01
OWASP WSTG aligned
Testing follows the OWASP Web Security Testing Guide.
Based in Colombia · Serving globally
IZK / 2026
Web security audits for growing businesses.
OWASP-aligned assessments. Signed RoE. Executive + technical reports. No jargon.
Remote assessments for web applications and public infrastructure.
Methodology references
- 01 OWASP WSTG
- 02 OWASP ASVS
- 03 CVSS 4.0
- 04 CISA KEV
Why trust Izkuna
A disciplined, documented process from authorization to closure.
Foundation / 00
02
Signed RoE before any test
Scope, window, and authorization are agreed in writing first.
03
Executive + technical reports
Business impact for leadership, evidence for engineers.
04
eJPT certified
OSCP in progress. Continuous hands-on practice.
How an engagement works
Four steps, no surprises.
-
01
Authorize
We sign the RoE and confirm scope, window, and contacts.
-
02
Assess
Testing runs within the agreed scope and change window.
-
03
Report
You receive an executive summary and a technical report.
-
04
Close
We debrief, support remediation, and verify fixes.
01 — Core assessments
Services
Seven fixed-scope engagements. Prices in USD.
No.
Engagement
Delivery
Fee
-
01
Exposure Snapshot
Start here
$300 USD
A focused review of your public web footprint and exposed assets.
- Public attack-surface review
- Exposed asset inventory
- Executive report with priorities
$300 USD
$500 USD after launch
-
02
Web Security Audit — Express
Most popular
$600 USD
OWASP-aligned assessment with executive and technical reports.
- Secure headers and WAF review
- Route and technology mapping
- Executive + technical reports
- 30-minute debrief
$600 USD
$900 USD after launch
-
03
Web Security Audit — Deep
$1,200 USD
Deeper testing of APIs, JavaScript, and business logic.
- Express audit included
- API and endpoint review
- JavaScript and business-logic review
- 60-minute debrief
$1,200 USD
$1,800 USD after launch
Add-ons
Support & verification
Every engagement starts with a signed RoE and a defined scope.
-
04
Retest & Remediation Verification
$200 USD
Verify that remediation actually closed the findings.
Re-test of remediated findings · Evidence validation · Closure report
$200 USD
-
05
Anti-Phishing Training
$300 USD
A practical workshop to reduce phishing risk across your team.
Live 2-hour workshop · Real-world phishing scenarios · Team checklist and materials
$300 USD
-
06
Remediation Support
$400 USD
Hands-on guidance to close findings with your engineering team.
Technical working sessions · Fix prioritization support · Practical closure guidance
$400 USD
-
07
Protected SMB Package
Best value$1,000 USD
Snapshot, Express audit, and retest in one engagement.
Exposure Snapshot · Web Security Audit — Express · Retest & verification · 60-minute closure meeting
$1,000 USD
Not sure where to start?
The usual path: snapshot, Express audit, then deeper testing only if the scope requires it.
- 01Exposure Snapshot
- 02Web Security Audit — Express
- 03Web Security Audit — Deep
02 — Specialized engagements
When the audit is not enough
Focused extensions for teams that need code, cloud, compliance, or AI security reviewed.
Beyond the fixed scope
These are scoped engagements, not fixed-price packages. The seven core audits remain the entry point.
-
P.01 Scoped after diagnostic
Secure Code Review
Source-assisted review of authentication, authorization, sessions, and data flows in web applications and APIs.
- Authorization and session logic
- Injection, file handling, and secrets
- Findings mapped to the audit report
-
P.02 Scoped after diagnostic
Cloud & Infrastructure Review
A focused review of public cloud configuration, identity, storage, and exposed services around your web stack.
- IAM and privilege boundaries
- Storage, logging, and network exposure
- Prioritized hardening roadmap
-
P.03 Scoped after diagnostic
Compliance Readiness
Gap analysis and evidence mapping for ISO 27001, SOC 2, or PCI DSS, built on the findings of your web audit.
- Control gap analysis
- Evidence and policy mapping
- Readiness roadmap for leadership
-
P.04 Scoped after diagnostic
AI & LLM Application Security
Security review of AI features: prompt injection, data exposure, tool permissions, and trust boundaries.
- Prompt injection and output handling
- Data leakage and tenant isolation
- Tool, agent, and API permissions
03 — Open source
Built in the open
Small tools from our audit workflow, released on GitHub as they mature.
Working names. Repositories will be published when they are ready.
GitHub repositories coming soon
Izkuna lab
Project index
-
01
HeaderScope
In developmentHTTP security header and CSP analyzer for web applications.
Python / CLI / Web security
-
02
RoE Kit
PlannedRules of Engagement and scope templates for authorized web audits.
Templates / JSON / Audit ops
-
03
Report Forge
ResearchEvidence-first report generator for executive and technical deliverables.
Python / Markdown / Reports
Team photo coming soon
The Izkuna team
Web security audits
04 — About
Built by professionals
“Clear evidence. Honest priorities. No theater.”
Izkuna is led by Luis Felipe, eJPT certified, with OSCP in progress. The focus is simple: clear evidence, honest priorities, and reports your team can act on.
Clarity
Findings explain impact and next steps in plain language.
Confidentiality
Client data and findings stay private.
Discipline
Signed authorization and documented testing before any action.
05 — Contact
Reach the right desk.
Three direct channels for direction, partners, and institutions.
-
Direction & founder
Executive direction, founder decisions, strategic matters, and institutional representation.
founder.kispat.izkuna@izkuna.site -
Business relations
Negotiations, partnerships, proposals, corporate clients, and business opportunities.
business@izkuna.site -
Institutional relations
Public contact, general inquiries, vendors, collaborators, and external communications.
contact@izkuna.site
Next step
Know exactly what to fix first.
Start with a 30-minute diagnostic call. No pressure, no jargon.