OWASP Top 10 (2025)

What it is

The OWASP Top 10 is a regularly-updated list of the most critical security risks to web applications, derived from a community survey plus large-scale data analysis of vulnerability prevalence. Used as the de facto bar in penetration testing scopes and SDLC requirements.

Why it matters

Your AppSec program should provably address every Top 10 risk — broken access control, cryptographic failures, injection, insecure design, misconfiguration, vulnerable components, auth failures, integrity failures, logging gaps, SSRF. Most security questionnaires reference it directly.

Who it applies to

Every web application — the Top 10 is the baseline, not the ceiling.

How WQI scores it

Web Quality Index considers this standard satisfied when all of the 3 supporting factors pass.

Related standards

See also

NIST CSF , CSP 3 , SRI

Standards that share factors with this one

Auto-computed from overlapping factor tickets in satisfiedBy, excluding standards already listed under "See also" above. Strong overlap suggests these standards rise and fall together when sites are scored.

• ISO/IEC 27001:2022 3 shared factors Security International gold standard for an Information Security Management System. The 2022 revision restructures the Annex A controls to align with ISO 27002:2022.
• Cross-Origin isolation (COOP / COEP / CORP) 1 shared factor Security Three response headers that together unlock SharedArrayBuffer and high-resolution timers — and incidentally close a class of cross-origin side-channel leaks.
• HTTP Strict Transport Security 1 shared factor Security One header tells every future visitor 'always HTTPS, never HTTP, no exceptions'. Should ship everywhere; preload only after you're sure.
• Modern HTTP security headers 1 shared factor Security HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. The six headers every modern site should ship.
• PCI DSS v4.0 1 shared factor Security If you store, process, or transmit card data — directly or through an iframe — PCI DSS applies. v4.0 is mandatory; v3.2.1 retired in March 2024.

Other references

• spec OWASP Top 10 — 2025 release
• guidance OWASP Cheat Sheet Series