Choose a Shomar plan without starting from a blank form.
Compare tiers, check your plan fit, see what drives the quote, and send a pre-scoped buying brief when your team is ready.
Launch an active workspace in 60s with a 7-day free trial (3 users, 3 projects, 100 scans, 2 VAPTs).
Official executive rate card, allowances, modular schedule & client order form (PDF).
Review separated allowances, modular bundle savings, and add-on pricing.
Email the plan, requirements, and timeline directly to the account team.
Pick a plan before talking to sales.
You aren't buying scanner seats. You are buying verified outcomes.
Every tier is structured to deliver risk assurance to the CISO, shipping velocity to the CTO, frictionless adoption to engineering, continuous evidence to compliance, and boardroom confidence to executive leadership.
Clear starting points, with room for custom scope.
Each tier is a buying starting point. The final quote adjusts only for usage, deployment, evidence, VAPT, support, and implementation scope.
Entry package measuring scans, projects, users, and VAPT assessments separately with full baseline compliance.
- 3 Users (Admin + Security)
- 3 Connected Projects
- 100 Standard Scans / month
- 2 Automated VAPT assessments / quarter
- 1 Concurrent scan job
- 1 Compliance framework
- 5 GB Evidence storage
- 90 days scan-history retention
- Email support
For scaling fintechs needing higher scan concurrency, multi-framework coverage, and regular automated VAPT retests.
- 10 Users (Admin + Auditor + Devs)
- 15 Connected Projects
- 500 Standard Scans / month
- 8 Automated VAPT assessments / quarter
- 3 Concurrent scan jobs
- 3 Compliance frameworks
- 25 GB Evidence storage
- 12 months scan-history retention
- Priority email support
Regulated finance baseline with large concurrency, 6 frameworks, 100 GB storage, and dedicated onboarding assistance.
- 25 Users (Admin, Auditor, Execs)
- 50 Connected Projects
- 1,500 Standard Scans / month
- 20 Automated VAPT assessments / quarter
- 8 Concurrent scan jobs
- 6 Compliance frameworks
- 100 GB Evidence storage
- 24 months scan-history retention
- Priority + onboarding support
Bespoke scope for large institutions needing sovereign enclaves, customer workers, custom scan metering, and 24/7 SLAs.
- Custom Users & Projects capacity
- Custom Standard scan runs / month
- Custom Automated VAPT assessments
- Custom Concurrent scan jobs
- Custom Compliance frameworks
- Custom Evidence storage & retention
- Sovereign / on-prem option
- SLA-based dedicated support
Usage allowances, modular purchasing, and transparent add-on pricing.
Every element of our commercials is structured for transparency: distinct allowances for scans, projects, users, and VAPTs, modular flexibility for teams with existing tools, and clear expansion add-ons.
Usage Allowance Matrix
The key change we make is to measure scans, projects, users, and VAPT assessments separately across all tiers.
| Usage allowance | Starter | Growth | Business | Enterprise |
|---|---|---|---|---|
UsersNamed member accounts with role-based access control | 3 | 10 | 25 | Custom |
ProjectsApplications, repositories, or API assessment workspaces | 3 | 15 | 50 | Custom |
Standard scan runs/monthSAST, SCA, secrets, and PCI ASV readiness scans against authorized targets | 100 | 500 | 1,500 | Custom |
Automated VAPT assessments/quarterBounded automated web app, API, or IP penetration tests | 2 | 8 | 20 | Custom |
Concurrent scan jobsParallel execution slots across pipelines and workers | 1 | 3 | 8 | Custom |
Compliance frameworksIndependently maintained framework assessments & controls | 1 | 3 | 6 | Custom |
Evidence storageCryptographically verifiable regulatory audit evidence vault | 5 GB | 25 GB | 100 GB | Custom |
Scan-history retentionLongitudinal vulnerability history and auditor trend lines | 90 days | 12 months | 24 months | Custom |
Deployment ModelDedicated Enclave air-gap appliance fee: +$15,000 / ₦22,500,000 per year (zero data egress) | Cloud SaaS | Cloud SaaS | Cloud SaaS (Enclave optional) | Cloud SaaS or Dedicated Enclave |
SupportTechnical escalation and compliance engineer response guarantee | Priority email | Priority + onboarding | SLA-based |
Modular Purchasing & Full-Platform Bundles
We retain modular purchasing. This is particularly important for fintechs that already have some security tools.
| Module | Starter | Growth | Business |
|---|---|---|---|
VAPT Automated pentesting, exploit validation & retest reports | $1,800/yr | $3,600/yr | $8,000/yr |
SecOps / DevSecOps Source code SAST, SCA dependencies, secrets & PCI ASV readiness | $2,000/yr | $4,500/yr | $9,000/yr |
Compliance 16+ Pan-African & Global frameworks, evidence vault & auditor portal | $1,800/yr | $5,000/yr | $13,000/yr |
| Combined module value | $5,600 | $13,100 | $30,000 |
Full-platform bundleDiscounted | $4,600 Save $1,000 | $11,550 Save $1,550 | $27,000 Save $3,000 |
4. Recommended Add-on Pricing
Capacity expansions, additional compliance frameworks, premium onboarding, and manual penetration testing.
