Framework / guidance
Global
OWASP Top 10
OWASP Top 10: The Ten Most Critical Web Application Security Risks
The OWASP Top 10 is a free, community-built list of the ten most critical security risks to web applications, published by the OWASP Foundation. The 2025 edition adds Software Supply Chain Failures and Mishandling of Exceptional Conditions, and keeps Broken Access Control at number one. It is an awareness document, not a full standard, but customers, auditors, PCI DSS and penetration testers widely use it as a baseline for secure development.
Voluntary: Voluntary awareness standard; referenced by PCI DSS, customers and pen testers
Quick facts
- What it covers
- Common web application weaknesses, from access control and misconfiguration to supply chain, cryptography, injection, design, authentication, integrity, logging and error handling.
- Who needs it
- Web and SaaS development teams
- Why it matters
- It is the shared baseline developers, testers and customers use to talk about web application security, and most security questionnaires ask how you address it.
- Key requirements
- A01 Broken Access Control
- A02 Security Misconfiguration
- A03 Software Supply Chain Failures
- A04 Cryptographic Failures
- A05 Injection
- A06 Insecure Design
- A07 Authentication Failures
- A08 Software or Data Integrity Failures
- A09 Security Logging and Alerting Failures
- A10 Mishandling of Exceptional Conditions
- Where it applies
- Global
- Category
- Secure Software Development