Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

What is the OWASP Top 10? Web risks explained

In one sentence: The OWASP Top 10 is a widely used list of the ten most serious types of weakness in web applications, written by a non-profit so developers and buyers share one checklist.

What it is

OWASP, the Open Worldwide Application Security Project, is a non-profit foundation working to improve the security of software. Its Top 10 is a ranked awareness document that groups common web application weaknesses into ten categories.

The 2021 edition is the most widely cited. Its categories are: A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection, A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable and Outdated Components, A07 Identification and Authentication Failures, A08 Software and Data Integrity Failures, A09 Security Logging and Monitoring Failures and A10 Server Side Request Forgery. OWASP has also published a 2025 edition on its site with renumbered categories, for example A04 Cryptographic Failures and A07 Authentication Failures, so always check owasp.org/Top10 for the current list.

How it works

It is a list, not a tool, so “how it works” is about how people use it.

  1. OWASP collects data from organisations that test applications, plus a community survey, and ranks categories by how often and how seriously they appear.
  2. Each category page explains the weakness, example attack scenarios, and how to prevent it.
  3. Developers use it as training and a coding checklist.
  4. Buyers and auditors use it in contracts, for example “tested against the OWASP Top 10”.
  5. Testers use it as a minimum scope, then go beyond it.

What it does not do: it is not a complete standard and passing a scan against it does not prove an application is secure. OWASP notes that an insecure design cannot be fixed by a perfect implementation.

Who it affects and how badly

Anyone who builds, buys or runs a web application, mobile back end or API: SaaS start-ups, fintech and insurers, retailers with web shops, recruitment platforms, estate agency portals and councils with citizen services.

Small firms using off-the-shelf plugins inherit A06 risk. Mid-sized firms with custom portals face data theft and downtime. Regulated firms must show appropriate security for personal data. OWASP’s 2021 data found broken access control in 94% of applications tested, with an average incidence rate of 3.81%.

Worst case depends on the category, from account takeover to full database theft.

Real examples

TalkTalk, 2015 (Injection). The ICO found attackers used SQL injection on legacy web pages, accessing the details of 156,959 customers, and fined the company £400,000. Source: https://ico.org.uk/about-the-ico/media-centre/talktalk-cyber-attack-how-the-ico-investigation-unfolded/

Credential stuffing (Authentication failures). OWASP’s authentication failures page names credential stuffing as a very common attack and recommends MFA. Source: https://owasp.org/Top10/2025/A07_2025-Authentication_Failures/

How to detect it

  • Ask your developers or supplier which Top 10 categories they test for, and for the latest test report.
  • Run a free web vulnerability scan to find the easy items, such as outdated components and missing security headers.
  • Review web server and application logs for access control failures and repeated login failures. OWASP says to log access control failures and alert on repeats.
  • Check that logging and alerting exist (A09). If nobody would notice an attack, that is a finding.
  • Check dependencies for known flaws.

How to fix or prevent it

  1. Enforce access control on the server side and deny by default (A01).
  2. Use parameterised queries and safe frameworks (A03).
  3. Encrypt data in transit and at rest, and hash passwords with a modern algorithm (A02).
  4. Design security in from the start, with threat modelling (A04).
  5. Harden configuration and remove defaults (A05).
  6. Keep components and libraries patched (A06).
  7. Require MFA and block known-breached passwords (A07).
  8. Log and alert on security events (A09), and test with a manual penetration test.

Related terms

Browse all entries in the web application security hub.

FAQ

Is the OWASP Top 10 a standard? It is an awareness document, not a complete standard. It is a good minimum checklist.

What is number one in the 2021 list? Broken Access Control, which moved up from fifth place.

How often does it change? Editions are published periodically. The 2021 edition is widely used and a 2025 edition now exists.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan at wolfcore.co.uk/free-web-vulnerability-scan and see Wolfcore penetration testing.