OWASP Top 10 is a globally recognised list of the ten most critical security risks for web applications, published and periodically updated by the Open Web Application Security Project (OWASP) — a non-profit foundation. The list is the de facto standard for application security: every penetration tester checks for these issues, every developer training programme covers them, every secure development framework references them. The current version is **OWASP Top 10:2021**; the next major update is expected in 2025-2026 based on data collected from 200+ organisations and 500K+ applications. PCI-DSS, ISO 27001, NIS2, and many other frameworks reference OWASP Top 10 directly or indirectly.

The current ten categories: (1) **A01: Broken Access Control** — IDOR, missing authorisation, privilege escalation; #1 risk by far, (2) **A02: Cryptographic Failures** (formerly Sensitive Data Exposure) — weak crypto, plaintext storage, missing TLS, (3) **A03: Injection** — SQL/NoSQL/command/LDAP/XPath injection, (4) **A04: Insecure Design** — new category 2021, missing security-by-design, (5) **A05: Security Misconfiguration** — default passwords, verbose errors, unnecessary features enabled, (6) **A06: Vulnerable and Outdated Components** — Log4Shell-class issues; use SCA, (7) **A07: Identification and Authentication Failures** — weak passwords, broken MFA, session management bugs, (8) **A08: Software and Data Integrity Failures** — supply chain (SolarWinds-class) and unsigned updates, (9) **A09: Security Logging and Monitoring Failures** — no detection of breaches, (10) **A10: Server-Side Request Forgery (SSRF)** — let attacker make requests from server.

Per category briefly: (1) **A01 Broken Access Control** — server-side authorisation checks for every request, deny by default, automated tests, (2) **A02 Cryptographic Failures** — TLS 1.3 everywhere, AES-256 at rest, modern hashing for passwords (Argon2), (3) **A03 Injection** — parameterised queries, ORMs, input validation, (4) **A04 Insecure Design** — threat modelling early, security stories in product backlog, (5) **A05 Misconfiguration** — hardened baselines (CIS Benchmarks), automated configuration scanning, (6) **A06 Vulnerable Components** — SCA tools (Snyk, Dependabot), automated dependency updates, (7) **A07 Auth Failures** — MFA mandatory, secure session management, rate limiting, (8) **A08 Integrity** — code signing, SBOM, secure CI/CD, (9) **A09 Logging** — comprehensive audit logging + 24/7 SOC monitoring, (10) **A10 SSRF** — egress filtering, allow-list validation, metadata service protection.

No — OWASP Top 10 is the *starting point*, not a complete checklist. It covers the most common and impactful classes of vulnerability but misses many real-world issues: business logic flaws (loan approval bugs, payment race conditions), API-specific issues (use OWASP API Security Top 10 separately), mobile-specific issues (use OWASP MASTG), cloud configuration issues (use AWS Well-Architected Framework, CIS Benchmarks), supply chain attacks beyond Top 10's scope. For comprehensive coverage, combine: OWASP Top 10 (web), OWASP API Security Top 10, OWASP MASTG (mobile), CIS Benchmarks (config), MITRE ATT&CK (operational), threat modelling for application-specific risks. Penetration testing and code review still find many issues not covered by automated scanning.

OWASP API Security Top 10 is a separate list focused on API-specific vulnerabilities, first published 2019 with major update in 2023. Current categories: (1) **API1: Broken Object Level Authorization** (BOLA — API equivalent of IDOR), (2) **API2: Broken Authentication**, (3) **API3: Broken Object Property Level Authorization** (mass assignment + excessive data exposure), (4) **API4: Unrestricted Resource Consumption** (DoS-class), (5) **API5: Broken Function Level Authorization**, (6) **API6: Unrestricted Access to Sensitive Business Flows**, (7) **API7: Server-Side Request Forgery**, (8) **API8: Security Misconfiguration**, (9) **API9: Improper Inventory Management** (shadow APIs), (10) **API10: Unsafe Consumption of APIs**. Modern apps need both Top 10s; APIs (REST, GraphQL, gRPC) increasingly handle the most sensitive logic.

Five practical applications: (1) **Developer training** — every developer should understand the ten categories and how to write code that avoids them, (2) **Penetration testing scope** — minimum baseline; pentest reports often map findings to OWASP Top 10, (3) **SAST/DAST tool configuration** — most tools are pre-configured against OWASP Top 10; tune for your stack, (4) **Compliance evidence** — PCI-DSS Requirement 6.2.4 explicitly references OWASP Top 10; many auditors expect coverage, (5) **Threat modelling** — use Top 10 as a checklist of threats to consider for each component. Don't make it the *only* security activity — defence in depth requires more than Top 10. Use OWASP SAMM (Software Assurance Maturity Model) or BSIMM for measuring overall application security maturity.

OWASP collects data on a 4-year cycle. The 2025 update will reflect: (1) Increased prominence of supply chain attacks (likely promoting A08 Software Integrity), (2) AI/ML-specific risks emerging — OWASP also publishes a separate **LLM Top 10** covering prompt injection, training data poisoning, model denial of service, (3) Expanding API risks, (4) Growing impact of misconfigured cloud-native architectures, (5) Likely consolidation of categories (current 10 may merge or split). The 2025 list isn't finalised at time of writing; track owasp.org/Top10/ for the latest. Organisations should prepare by extending their secure development programmes to cover supply chain integrity, LLM security, and continuous cloud configuration management.