OWASP stands for Open Worldwide Application Security Project. The nonprofit foundation and its community publish freely available standards, testing guides, tools and implementation guidance for secure software. Its best-known publication is the OWASP Top 10. OWASP covers considerably more than this list and is neither a software vendor nor a certification authority.
What is the OWASP Top 10?
The OWASP Top 10 is an awareness document describing especially important web-application risks. It helps development, management and procurement discuss recurring problem areas in a shared language. Categories are informed by submitted vulnerability data and community surveys. They describe classes of risk rather than ten individual technical vulnerabilities.
Which risks are in the OWASP Top 10:2025?
| Category | Core issue |
|---|---|
| A01 Broken Access Control | Users can act beyond their intended permissions. |
| A02 Security Misconfiguration | Unsafe defaults, unnecessary features or incorrect configuration expose systems. |
| A03 Software Supply Chain Failures | Dependencies, build processes and supply chains are insufficiently protected. |
| A04 Cryptographic Failures | Sensitive data is exposed through missing or incorrectly applied cryptography. |
| A05 Injection | Untrusted input alters commands or queries, as in SQL injection. |
| A06 Insecure Design | Security requirements and controls are absent from the design itself. |
| A07 Authentication Failures | Identities, authentication or sessions are inadequately protected. |
| A08 Software or Data Integrity Failures | Software, updates or data are trusted without sufficient integrity checks. |
| A09 Security Logging and Alerting Failures | Missing events or response allow attacks to remain undetected. |
| A10 Mishandling of Exceptional Conditions | Errors and unexpected conditions are handled insecurely. |
The order is not a priority list for every individual application. An internal administrative tool has different attack paths and consequences from a public online shop. Teams must add their own context, relevant threats and business impact.
Which other OWASP projects matter?
- Application Security Verification Standard (ASVS):
Structured, verifiable requirements for development, testing and procurement. - Web Security Testing Guide (WSTG):
Methods and test cases for practical web-application security assessments. - Cheat Sheet Series:
Focused implementation guidance for subjects such as authentication, uploads and input validation. - Software Assurance Maturity Model (SAMM):
A model for assessing and incrementally improving an application-security program. - API Security Top 10:
An awareness list for recurring risks in modern application programming interfaces.
How are OWASP resources used?
The Top 10 is suitable for awareness and education. Specific security requirements can be derived from ASVS and referenced with their version in tasks or contracts. WSTG helps testers plan an assessment, while cheat sheets give developers practical implementation advice. Together, these resources support requirements, design, development, threat modeling and testing rather than only the final assessment.
What can OWASP not provide?
Checking ten categories does not prove that an application is secure. Business logic, specialized technology, configuration mistakes and new attack techniques may sit outside a Top 10 list. A penetration test limited to ten headings is equally incomplete. OWASP provides strong starting points; it does not replace scope, contextual risk assessment or expert testing.
Thank you for your feedback! We will review it and optimize this content.