The OWASP Top 10 is a regularly updated, community-driven list of the most critical security risks to web applications, published by the Open Worldwide Application Security Project. It is the industry's common reference point for application risk, but it is an awareness document, not a testing checklist.
The Top 10 raises awareness of the categories of risk that most commonly and seriously affect web apps, so teams and stakeholders share a vocabulary. It is deliberately not a complete standard or a test plan: for systematic coverage you use the OWASP Web Security Testing Guide (WSTG) for test cases and the OWASP Application Security Verification Standard (ASVS) for control-level requirements. The Top 10 frames risk; WSTG and ASVS drive the actual testing.
The current version is the OWASP Top 10 2025. If you still see references to 2021, they are out of date. The 2025 categories are: A01 Broken Access Control, A02 Security Misconfiguration, A03 Software Supply Chain Failures, A04 Cryptographic Failures, A05 Injection, A06 Insecure Design, A07 Authentication Failures, A08 Software or Data Integrity Failures, A09 Security Logging and Alerting Failures, and A10 Mishandling of Exceptional Conditions.
Broken Access Control stays at the top. It is consistently the most widespread serious web risk, which is why authenticated, multi-role testing matters so much. Other notable changes: Security Misconfiguration rose to A02, a new Software Supply Chain Failures category (A03) widens the older 'vulnerable components' theme, and a new A10 covers the mishandling of exceptional conditions. The categories change as real-world data and the threats themselves change.
In a web assessment, the Top 10 is typically used to frame and communicate findings, mapping each issue to a risk category that leadership recognises. The depth comes from WSTG test cases and verification against ASVS. There is also a companion OWASP API Security Top 10 (current edition 2023) for APIs, and the OWASP Mobile Application Security project (MASVS/MASTG) for mobile, because those surfaces carry their own risks.
It's a regularly-updated, community-driven list of the most critical security risks to web applications, published by OWASP. It's the industry's common reference point for application risk, but it's deliberately an awareness document, not a complete standard or a test plan.
The current version is the 2025 edition, and references to 2021 are out of date. Broken Access Control stays at the top, Security Misconfiguration rose to A02, and there are two new categories: A03 Software Supply Chain Failures and A10 Mishandling of Exceptional Conditions.
Not directly. In a web assessment it is typically used to frame and communicate findings by mapping each issue to a risk category, while the actual test depth comes from the OWASP Web Security Testing Guide and verification against ASVS. APIs and mobile apps have their own equivalents: the OWASP API Security Top 10 and MASVS/MASTG.