OWASP Top 10
A widely referenced list of the most critical web application security risks, updated periodically.
It covers categories such as broken access control, cryptographic failures, injection, and security misconfiguration, and it is the common vocabulary for application security.
It is an awareness document rather than a complete testing standard. An application can have no Top 10 issues and still be insecure in ways specific to what it does.
Where this comes up
OWASP Top 10 sits inside our penetration testing work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
Web application penetration test Testing focused on a specific application, its logic, authentication, and handling of user input. SQL injection Manipulating an application's database query by supplying input the application fails to handle safely. Cross-site scripting Injecting script into a web page that then executes in another user's browser in the context of that site. CWE A classification of the underlying types of software weakness, describing categories rather than specific instances.