Problem
Offensive security tooling is priced for a Western enterprise. The number that shows up in comparison articles runs past thirty-five thousand dollars a year. An African SME cannot budget for that, and cannot borrow the consultant either, so it goes uncovered by default.
The tooling that does fit the budget was not built for the threats. EcoCash and M-Pesa fraud, USSD session hijacking, SIM-swap takeovers and invoice fraud against African suppliers are the cases that actually land, and a generic scanner has no model of any of them. It will happily report a missing header and stay quiet on the payment rail fraud.
Process
Guardian was formerly Sentari, and it was built Africa-first rather than adapted afterwards. Eleven-plus scan modules run in parallel against the target, covering DNS, subdomain enumeration, open ports, technology fingerprinting, TLS, response headers, credential leaks, social OSINT, threat intelligence, African threat patterns and forum monitoring. An email security suite checks SPF, DMARC, DKIM, BIMI and MTA-STS alongside a spoofing risk calculator, and VirusTotal supplies domain reputation. Eleven modules in parallel means a scan that took minutes now returns while a founder is still on the phone about it.
Findings are scored zero to one hundred and then reasoned over by a multi-model ensemble across Groq, OpenRouter, HuggingFace and Ollama. The point is attack path, not a vulnerability list: which of these findings chains into a breach of something that matters here. Supabase carries the database, auth and row level security; the front end is Next.js 16 with React 19 and Tailwind v4.
The compliance layer is the second half. Findings map against POPIA, NDPA, the Kenya DPA, GDPR, ISO 27001 and Zimbabwe's own Data Protection Act, so the output reads as obligations the business has rather than preferences a tool has.
The one thing that is not negotiable is authorization. Passive checks run by default. Active validation is triple-gated behind a global kill flag, verified domain ownership and a role check, because a security tool that will attack a domain you do not own is a liability, not a product.
Result
In beta with every feature unlocked while feedback is collected, three scans a month on the free tier and paid tiers announced after it. It is public on GitHub so the scan modules can be read and argued with.