Shomar

Shomar is a security scanning and continuous-compliance platform for regulated African organisations that need security operations tied directly to compliance evidence and audit readiness.

Key capabilities include:

• Application security scanning with SAST/DAST to surface and track software security findings.
• Live system testing, plus dependency and container risk coverage to help teams monitor risk across modern application stacks.
• Compliance framework bundles that start with a Global Cloud and Security Baseline (ISO 27001, SOC 2, PCI DSS 4.0) and extend to pan-African directives and regional profiles, including Nigerian sector-specific bundles (for example, CBN, NDIC, BOFIA, NDPR/NDPA, NIBSS, NPS, NITDA, SEC/ARIP).
• Compliance operations such as gap tracking, evidence management (including external-link evidence), and audit-workpaper exports to support reviews and assessments.

Available on Web via a browser-based workspace. Shomar offers a time-limited trial (10 working days or 14 calendar days), then requires a paid licence to continue using subscribed capabilities.

It targets banks, fintechs, PSPs and payment gateways, remittance and cross-border payments teams, crypto/VASP businesses, government teams, agencies, and security-led organisations. Licence tiers can support compliance-only, security-only, or mixed access, and teams can choose SaaS scanning or dedicated/customer-controlled worker patterns for sensitive environments.

Notable in the African context, the platform packages security scanning with region-specific compliance bundles (including Nigeria-focused financial-sector requirements and expansion profiles for Ghana, Kenya, South Africa, Senegal, and Rwanda), while clearly stating it supports audit readiness but does not provide legal, regulatory, or audit-attestation advice.