Published · By the Aesparrow Security Research Team
Short answer
The OWASP Top 10 is a regularly updated list, published by the Open Worldwide Application Security Project (OWASP), of the ten most critical security risks to web applications — including broken access control, cryptographic failures, injection, insecure design and security misconfiguration. Organisations use it as a minimum baseline for secure development and penetration testing.
What are the OWASP Top 10 categories?
- Broken access control: users acting outside their permissions, e.g. IDOR.
- Cryptographic failures: weak or missing encryption of sensitive data.
- Injection: SQL, OS command and other injection, including XSS.
- Insecure design: missing security controls at the design stage.
- Security misconfiguration: default settings, verbose errors, open cloud storage.
- Vulnerable and outdated components: libraries with known CVEs — addressed by SCA.
- Identification and authentication failures: weak login, session and MFA controls.
- Software and data integrity failures: untrusted updates, CI/CD and deserialisation.
- Security logging and monitoring failures: attacks go undetected.
- Server-side request forgery (SSRF): the server is tricked into making internal requests.
Are there OWASP Top 10 lists for APIs and mobile apps?
Yes. The OWASP API Security Top 10 covers API-specific risks such as broken object-level authorisation, and the OWASP Mobile Top 10 with the MASVS standard covers Android and iOS risks such as insecure data storage and insufficient cryptography.
FAQ
Frequently Asked Questions
Clear answers about what we do — and what we don’t. If you have any other questions, feel free to reach out to our team.
Is OWASP Top 10 compliance a certification?
No. The OWASP Top 10 is an awareness document, not a certification. A penetration test report can show that an application was tested against it; OWASP ASVS provides a more formal verification standard.
How often is the OWASP Top 10 updated?
Roughly every three to four years, based on data contributed by security firms and practitioners.