A SecurityMetrics alternative for ISOs, acquirers and PayFacs

Reviewing your merchant PCI program, or comparing SecurityMetrics before you sign? Here is a fair description of SecurityMetrics, the questions worth asking any vendor, how Compliance Assessment Tool works, and a practical plan for switching.

About SecurityMetrics

SecurityMetrics was founded in 2000 and is headquartered in Orem, Utah. It describes itself as an Approved Scanning Vendor, Qualified Security Assessor and certified forensic investigator.

Its PCI Program for acquirers, ISOs and payment service providers lists a Partner+ Portal for tracking merchant compliance, an assigned Customer Success Manager who sets the program up, 24/7 merchant support by phone, chat and email, ASV scans in its plans, a FastPass tool that auto-fills merchants' SAQs in non-technical language, and Spectre AI for identifying portfolio risk.

Capabilities and terms vary by program, so confirm details with SecurityMetrics.

What to compare

The same questions apply to any merchant PCI program. The CAT column is what we do; the right-hand column is what to ask SecurityMetrics. We don't answer for them.

What to compare	Compliance Assessment Tool	Ask SecurityMetrics
SAQ selection	The merchant describes each way they take payments in their own words. AI picks the right SAQ for each payment method from all nine PCI DSS v4.0.1 merchant SAQs, asking a follow-up only when it needs one.	SecurityMetrics says its FastPass tool auto-fills the merchant's SAQ in non-technical language. Ask what data it fills from, and what the merchant confirms before signing. What happens when a merchant takes cards more than one way?
Merchant experience	Every question is written in plain English for that business and that payment method, and each answer shapes the next. The merchant reviews and confirms every answer; nothing is auto-attested.	Can we see the exact questions a merchant with a countertop terminal answers? What share of invited merchants complete, and how long does it take them?
Branding and white-label	Your brand: a white-label portal and embeddable iframe, and branded invite emails.	Whose brand does the merchant see in the emails, the portal and the documents? Is white-label included or extra?
Integration options	Zero-code bulk invites, a platform redirect, an embeddable iframe, a REST API (OpenAPI 3.1) and an MCP server for AI agents. An optional Authorize.Net connection reads how a merchant takes payments.	Is there a documented API, and can our engineers test it today, before a contract?
Portfolio reporting	Portfolio visibility for ISOs and banks: a portfolio API, CSV export for your sponsor bank, and signed webhooks.	SecurityMetrics lists a Partner+ Portal for tracking merchant compliance and Spectre AI for identifying portfolio risk. Ask whether you can export that view in your sponsor bank's format and receive status events in your own systems.
Document output	The official PCI SSC SAQ and Attestation of Compliance, filled in and signed digitally by the merchant, as PDFs.	Is the output the official PCI SSC SAQ and AoC, signed by the merchant?
Pricing model	$25 per completed assessment. Free sandbox.	Is it priced per merchant, per month, per assessment, or bundled into a fee charged to merchants? Who pays, you or the merchant?
Bundled services	None: CAT does the SAQ and AoC. Pair it with an Approved Scanning Vendor if merchants need quarterly scans.	SecurityMetrics lists ASV scans in its program plans and 24/7 support by phone, chat and email. Ask which are included at your tier, and whether you can drop what you don't need.
Switching and renewals	Bulk CSV invites move merchants over at their renewal dates. From then on, annual renewals carry the prior year's answers forward.	Can we export every merchant's status, SAQ type, AoC and validation dates as CSV? What do our contract's notice and data-return terms say?

The full list of criteria is in our guide to choosing a merchant PCI compliance program.

Where Compliance Assessment Tool fits

CAT is a PCI DSS compliance engine for ISOs, acquirers and PayFacs, under your brand. Each merchant describes how they take payments; AI picks the right SAQ for each payment method (all nine merchant SAQs under PCI DSS v4.0.1), and every question is written in plain English for that business and payment method, with each answer shaping the next. The merchant reviews and confirms every answer, signs digitally, and gets the official PCI SSC SAQ and AoC, filled in. You launch through a white-label portal, an embeddable iframe, the REST API or an MCP server, and see your whole portfolio through a portfolio API, CSV export and signed webhooks. Annual renewals carry prior answers forward. Pricing is $25 per completed assessment.

When CAT is not the better fit: If you want one provider to bundle ASV scans, merchant support and the SAQ under a single contract, that is what SecurityMetrics' program lists and CAT does not do. You can also pair CAT with a scanning vendor.

Switching from SecurityMetrics

You don't have to move every merchant at once. Most of the work is lining up each merchant's move with its renewal date.

1. Read your current contract. Note the term, the notice period, the renewal date and what it says about returning your data.
2. Export your merchant list. For each merchant: merchant ID, legal and DBA name, contact email, payment channels, SAQ type, AoC date and validation expiry. A CSV is enough.
3. Keep existing AoCs valid until they expire. A merchant that validated last quarter does not need to start again. Keep its SAQ and AoC on file, and move it at its next annual renewal.
4. Re-validate at renewal. Invite merchants to CAT in renewal-date cohorts with a bulk CSV invite and branded emails, or build it into your portal with the iframe or API. Their next renewal on CAT carries this year's answers forward.
5. Board new merchants on CAT from day one, so the old program only has to cover merchants until their renewal.
6. Keep scanning covered. Merchants whose SAQ requires quarterly ASV scans still need them; keep your scanning vendor or choose one.
7. Tell your sponsor bank or acquirer, and agree how portfolio reporting will look during the overlap. CAT's CSV export and portfolio API cover the merchants it handles.
8. Update merchant communications and billing, including any program or non-compliance fee wording in your merchant agreement.

Common questions

Is Compliance Assessment Tool affiliated with SecurityMetrics?

No. Compliance Assessment Tool is an independent company with no affiliation with, or endorsement from, SecurityMetrics. SecurityMetrics is a trademark of its owner.

Does CAT include ASV scans, as SecurityMetrics plans do?

No. SecurityMetrics lists ASV scans in its PCI program plans. CAT does not provide scanning: it handles SAQ selection, the plain-English assessment and the signed SAQ and AoC. If your merchants' SAQs require quarterly external scans, pair CAT with an Approved Scanning Vendor.

How does CAT's pricing compare with SecurityMetrics?

CAT costs $25 per completed assessment, with a free sandbox. We do not publish other vendors' pricing; ask SecurityMetrics for a quote covering the same scope (merchant count, scans, support and branding) so you compare like with like.

Do merchants have to redo their SAQ when we change PCI vendors?

Not straight away. A merchant's current SAQ and Attestation of Compliance cover its current validation year, whichever tool produced them. The usual approach is to keep each AoC on file until it expires and move that merchant to the new program at its next annual renewal. Your acquirer sets the validation requirements, so confirm the plan with them.

Can we try Compliance Assessment Tool before we switch?

Yes. Sandbox credentials are free and issued as soon as you verify your email, and the sandbox runs the same API and engine as production. Run your own merchants' descriptions of how they take payments through it and compare the questions and documents side by side.

Also compared: ControlScan alternative · VikingCloud alternative · all PCI program alternatives

SecurityMetrics is a trademark of its owner. Compliance Assessment Tool is not affiliated with, endorsed by or sponsored by it, and names them only to describe their published offerings. Descriptions of other companies come from their own websites as of October 2026 and may have changed; confirm details with each vendor. Compliance Assessment Tool facilitates merchant PCI DSS self-assessment. It is not a Qualified Security Assessor and does not certify compliance; acquirers set each merchant's validation requirements.