What is OWASP Top 10?
The list of the 10 most dangerous security threats to web apps. We check every project against it.
OWASP Top 10 is a list of the ten most common and dangerous security risks for web applications. OWASP stands for the Open Worldwide Application Security Project — a non-profit organisation where security experts worldwide share knowledge. Think of the list as a "top 10 of break-in methods": once you know how burglars usually get in, you can put the right locks in the right places.
The list is updated every few years based on what actually hits businesses in the real world. It covers things like broken access control (the wrong people reaching the wrong pages), input attacks where hackers trick the system with malicious text, and misconfigured settings that leave doors ajar. For each risk, it describes what the problem is and how to protect against it.
The useful part is that OWASP Top 10 is free and written as a shared reference point. When one developer says "we have covered OWASP Top 10", another developer immediately knows what that means. It is both a checklist and a common language for web security.
Why is OWASP Top 10 important for your business?
Most data breaches do not happen through brilliant new tricks, but through known weaknesses that could have been patched. OWASP Top 10 collects exactly these common mistakes, so you can build them out before they become an incident.
As a client, the list is also a good tool for setting requirements. You can ask your supplier how they handle the risks in OWASP Top 10 and get a concrete answer, instead of a vague promise that everything is secure.
OWASP Top 10 in practice
Say you are launching a new booking site for your business. Before it goes live, the developer runs through OWASP Top 10 and checks, among other things, that login is secure, that a regular user cannot reach admin pages by simply changing the web address, and that forms cannot be exploited for attacks.
At ZORC we check every project against OWASP Top 10 as part of development, so baseline protection is built in from the start rather than patched on afterwards.
Common questions about OWASP Top 10
What does OWASP Top 10 mean?
OWASP Top 10 is a regularly updated list of the ten most serious security risks for web applications. It is produced by the non-profit OWASP organisation and used as a reference by developers worldwide.
Is OWASP Top 10 a standard you must follow?
It is not a law, but a voluntary industry standard and best practice. Many treat it as a minimum requirement, and it is often referenced in procurement and security requirements.
How often is OWASP Top 10 updated?
The list is updated every few years based on how the threat landscape changes and which vulnerabilities are most common in practice. It is therefore wise to always work from the latest version.
Related terms
2FA / MFA
Two-factor or multi-factor authentication. Password plus SMS code or app. Stops most account takeovers. Turn it on. Now.
Data Breach
When the wrong person gets access to the right data. Like someone unauthorised walking into your archive — except you never hear the door.
DORA
The EU's digital resilience test for financial services. Not the explorer — the rules that stop banks and fintech from collapsing when IT fails.
End-to-End Encryption
Data is encrypted at the sender and only decrypted at the recipient. Middlemen only see unreadable text.
EU Hosting
Keeping your data in Europe. Like choosing a storage unit in the neighbourhood instead of one in a country whose rules you do not know.
NIS2
The EU's updated cyber security rules that say "raise your game — or else". Forces thousands of businesses to take security seriously, with fines as the wake-up call.