Services

OWASP Top 10

The OWASP Top 10 is a periodically updated list of the most critical and most common security risks in web applications, put together by practitioners who see what's actually being exploited in the wild. It's not a compliance checklist so much as a map of where attackers spend their time — broken access control, injection flaws, cryptographic failures, security misconfiguration, and the rest of the current list.

What makes this list worth taking seriously isn't novelty — most of these issue categories have been around for years — it's persistence. Broken access control and injection have been near the top of this list for a long time because they keep showing up in real applications, including ones built by experienced teams, because they're easy to introduce and easy to miss in a code review that isn't specifically looking for them.

How I assess against it

I test your application against each category the way an attacker actually would — not just running a scanner and forwarding you the output, but manually verifying what's actually exploitable and what a scanner flagged incorrectly. Access control issues in particular need a human looking at the actual business logic, because they're rarely something a tool catches reliably on its own.

Where this fits with other testing

The OWASP Top 10 is a good baseline, but it's explicitly not exhaustive — it's the most common risks, not every possible risk to your specific application. For anything handling sensitive data or facing significant threat exposure, I treat it as the floor for an assessment, not the ceiling, and look at what's specific to your application's own logic and architecture on top of it.

If you want to know where your web application actually stands against these risks, let's scope an assessment.