OWASP Top 10

The OWASP Top 10 is a list of broad categories of web application security risk, published by the Open Worldwide Application Security Project and revised every few years from contributed data and a practitioner survey. Each entry describes a class of weakness rather than an individual bug: broken access control, cryptographic failures, injection and the others each gather up many distinct defects that go wrong in the same way. The 2021 edition placed broken access control first, which surprised nobody who had spent time testing authorisation by hand.

Its commercial usefulness is as a shared reference. It gives a buyer, a developer and a tester the same names for the same problems, and it is the vocabulary most security questionnaires are written in. Its limit is stated plainly by OWASP: this is an awareness document, not a standard and not a checklist. An application can contain nothing from the list and still be insecure, because the list records what is commonly found across many organisations rather than what is possible against your particular design.

How the list is used inside an assessment

• As a coverage frame, so a review has an agreed shape and no large category gets skipped by accident or by preference.
• As a reporting structure, because a finding filed under a heading a developer already recognises gets acted on faster than one explained from first principles.
• Alongside the OWASP Application Security Verification Standard where a requirements-level document is wanted, since ASVS is written as testable requirements and this list deliberately is not.
• With business logic examined separately. Flaws in what your application is meant to permit have no category here, and they are found by reasoning about the workflow rather than by pattern matching.

Clearing the Top 10 is a floor rather than a finish line, and any supplier offering it as a certificate is selling something OWASP does not issue.