OWASP Top 10
The 10 most critical web application security risks — with our real finding counts from 400+ assessments.
Restrictions on what authenticated users can do are not properly enforced. Attackers access unauthorized functions or data.
How we use the OWASP Top 10 in assessments
The Top 10 is a coverage floor, not a methodology. It tells you which categories must be exercised, but it says nothing about how deep to go — A04 (Insecure Design) is an entire discipline disguised as one row, and it is where the highest-impact findings live: race conditions on financial endpoints, workflow steps that can be replayed or skipped, and business rules enforced only in the client. A scanner can confirm the category exists on your app; it cannot find the flaw, because the flaw is a property of your logic, not a signature.
The finding counts beside each category are ours — the observed distribution across hundreds of real assessments, not the OWASP survey averages. Two things stand out: Misconfiguration (A05) is the most common category by raw count but mostly produces medium-severity findings, while Broken Access Control (A01) produces the majority of criticals. The gap between "most frequent" and "most severe" is exactly why a checklist approach leaves the dangerous work undone.
If you are using this page to prepare for an assessment: the categories where your stack is weakest are the ones where your features concentrate — auth surfaces for A07, anything that touches money or state for A04, every integration point for A08 and A10. Bring those to the scoping call and the testing time goes where it matters.
How does your application score?
We test against all 10 OWASP categories — plus business logic, authentication chains, and infrastructure issues that the OWASP list does not cover.