISO 42001, HIPAA, PCI DSS, GDPR, NIST CSF, COBIT 5, ITIL, India's DPDP Act, the ACSC Essential Eight, the Australian Privacy Principles and APRA CPS 234 — from one shared control set, connects to 429+ integrations, and bundles internal and external attack surface management (iASM/EASM) and breach & attack simulation (BAS) so controls are proven to work, not just documented. Plans are priced in USD from $149 per month with a 14-day free trial.
- Frameworks
- 14, on one shared control set — evidence collected once, reused everywhere.
- Integrations
- 429+ connectable vendors; deep connectors for AWS, Azure, GCP, GitHub, GitLab, Jira, Google Workspace and Okta.
- Pricing
- From US$149/month, published and self-serve, with a 14-day free trial.
Last updated 2026-09-25.
Everything You Need for Compliance Automation & Security
From automated evidence collection to internal attack surface management and breach simulations — CATAAM covers the full security and compliance lifecycle for organizations and the firms that serve them.
Multi-Framework Compliance
Manage SOC 2, ISO 27001, HIPAA, PCI-DSS, NIST CSF, COBIT 5, ITIL, and more from a single platform. Cross-framework mapping automatically identifies overlapping controls so you implement them once and satisfy multiple standards simultaneously.
- SOC 2 · ISO 27001 · HIPAA · PCI-DSS · NIST
- Automatic cross-framework control mapping
- Real-time audit progress tracking per framework
Evidence Harvesting & Management
Automatically collect evidence from your connected tools — AWS, GitHub, Jira, and more. Define harvest rules once and let the platform continuously pull proof of compliance. Attach evidence directly to controls and requirements, eliminating last-minute audit scrambles.
- Automated evidence collection from integrations
- Rule-based harvesting with schedule control
- Evidence linked directly to controls and requirements
Partner & Multi-Org Management
CISO Resellers and CPA firms can onboard and manage multiple client organizations from a single partner dashboard. Switch between client contexts instantly, enroll clients in frameworks, track their compliance status, and get billed monthly for active enrollments.
- Onboard unlimited client organizations
- Per-client compliance dashboard with context switching
- Post-paid partner billing at $149/framework/month
Executive Reporting & Risk Score
Generate board-ready compliance reports with a live risk score calculated from your control statuses. Track your 90-day compliance trend with sparkline charts, create custom report templates, and export executive summaries for stakeholders and auditors.
- Live risk score with 90-day trend tracking
- Customizable executive report templates
- Exportable PDF and structured compliance summaries
External Attack Surface Monitoring
Continuously discover and monitor your external attack surface. Identify exposed subdomains via certificate transparency logs, check DNS health (SPF, DMARC, DNSSEC), detect open ports and exposed services, and map findings to MITRE ATT&CK techniques.
- Subdomain discovery via crt.sh & DNS analysis
- Email security checks (SPF, DMARC, MX records)
- MITRE ATT&CK technique mapping for findings
Internal Attack Surface Management (iASM)
Discover, map, and secure your internal cloud infrastructure. Connect AWS, Azure, and GCP accounts to auto-discover assets, visualize your attack surface as an interactive attack-path graph, run automated security audits, and track open findings — all from a single pane of glass. Free to explore; credits consumed only when running active scans.
- Auto-discover cloud assets via connector sync
- Interactive attack graph with path simulation
- Automated security audit with open findings tracking
Breach & Attack Simulation (BAS)
Proactively test your defences before attackers do. Simulate real-world attack scenarios against your AWS environment and SSH endpoints. Every BAS run maps findings to CVEs and MITRE ATT&CK techniques, giving your security team actionable intelligence to prioritize remediation — at a fraction of the cost of traditional pen testing.
- AWS IAM privilege escalation & lateral movement simulations
- SSH brute-force, cipher weakness, and exposure probes
- CVE and MITRE ATT&CK technique mapping for every finding
Marketplace & Vendor Risk
Discover vetted compliance service providers in the CATAAM marketplace. Partners can list their services, connect with prospects, and manage leads. Organizations can assess and monitor vendor security posture through integrated vendor risk questionnaires.
