Izkuna
Based in Colombia · Serving globally IZK / 2026

Web security audits for growing businesses.

OWASP-aligned assessments. Signed RoE. Executive + technical reports. No jargon.

Remote assessments for web applications and public infrastructure.

View services Book a free 30-min diagnostic

Methodology references

IZK / METHOD

01
OWASP WSTG
02
OWASP ASVS
03
CVSS 4.0
04
CISA KEV

Foundation / 00

Why trust Izkuna

A disciplined, documented process from authorization to closure.

01

Foundation / 00

OWASP WSTG aligned

Testing follows the OWASP Web Security Testing Guide.

02

Foundation / 00

Signed RoE before any test

Scope, window, and authorization are agreed in writing first.

03

Foundation / 00

Executive + technical reports

Business impact for leadership, evidence for engineers.

04

Foundation / 00

eJPT certified

OSCP in progress. Continuous hands-on practice.

How an engagement works

Four steps, no surprises.

  1. 01

    Authorize

    We sign the RoE and confirm scope, window, and contacts.

  2. 02

    Assess

    Testing runs within the agreed scope and change window.

  3. 03

    Report

    You receive an executive summary and a technical report.

  4. 04

    Close

    We debrief, support remediation, and verify fixes.

01 — Core assessments

Services

Eight engagements. Published prices in USD; the infrastructure audit is quoted in writing.

IZK / CATALOG · 08

IZK-01 Start here

Exposure Snapshot

A focused review of your public web footprint and exposed assets.

  • Public attack-surface review
  • Exposed asset inventory
  • Executive report with priorities

$300 USD

$500 USD after launch

Get started
IZK-02 Most popular

Web Security Audit — Express

OWASP-aligned assessment with executive and technical reports.

  • Secure headers and WAF review
  • Route and technology mapping
  • Executive + technical reports
  • 30-minute debrief

$600 USD

$900 USD after launch

Get started
IZK-03 Delivery · 10 days

Web Security Audit — Deep

Deeper testing of APIs, JavaScript, and business logic.

  • Express audit included
  • API and endpoint review
  • JavaScript and business-logic review
  • 60-minute debrief

$1,200 USD

$1,800 USD after launch

Get started
IZK-08

Infrastructure Security Audit

A focused review of cloud configuration, identity, storage, and exposed services.

Cloud configuration and identity review · Storage, logging, and network exposure · Prioritized hardening roadmap

Quoted

Written quote before signing

Request a quote

Add-ons

Support & verification

Every engagement starts with a signed RoE and a defined scope.

IZK-04

$200 USD

Retest & Remediation Verification

Verify that remediation actually closed the findings.

Re-test of remediated findings · Evidence validation · Closure report

2 days Get started
IZK-05

$300 USD

Anti-Phishing Training

A practical workshop to reduce phishing risk across your team.

Live 2-hour workshop · Real-world phishing scenarios · Team checklist and materials

1 session (2h) Get started
IZK-06

$400 USD

Remediation Support

Hands-on guidance to close findings with your engineering team.

Technical working sessions · Fix prioritization support · Practical closure guidance

5 days Get started
IZK-07

$1,000 USD

Protected SMB Package

Best value

Snapshot, Express audit, and retest in one engagement.

Exposure Snapshot · Web Security Audit — Express · Retest & verification · 60-minute closure meeting

7 days Get started

Not sure where to start?

The usual path: snapshot, Express audit, then deeper testing only if the scope requires it.

  1. 01Exposure Snapshot
  2. 02Web Security Audit — Express
  3. 03Web Security Audit — Deep

02 — Specialized engagements

When the audit is not enough

Focused extensions for teams that need code, cloud, compliance, or AI security reviewed.

Beyond the fixed scope

These are scoped engagements, not fixed-price packages. The core audits remain the entry point.

Discuss scope
  1. P.01 Scoped after diagnostic

    Secure Code Review

    Source-assisted review of authentication, authorization, sessions, and data flows in web applications and APIs.

    • Authorization and session logic
    • Injection, file handling, and secrets
    • Findings mapped to the audit report
  2. P.02 Scoped after diagnostic

    Cloud & Infrastructure Review

    A focused review of public cloud configuration, identity, storage, and exposed services around your web stack.

    • IAM and privilege boundaries
    • Storage, logging, and network exposure
    • Prioritized hardening roadmap
  3. P.03 Scoped after diagnostic

    Compliance Readiness

    Gap analysis and evidence mapping for ISO 27001, SOC 2, or PCI DSS, built on the findings of your web audit.

    • Control gap analysis
    • Evidence and policy mapping
    • Readiness roadmap for leadership
  4. P.04 Scoped after diagnostic

    AI & LLM Application Security

    Security review of AI features: prompt injection, data exposure, tool permissions, and trust boundaries.

    • Prompt injection and output handling
    • Data leakage and tenant isolation
    • Tool, agent, and API permissions

03 — Open source

Built in the open

Small tools from our audit workflow, released on GitHub as they mature.

Published repositories are linked below. The rest are working names.

More repositories soon
Izkuna lab Project index
  1. 01

    Xammu

    Published

    Behavioral profiler for perimeter defenses: sends inert probes through one authorized egress and publishes evidence-backed findings.

    Go / CLI / Authorized testing

  2. 02

    HeaderScope

    In development

    HTTP security header and CSP analyzer for web applications.

    Python / CLI / Web security

  3. 03

    RoE Kit

    Planned

    Rules of Engagement and scope templates for authorized web audits.

    Templates / JSON / Audit ops

  4. 04

    Report Forge

    Research

    Evidence-first report generator for executive and technical deliverables.

    Python / Markdown / Reports

04 — About

Built by professionals

“Clear evidence. Honest priorities. No theater.”

Izkuna is led by Luis Felipe, eJPT certified, with OSCP in progress. The focus is simple: clear evidence, honest priorities, and reports your team can act on.

Clarity

Findings explain impact and next steps in plain language.

Confidentiality

Client data and findings stay private.

Discipline

Signed authorization and documented testing before any action.

About Izkuna

05 — Contact

Reach the right desk.

Two direct channels for partners and institutions.

  • Business relations

    Negotiations, partnerships, proposals, corporate clients, and business opportunities.

    business@izkuna.site

  • Institutional relations

    Public contact, general inquiries, vendors, collaborators, and external communications.

    contact@izkuna.site
Message us on WhatsApp

Next step

Know exactly what to fix first.

Start with a 30-minute diagnostic call. No pressure, no jargon.

Book a free 30-min diagnostic View services

Display only. Wompi charges in COP; PayPal charges in USD.