OWASP Top 10 — orientation

Why this matters

The Top 10 is the most-cited list in web security, updated every few years from a meta-analysis of real-world data. It's not the canon, it's the consensus — what most teams will encounter most often. Knowing it cold means you can read a bug report and immediately know what category you're in, which past incident is similar, and what the standard mitigations are.

Demo

The 2021 list, in order: A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection, A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable Components, A07 Identification/Authn Failures, A08 Software & Data Integrity Failures, A09 Logging Failures, A10 SSRF. Each has a cluster of CWEs underneath.

Try it yourself

1. Read the OWASP Top 10 2021 once, then close the tab and write the ten categories from memory. Check what you missed.
2. For each category, write one example you've seen (in your code, a CVE, a bug bounty writeup).
3. Build a checklist: 'before merging, have I considered each of these ten?'. Tape it to your monitor for a week.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, explain what the OWASP Top 10 is and what it isn't.

2. Why it works (the mechanism)

Walk me through how the Top 10 is constructed — what data, what process, what biases.

3. Advanced — application & what's next

Pick a category that moved up or down between Top 10 versions. What's the story behind the change?

References

• OWASP Top 10 — 2021
• OWASP — ASVS (Application Security Verification Standard)