Glossary · Testing and assessment
The OWASP Top 10 is an awareness list, and a test plan needs more than ten lines.
A ranked list of the most critical web application security risk categories, published by the OWASP Foundation and refreshed every few years from community and industry data.
Back to the glossary01 · In plain words
In plain words
A ranked list of the most critical web application security risk categories, published by the OWASP Foundation and refreshed every few years from community and industry data.
The OWASP Foundation is a non-profit community that publishes free application security material. Its Top 10 names ten broad risk categories, such as broken access control, injection and cryptographic failures, in order of concern. Each category is a family of weaknesses, not a single bug.
Spelled out: Open Worldwide Application Security Project Top 10.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
The list has become a shared vocabulary. Enterprise buyers ask whether your application was tested "against the OWASP Top 10", developers use it to pick training topics, and testers group findings under its headings so a non-specialist can read a report. The catch is that OWASP itself presents it as an awareness document. Ten categories cannot describe every check a serious test performs, and a report that only ticks ten boxes may skip business-logic flaws that are specific to your product. Knowing that difference lets a founder answer a questionnaire honestly and still buy a test that goes deeper.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Security questionnaires
- A line asking whether the product is tested for, or protected against, the Top 10 categories.
- Penetration test reports
- Findings tagged with the category they fall under, so readers can see the spread of risk.
- Secure development policy
- Training and code review checklists that name the categories developers must know.
- PCI DSS assessments
- Card-data environments that develop software are expected to address common coding weaknesses; many teams use the list as their reference.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: an edtech platform answering a school group's questionnaire
A learning platform selling to a chain of schools is asked: "Has the application been tested against the OWASP Top 10?" Its last test report grouped findings by category, so the answer is yes, with the report date. The reviewer then asks about parent and teacher roles. The team realises the test never checked whether a teacher could open another school's records, a business-logic question. They add role-by-role access tests to the next engagement and describe the scope in the answer rather than leaning on the list alone.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- OWASP ASVS
- The Application Security Verification Standard is a detailed list of testable requirements in levels. The Top 10 raises awareness; ASVS is what you test against.
- OWASP API Security Top 10
- A separate list for APIs, with its own categories. A web Top 10 claim does not cover an API-first product.
- CVSS
- A severity score for one vulnerability. The Top 10 groups kinds of weakness; it does not score them.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Ask any tester which methodology sits beneath the Top 10 headings, for example the OWASP Web Security Testing Guide or ASVS.
- Check that business-logic and role-based access tests are in scope, since no list can name them for your product.
- Map the categories to your secure development training so developers see them before testers do.
- Note the edition of the list your report refers to, and update references when OWASP publishes a new one.
- GuideWeb application security testingManual and tool-assisted testing of web apps and APIs.
- GuideSecure developmentFrom requirements to code review and testing.
- GuidePenetration testing for SOC 2What auditors look for in a test report, and what they ignore.
Sources: OWASP Top 10 project pages (owasp.org); OWASP Application Security Verification Standard project page; OWASP Web Security Testing Guide; OWASP API Security Top 10 project page.
Questions about OWASP Top 10
Which edition of the OWASP Top 10 is current?
Check owasp.org; the list is revised every few years.
OWASP revises the list every few years from contributed data and a community survey. The 2021 edition was followed by a 2025 edition. Always cite the edition your test used, because category names and order change between versions.
Is "OWASP Top 10 compliant" a real status?
No. Nobody certifies against it.
The list is not a standard with a pass mark, and OWASP does not certify products. What you can truthfully say is that a named tester assessed the application, on a stated date, with the categories covered in scope, and that findings were fixed and retested.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.