Quick answer: The OWASP Top 10 is a free, internationally recognized reference listing the ten most common and highest risk security vulnerability categories in web applications. It is updated every few years based on real world data by the Open Worldwide Application Security Project (OWASP). The most current version is 2021, topped by Broken Access Control. The OWASP Top 10 is not a checklist but an awareness document: it does not prove an application is secure, but it shows an application cannot be secure without closing these ten categories. It is also the core framework for penetration test scope and secure development training.

When web application security comes up, the answer almost always starts with the OWASP Top 10. The reason is simple: in the real world, the vast majority of ways applications get compromised fall into these ten categories. This article covers the OWASP Top 10 2021 list, what each category is and how to close it.

What the OWASP Top 10 is and is not

OWASP is a non profit community producing free tools, guides and standards in application security. The Top 10 is its best known output.

An important distinction: the OWASP Top 10 is not a compliance standard. You cannot say "we passed the Top 10, our application is secure." The list shows the most common risk categories. Even an application that closes all ten may contain other flaws. Conversely, leaving even one of the Top 10 categories open means serious risk. So the Top 10 is a floor, not a ceiling.

The list is updated every few years because the threat landscape changes. The 2021 version was built from data collected from real applications and a community survey.

The OWASP Top 10 (2021)

Rank Category In brief
A01 Broken Access Control A user reaching data or functions they are not authorized for
A02 Cryptographic Failures Weak or missing encryption, exposed sensitive data
A03 Injection SQL, command, LDAP injection; XSS falls here too
A04 Insecure Design Security gaps at the design stage
A05 Security Misconfiguration Default settings, verbose errors, unnecessary services
A06 Vulnerable and Outdated Components Unpatched libraries and dependencies
A07 Identification and Authentication Failures Weak session and authentication
A08 Software and Data Integrity Failures Unverified updates and supply chain
A09 Security Logging and Monitoring Failures Insufficient logging and monitoring
A10 Server Side Request Forgery (SSRF) The server tricked into requesting internal resources

The categories explained and defended

A01 Broken Access Control

It rose to first place in 2021 as the most common and most impactful flaw. If a user can reach someone else's data by changing an ID in the URL (IDOR), or a normal user can call admin functions, access control is broken. Defense: re authorize every request server side, never leave decisions to the client, and apply deny by default. This is the application level equivalent of the Zero Trust architecture approach.

A02 Cryptographic Failures

Storing or transmitting sensitive data unencrypted, using weak algorithms, hardcoded keys. Defense: current TLS everywhere, encrypting sensitive data with strong modern algorithms, separating keys from code and using a secret management system.

A03 Injection

User input mixing directly into a query or command. The best known is SQL injection, see our article on what SQL injection is and how to prevent it. Cross Site Scripting (XSS) falls here too, covered in a separate article. Defense: parameterized queries, input validation and output encoding.

A04 Insecure Design

A flaw in the design, not the code. Business logic flaws, missing rate limiting, abusable flows belong here. Defense: threat modeling at the design stage, secure design patterns and thinking through abuse scenarios in advance.

A05 Security Misconfiguration

Default passwords, open directory listing, verbose error messages, unnecessary open ports. Defense: hardening standards, closing everything unnecessary, automated configuration auditing.

A06 Vulnerable and Outdated Components

A known flaw in a library the application uses. Most modern applications are largely third party code. Defense: a dependency inventory (SBOM), continuous vulnerability scanning and regular updates. For the supply chain dimension see our article on supply chain security.

A07 Identification and Authentication Failures

Weak password policy, login open to brute force, poor session management. Defense: multi factor authentication, phishing resistant methods and secure session management. See our article on passkeys and MFA bypass.

A08 Software and Data Integrity Failures

Unverified updates, insecure deserialization, a tampered supply chain. Defense: signed updates, integrity verification and trusted source control.

A09 Security Logging and Monitoring Failures

Failing to notice an attack usually stems not from a code flaw but from missing logging and monitoring. Defense: centralized logging, meaningful event generation and real time monitoring. This is the foundation of building a SIEM and SOC.

A10 Server Side Request Forgery (SSRF)

An attacker tricking the server into requesting resources on the internal network or a cloud metadata service. A serious escalation path in cloud environments. Defense: validating outbound requests, restricting access to internal addresses and an allow list approach.

How to use the OWASP Top 10

  • Developer training. The team must recognize each category at code level. Awareness is the first step of secure code.
  • Penetration test scope. An authorized penetration test begins by targeting these ten categories. See our article on the penetration test process and scope.
  • Code review and automated scanning. Static and dynamic analysis tools should be tuned to look for these categories.
  • Acceptance criteria. A new feature should pass the relevant Top 10 controls before release.

OWASP also publishes a list specific to APIs. If your application is API heavy, the OWASP API Security Top 10 should be studied separately.

Frequently asked questions

Is an application that passes the OWASP Top 10 secure? No. The Top 10 shows the most common risks, it does not guarantee full security. It is a floor, and other flaws may exist.

How often is the OWASP Top 10 updated? Every few years. The most current version is 2021, with a new version being developed by the community.

Is OWASP free? Yes. OWASP is non profit and all its documents, including the Top 10, are free.

Why is XSS not a separate item? In the 2021 version XSS is assessed under Injection (A03). It still has its own defense techniques.

Does a small site need the OWASP Top 10? Yes. Attacks are mostly automated and do not care about site size. The traps small sites fall into most are on this list.

Is there a relationship between the OWASP Top 10 and compliance standards? It is not a compliance standard directly, but it largely overlaps with the application security expectations of frameworks such as ISO 27001, PCI DSS and NIS2.

Sources

To measure whether your application is genuinely resilient against the OWASP Top 10, contact DSET. From our Ankara Hacettepe Teknokent laboratory we provide penetration testing, secure code review and developer training.