What is OWASP?

Founded in 2001, OWASP runs as a nonprofit funded by corporate members and volunteer contributors, and its output is deliberately vendor-neutral and free. Beyond the Top 10, OWASP maintains the API Security Top 10 (broken object-level authorization is the perennial #1 there), the ASVS, which gives auditors a checklist of verifiable security requirements at three rigor levels, the Testing Guide for manual and automated assessment methodology, and SAMM, a maturity model for scoring how mature an organization's software security practices actually are.

The 2021 Top 10 reordered around root cause rather than just symptom: Broken Access Control moved to #1 after climbing from #5, reflecting how often authorization logic, not injection, is where real breaches happen. Cryptographic Failures (weak or missing encryption, hardcoded keys) sits at #2. Injection, still SQL, LDAP, OS command, NoSQL, dropped from #1 to #3 as parameterized queries became more standard. Insecure Design is newer to the list and captures architectural flaws that no amount of secure coding fixes after the fact. Security Misconfiguration, Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures (insecure CI/CD pipelines, unsigned updates), Security Logging and Monitoring Failures, and SSRF round out the list.

Each category page documents attack scenarios, example code, and specific prevention guidance, which is why WAF vendors, penetration testers, and secure-coding training all reference OWASP categories directly, giving security teams and developers a shared vocabulary for describing the same class of flaw.

The ASVS in particular is built for verification rather than awareness: instead of listing risks, it enumerates specific, testable requirements (session tokens must be invalidated on logout, password fields must enforce a minimum length, API responses must not leak stack traces) that a tester can check off one by one. Level 1 covers baseline controls appropriate for any application, Level 2 adds requirements for applications handling sensitive data, and Level 3 is for the highest-assurance systems like those processing financial transactions. Many organizations use ASVS Level 2 as the contractual bar they require from third-party developers, because it's specific enough to test against rather than a vague promise to follow best practices.