What is the OWASP Top 10?
The OWASP Top 10 is a periodically-updated list of the most critical web application security risks, published by the Open Worldwide Application Security Project. It is a consensus awareness document, not a checklist or a standard - each entry is a broad risk category (like broken access control or injection) that groups many specific weaknesses. It is the common language teams and tools use to talk about application risk coverage.
The OWASP Top 10 is the most widely-known reference in application security: a periodically-updated list of the most critical risks facing web applications, published by the Open Worldwide Application Security Project. Almost every security conversation, tool, and program references it, which makes understanding what it is - and what it is not - genuinely useful.
What it is (and is not)
The Top 10 is an awareness document. Its purpose is to focus the industry’s attention on the categories of risk that cause the most real harm, so that teams building and securing applications know where to concentrate. It is:
- A consensus of risk categories, each broad enough to cover many specific weaknesses.
- Periodically revised, as the data on what actually causes breaches shifts.
- A shared vocabulary, so “broken access control” or “injection” means the same thing across teams and tools.
It is not a compliance standard, an exhaustive checklist, or a guarantee - an application free of Top 10 issues is not thereby secure, and the list deliberately trades completeness for focus. Treating it as a certification to pass rather than a set of risks to understand is the common misuse.
How it relates to CWEs
The Top 10 sits above the CWE taxonomy. Each Top 10 category is a risk, and it groups many specific weaknesses:
- The “injection” risk includes SQL injection, command injection, and other injection CWEs.
- “Broken access control” spans a range of authorization-weakness CWEs.
- “Cryptographic failures” covers many specific crypto-misuse weaknesses.
So the relationship is layered: tools detect CWEs (specific weakness classes), and the Top 10 organizes those into the application-level risks that people prioritize and report against. When you check that a scanner covers the Top 10, what you are really checking is that it detects the CWE classes underneath each category.
The family of Top 10 lists
The flagship web application list is the best known, but OWASP maintains several focused lists for different surfaces:
- The API Security Top 10, addressing risks specific to APIs - broken object-level authorization, broken authentication, and the rest - which is the reference for API security testing.
- The Mobile Top 10, and the related MASVS standard, for mobile application security.
This matters when evaluating a tool: “OWASP Top 10 coverage” is only meaningful once you know which list, since a web scanner and an API scanner cover different risks entirely.
As a coverage yardstick
Because it is a shared, respected framing, the Top 10 functions as a coverage target: security teams verify that their tooling detects the weakness classes behind each risk category. The SecuNexa engines publish their coverage against the relevant OWASP lists and the CWE Top 25, so that “does it cover the risks that matter” is a question you can answer by reading a matrix rather than trusting a slogan.
Frequently asked questions
Is the OWASP Top 10 a compliance standard?
Not formally, though many programs and contracts reference it. It is an awareness document meant to focus attention on the highest-impact risk categories. Some standards and regulations point to it, which gives it de facto weight, but 'covering the OWASP Top 10' is a coverage goal rather than a certification.
How does the OWASP Top 10 relate to CWEs?
Each Top 10 category groups many specific CWE weakness classes. 'Injection' as a Top 10 risk includes SQL injection, command injection, and others, each a distinct CWE. So the Top 10 is the application-level framing and CWEs are the specific weaknesses underneath - tools detect CWEs, and the Top 10 organizes them into risks people prioritize by.
Are there other OWASP Top 10 lists?
Yes. Beyond the flagship web application list, OWASP maintains focused lists including the API Security Top 10 and the Mobile Top 10, each addressing risks specific to that surface. When a tool claims OWASP Top 10 coverage, it is worth confirming which list, since a web-focused scanner and an API-focused one address different risks.