Frequently asked questions

Izkuna runs fixed-scope web security audits for teams that need a clear, evidence-backed view of their external attack surface. We review public assets, web applications, APIs, and business logic, then deliver prioritized findings with practical remediation guidance. We are not a 24/7 SOC or an emergency incident-response provider.

Small and mid-sized companies with an internet-facing website, product, or API, especially teams without a dedicated security department. We work remotely with clients in Latin America, the United States, and Europe. If you handle customer data, payments, or user accounts, an independent review is useful even before an incident.

No. An audit is a point-in-time assessment of a defined scope; it reduces risk but cannot prove the absence of vulnerabilities or prevent future ones. New code, configuration changes, and new attack techniques can create new exposure. The report gives you a defensible priority order, and a retest confirms that specific fixes worked.

Book a free 30-minute diagnostic by WhatsApp or email contact@izkuna.site. We clarify your goals and scope, recommend a service, and send the quote and payment link. After payment, you sign the RoE, we confirm the change window, and the engagement is scheduled.

Start with the Exposure Snapshot (USD 300) if you want a low-cost view of what is publicly exposed. The Web Security Audit — Express (USD 600) adds an OWASP-aligned application review. The Deep audit (USD 1,200) covers APIs, JavaScript, and business logic. The Protected SMB Package (USD 1,000) combines Snapshot, Express, and retest. If you already have findings, choose Remediation Support (USD 400) or Retest & Remediation Verification (USD 200). Anti-Phishing Training (USD 300) is a two-hour session for your team.

Prices are fixed per service and shown in USD on the services page, with the current launch price and the regular price. Checkout charges the COP equivalent through Wompi, and the exact amount is shown before you pay. There is no hourly billing; if the scope changes, we agree on a revised quote before doing additional work.

Delivery is 3 days for the Exposure Snapshot, 5 days for Express, 10 days for Deep, 5 days for Remediation Support, and 2 days for a retest. Anti-Phishing Training is a single two-hour session. The clock starts once scope, signed RoE, access, and the change window are confirmed; we agree on the schedule before starting.

You receive a written deliverable in your client portal: an executive summary, technical findings with severity, evidence, and remediation recommendations, plus the agreed debrief. Each service lists its exact deliverables on the services page. Reports are written for both decision-makers and the engineers who will fix the issues.

The domains, applications, and APIs in scope; a technical contact; the preferred change window; and test accounts for each role if authenticated testing is included. We also need a signed Rules of Engagement before any testing. Source code is not required for our black-box web audits.

Yes, we can test production in a controlled, non-destructive way, inside the agreed window and scope. We rate-limit requests and avoid denial-of-service, destructive payloads, real data exfiltration, and persistence. When a test could affect availability, we recommend staging or schedule it with your team and ask you to keep backups and monitoring active.

The audit is an independent assessment; we do not silently change your production systems. Remediation Support gives your team hands-on guidance to close the findings. Retest & Remediation Verification re-tests the exact findings, validates the evidence, and issues a closure report so you can prove the fixes hold.

Every engagement starts with a signed Rules of Engagement that defines scope, window, allowed techniques, and emergency contacts. You confirm that you own or are authorized to test the targets and that your hosting provider has been notified where required. The RoE includes confidentiality terms, and we can sign a separate NDA if your legal team requires one.

We request only the access needed, use test accounts whenever possible, and avoid extracting real customer data. Findings and client information are confidential and are not published without written authorization. Personal data is handled under our Privacy Policy and Colombian Law 1581 of 2012; retention is limited to what the engagement and legal obligations require.

Under Colombian Law 1480 of 2011, you may withdraw within five business days of purchase if the service has not started: no signed RoE and no testing performed. Email contact@izkuna.site with the subject “Withdrawal” and your order number; refunds go to the original payment method. If a deliverable does not meet the agreed scope, you can request a review within 15 days of delivery.

We notify your primary contact as soon as the issue is confirmed, without waiting for the final report. The message includes enough detail to act: affected asset, impact, evidence, and a safe remediation direction. We exploit only as far as needed to prove impact and coordinate any disclosure with you.