CATAAM Pricing, Features and SOC 2 Frameworks (2026)

CATAAM, developed by TheMarkups Canada Inc. in Mississauga, pairs GRC and compliance automation with offensive-security tooling. Alongside control mapping and evidence collection, it runs attack surface monitoring and breach and attack simulation, then feeds those simulation results back in as control evidence. That combination makes it an unusual option for startups and budget-conscious teams that want security testing and readiness work in one subscription.

On SOC 2, CATAAM works as a readiness tool. It maps controls and gathers evidence, but auditor fees are separate and the attestation itself comes from an outside CPA firm; the Enterprise tier adds workflows for managing that audit engagement. Support scales with plan: Starter customers get email support, while Professional and above add priority support and a dedicated compliance advisor, which gives smaller teams some expert guidance without hiring a consultant.

Pricing is published and tiered, billed monthly or annually. Starter is listed at $1,490 per year for one framework, Professional at $6,990 for five, Business at $17,990 for fifteen, and Enterprise is custom. The site does not state a currency, so the directory assumes USD. The platform lists 11 frameworks, including SOC 2, ISO 27001, ISO 42001, HIPAA and PCI DSS, plus APAC regimes such as Essential Eight, APRA CPS 234 and India's DPDP. Vendor risk features are included. An integration count is not published.

A company chasing its first SOC 2 report on a tight budget, especially one with APAC customers, could reasonably add CATAAM to a shortlist. The trade-off is that it has little public track record to check. Its G2 page exists but shows no rating or reviews, and the founding year is not published. Ask for references from current SOC 2 customers, confirm which cloud and identity tools it pulls evidence from, and check whether your auditor accepts simulation output as evidence.