- Compliance partner discovery marketplace
- Vendor risk questionnaires and assessments
- Lead management for partner firms
See Internal Attack Surface & Breach Simulation in Action
Internal attack surface management and breach simulation — purpose-built for CISOs, CPA auditors, and security teams. 50% cheaper than every comparable platform.
↑ Auto-discover every cloud asset across AWS, Azure, and GCP — connectors sync your infrastructure on demand.
Free to Explore
Connect cloud accounts, discover assets, and browse your attack surface graph at no cost. Credits are only consumed when you take action — run a scan, trigger BAS, or simulate an attack path.
50% Below Market Rate
Commercial iASM platforms charge $2,000–$5,000/month. CATAAM delivers the same coverage with a full monthly run — sync, audit, and BAS — for $1,999 on the Standard pack.
CISO & CPA Partners
Platform admin can grant credits to any client org. CISOs and CPA partners receive 100 free onboarding credits and post-paid billing — no upfront payment required to get clients running.
How It Works
Achieve compliance with our streamlined process
Connect & Enroll
Connect your AWS, Azure, or GCP account and enroll in your target framework — SOC 2, ISO 27001, HIPAA, or PCI-DSS. CATAAM maps controls automatically and launches your compliance workspace in minutes.
Collect Evidence
Step 02Define harvest rules once — CATAAM continuously pulls proof of compliance from AWS, GitHub, and Jira. Evidence is automatically linked to controls, eliminating last-minute audit scrambles.
Remediate & Report
Track open findings, assign controls to team members, and close gaps with iASM and BAS insights. Generate board-ready executive reports and export audit packages when you're ready for the auditor.
Who It's For
CATAAM is built for every role in the compliance ecosystem — from solo CISOs to large CPA firms managing hundreds of client audits.
CISO Resellers
🎁 100 free iASM credits on sign-upManage compliance and attack surface security for your entire client portfolio from one dashboard. Onboard clients, enroll them in frameworks, run iASM scans on their cloud infrastructure, trigger BAS simulations, and deliver findings reports — all under your brand. Post-paid billing at $149/framework/month. New CISO partners receive 100 free iASM credits per client org.
CPA & Audit Firms
🎁 100 free iASM credits + no upfront billingRun SOC 2, ISO 27001, and HIPAA engagements end-to-end. Manage audit evidence, track control status, and issue findings directly in the platform. Now include internal attack surface reports — powered by iASM — as a value-added service to your audit clients. New CPA partners receive 100 free iASM credits and no upfront commitment.
Enterprise Security Teams
Automate compliance across multiple frameworks simultaneously. Harvest evidence from AWS, GitHub, and Jira integrations. Discover your entire internal cloud attack surface with iASM, simulate adversary TTPs with BAS, and generate executive-ready reports with a live risk score — at 50% below the cost of Qualys, Rapid7, or Tenable.
Compliance Officers
Stay ahead of audits with real-time control tracking, automated remediation workflows, and document management. Assign controls to team members, respond to auditor requests, and maintain a continuous compliance posture. Use iASM findings to close security control gaps before auditors ask for evidence.
Free Security Tools & Compliance Templates
Practical scripts that produce audit-ready evidence — each one maps findings to a compliance framework so your team can act immediately. Free, open-source, and maintained by the Cataam team.
Prompt Guard — keep secrets out of public LLMs
Local-first redaction that strips API keys, secrets and PII from a prompt before it reaches ChatGPT, Claude or Gemini — reversibly, so the answer stays useful — with auditor-ready ISO 42001 / EU AI Act evidence.
env-hardener.sh
CIS Linux Hardening
Audits and remediates CIS Benchmark Level 1 & 2 controls on Linux hosts. Exports audit-ready JSON findings per control.
cve-scanner.py
CVE Scanner
Queries the NVD API for CVEs affecting a product or version, scores them with CVSS v3, and maps each finding to ISO 27001 and SOC 2 controls.
cloud-posture-check.py
AWS Cloud Posture
Audits AWS accounts against the CIS AWS Foundations Benchmark v1.5 — covering IAM, S3, CloudTrail, VPC Flow Logs, and security groups.
ssl-tls-audit.py
TLS / SSL Audit
Checks TLS protocol versions, cipher suite strength, and certificate validity. Applies PCI DSS 4.0 Requirement 4.2 pass/fail thresholds.