| Add-on | Proposed annual price | Commercial Option |
|---|---|---|
Dedicated Sovereign Enclave (Air-Gapped Appliance) 100% disconnected on-premises / private VPC Kubernetes packaging, offline cryptographic licensing, local MinIO evidence vault & dedicated infrastructure pod. | $15,000/ year | Include with Plan |
5 additional projects Expand capacity by 5 applications, repositories, or assessment workspaces with asset-mapping policy. | $600/ year | Include with Plan |
5 additional users 5 additional user seats across admin, security engineer, developer, or auditor roles. | $300/ year | Include with Plan |
250 extra standard scans/month 250 additional completed standard scan executions per month across SAST, SCA, and secrets. | $1,200/ year | Include with Plan |
4 additional automated VAPT assessments/quarter 4 additional bounded automated penetration testing assessments per quarter with retest reports. | $1,600/ year | Include with Plan |
Additional compliance framework One independently maintained framework assessment and its associated evidence and control workflows. | $1,500–$3,000/ year | Include with Plan |
Premium onboarding Dedicated security engineer onboarding, policy mapping, framework setup, and auditor prep. | $1,000–$3,000one-time | Include with Plan |
Manual penetration testing Human-led deep CREST/OSCP penetration testing with manual exploit validation and signed attestation. | Separate scoped quotationbespoke quote | Request Quoted Scope |
Licensing Definitions & Internal Metering Principle
I would establish the following licensing definitions:
One application, repository, API service, or managed security assessment workspace, with a consistent asset-mapping policy.
One completed scan execution against an authorized configured target, with resource-intensive scan types separately metered.
One bounded automated assessment of an authorized web application, API, or IP scope, including findings and an automated report.
One independently maintained framework assessment and its associated evidence and control workflows.
A repository secrets scan should not necessarily consume the same credits as a lengthy authenticated DAST assessment. Internally, you should meter compute time, target size, and scan type even if customers see simplified allowances.
5. Deployment Architecture: Cloud SaaS vs Dedicated Sovereign Enclave
We separate our pricing model between multi-tenant Cloud SaaS and air-gapped Dedicated Enclaves to reflect the infrastructure, container packaging, offline cryptographic validation, and priority engineering pods required for sovereign deployments.
Cloud SaaS Offering
Multi-Tenant Zero-Trust CloudDedicated Sovereign Enclave
100% Disconnected Air-Gapped Appliance6. Free-trial limits
Standardized sandbox boundaries for the 7-day evaluation environment.
Use these rules to choose the right tier.
The goal is to help the buyer decide before speaking with sales, then use the conversation only to confirm commercial and delivery scope.
Early team that needs basic scans, an industry-applicable baseline framework, MFA/SSO, basic reports, and Shomar-managed evidence.
3 users, 3 projects, 100 standard scan runs/mo, 2 automated VAPT assessments/quarter, 1 concurrent scan job, 1 compliance framework, 5 GB storage, 90 days retention, Email support.
Choose Growth when higher scan volume, multi-framework coverage, or repeatable automated VAPT retests matter.
Scaling fintech or payments team that needs more scan volume, CI/CD, industry baseline mapping, and repeatable evidence workflows.
10 users, 15 projects, 500 standard scan runs/mo, 8 automated VAPT assessments/quarter, 3 concurrent scan jobs, 3 compliance frameworks, 25 GB storage, 12 months retention, Priority email support.
Choose Business when 25+ seats, 50 projects, 1,500 scans, 6 frameworks, or onboarding support are required.
MFB, finance house, or regulated fintech with stronger admin governance, large concurrency, and audit reporting needs.
25 users, 50 projects, 1,500 standard scan runs/mo, 20 automated VAPT assessments/quarter, 8 concurrent scan jobs, 6 compliance frameworks, 100 GB storage, 24 months retention, Priority + onboarding support.
Choose Enterprise when private workers, dedicated tenancy, sovereign deployment, or custom allowances are required.
Bank, government, or large regulated organisation with custom deployment, SLA, or private execution requirements.
Custom users/projects/scans/VAPTs, controlled workers, dedicated tenant, SLA, CSM, custom frameworks, sovereign deployment.
Stay here when procurement, regulator, or infrastructure constraints need a custom commercial path.
What changes the final commercial number.
Shomar avoids public fixed prices because regulated deployments differ. These are the variables that affect the quote, so prospects know what matters before a call.
Licence tier and included users/projects
Expected scan volume and scan types
External evidence imports: SARIF, CodeQL, GitHub Advanced Security, or CI-generated findings
Compliance bundle: NDPR/NDPA, PCI DSS, CBN, NPS, VASP, MFB, finance-house, or custom frameworks
VAPT allowance: light, basic, larger, dedicated, or premium
Evidence storage: Shomar-managed, customer-owned, or external-link evidence
Deployment: SaaS, customer-controlled worker, dedicated tenant, sovereign/on-prem option
Onboarding, support, SLA, and customer success expectations
Product access
The selected Shomar licence tier, enabled modules, and feature flags.
Implementation path
Onboarding, bundle setup, evidence workflow, integrations, and handover scope.
Operational delivery
Support level, VAPT allowance, scan volume, worker model, and service commitments.
Expansion logic
How the organisation can add projects, frameworks, regions, or private execution later.
Start simple, expand by real usage.
Best for teams that know their sector: banking, fintech, MFB, finance house, or VASP.
Add PCI, CBN, NPS, ISO 27001, regional bundles, or custom frameworks when needed.
Use private workers, dedicated tenancy, premium VAPT, SLA, and sovereign options for sensitive organisations.
Send a scoped brief instead of filling another long form.
Include your selected plan, organisation type, users/projects, compliance scope, evidence or deployment requirements, and buying timeline. The account manager can respond with the right commercial path.