Compliance Templates
Audit-ready documents you can use directly or import into your GRC workflow.
Knowledge Base
Plain-English control guides mapped to frameworks — reference material for practitioners and auditors.
CVE Lab & Wiki
Detection scripts for major vulnerabilities and a GRC glossary every security practitioner should bookmark.
All tools output structured JSON that maps directly to Cataam platform controls — run them standalone or feed findings straight into your GRC workspace.
Integrations & Compatibility
Seamlessly connect with your existing security and infrastructure tools
AWS
Amazon Web Services security and compliance tools integration
Azure
Microsoft Azure security center and compliance manager
GCP
Google Cloud Platform security command center
Splunk
Security information and event management (SIEM)
CrowdStrike
Endpoint detection and response (EDR)
Rapid7
Vulnerability management and assessment
GitHub
Repository access controls and code scanning alert evidence
GitLab
Source code and container security scanning
VMware
Virtual infrastructure security compliance
Kubernetes
Container orchestration security policies
Terraform
Infrastructure as code security validation
Frequently asked questions
- What is CATAAM?
- CATAAM is a compliance automation and security testing platform from TheMarkups Canada Inc. It automates evidence collection and continuous control monitoring for 14 frameworks — SOC 2, SOC 1, ISO 27001, ISO 42001, HIPAA, PCI DSS, GDPR, NIST CSF, COBIT 5, ITIL, India's DPDP Act, the ACSC Essential Eight, the Australian Privacy Principles and APRA CPS 234 — from one shared control set, connects to 429+ integrations, and bundles internal and external attack surface management (iASM/EASM) and breach & attack simulation (BAS) so controls are proven to work, not just documented. Plans are priced in USD from $149 per month with a 14-day free trial.
- How much does CATAAM cost?
- Plans are published in USD: Starter $149/month ($1,490/year) for one framework and 25 users; Professional $699/month ($6,990/year) for up to 5 frameworks, 200 users and 30 iASM credits; Business $1,799/month ($17,990/year) for up to 15 frameworks, 1,000 users and 120 iASM credits with BAS runs; Enterprise is custom. Every paid plan starts with a 14-day free trial and no credit card. iASM credit packs are also priced in USD, from $599.
- Which compliance frameworks does CATAAM support?
- Fourteen frameworks from one shared control set: SOC 2, SOC 1, ISO 27001, ISO 42001, HIPAA, PCI DSS, GDPR, NIST CSF, COBIT 5, ITIL, India's DPDP Act, the ACSC Essential Eight, the Australian Privacy Principles and APRA CPS 234. A control evidenced once satisfies every framework it maps to.
- How is CATAAM different from Vanta, Drata or Secureframe?
- Those platforms automate compliance evidence only, which shows a control exists. CATAAM does the same evidence automation and adds attack surface management, breach and attack simulation and web/API pen-testing, so it also shows the control works. It is self-serve with published pricing at roughly half the cost of sales-led tools.
- What does CATAAM integrate with?
- 429+ vendors can be connected from the vendor page, including deep evidence connectors for AWS, Azure, Google Cloud, GitHub, GitLab, Jira, Google Workspace, Okta, Microsoft Entra ID and Supabase. Presence and configuration evidence is collected automatically and mapped to controls.
- Who is CATAAM for?
- Security and compliance teams at SaaS and cloud companies preparing for or maintaining SOC 2, ISO 27001 and similar certifications; CISOs who need proof controls work; and CPA firms and CISO resellers running compliance for many client organisations from one partner dashboard with post-paid billing at $149 per framework per client per month.
Ready to run your first compliance framework?
Start with GRC at $149/framework/month, or explore your cloud attack surface for free — no upfront commitment required.
Get Started Now