OWASP – open tools for secure software

The Open Worldwide Application Security Project (OWASP) is a non-profit organisation working for more secure software. Its vision is short: “No more insecure software”. Everything OWASP produces is free and open to all, whatever the size of the organisation.

OWASP started in 2001 and has been run by a US non-profit foundation since 2004. The work is done by a global community of more than 100,000 people in over 250 local chapters. Sweden has chapters in Stockholm, Gothenburg and Jönköping that hold meetups and talks.

Why OWASP matters to you

Most organisations build, buy or run web applications. OWASP's material helps in all three roles. Development teams get a shared picture of the risks. Buyers get a standard to set requirements with in procurement. Management gets a way to measure how mature development is.

Regulation is raising the bar too. NIS2 and the Swedish Cybersecurity Act require security in the supply chain. The EU Cyber Resilience Act requires manufacturers of products with digital elements to handle vulnerabilities and know which components their products contain. OWASP's tools are a practical way to meet those demands.

The OWASP Top 10:2025

The OWASP Top 10 lists the ten most critical security risks in web applications. It is built on data about real vulnerabilities and a survey of security practitioners. It is updated every few years. Earlier editions came in 2017 and 2021, and the current one is the OWASP Top 10:2025.

1. A01 Broken Access Control. Users reach data or functions they should not have access to.
2. A02 Security Misconfiguration. Default passwords, unnecessary services or overly generous settings.
3. A03 Software Supply Chain Failures. Vulnerable or tampered components, libraries and build tools.
4. A04 Cryptographic Failures. Weak or incorrectly used encryption of sensitive data.
5. A05 Injection. Input interpreted as commands, such as SQL injection and cross-site scripting.
6. A06 Insecure Design. Flaws built into the architecture that better code cannot fix.
7. A07 Authentication Failures. Weak logins, flawed session handling and missing multi-factor authentication.
8. A08 Software or Data Integrity Failures. Updates and data used without checking where they came from.
9. A09 Security Logging and Alerting Failures. Attacks that go unnoticed because nothing logs or alerts.
10. A10 Mishandling of Exceptional Conditions. Systems that behave insecurely when something unexpected happens.

Compared with 2021, two things changed most. The supply chain has its own, broader category. It replaces the earlier entry on vulnerable and outdated components. Mishandling of exceptional conditions is new to the list.

The Top 10 builds awareness, ASVS sets the requirements

The Top 10 is a list of risks, not a standard. It works well for training and as a starting point for development teams. It is not enough as a list of requirements for a supplier.

That is what the OWASP Application Security Verification Standard (ASVS) is for. ASVS contains concrete, testable security requirements for web applications. They are grouped into three levels, from basic protection to systems with high security needs. The current version is ASVS 5.0.

In a procurement, you can choose the ASVS level that fits the system and require the supplier to show how the requirements are met. Security then becomes something you can follow up, not just a promise.

More projects worth knowing

OWASP's work is organised in projects. New projects start as Incubator and can become Lab and Production as they mature. Projects of particular strategic value also receive the Flagship designation.

• OWASP SAMM is a maturity model for secure development. It measures five areas: governance, design, implementation, verification and operations.
• OWASP Dependency-Track analyses a software bill of materials (SBOM) and alerts when a component has a known vulnerability.
• OWASP CycloneDX is a standard format for SBOMs.
• OWASP Cheat Sheet Series gives short, practical advice for developers, topic by topic.
• OWASP Web Security Testing Guide is a handbook for testing web applications.
• OWASP Juice Shop is a deliberately vulnerable web shop to practise on.
• OWASP Top 10 for LLM Applications lists the risks in systems built on large language models.

How to get started

1. Have your development teams go through the OWASP Top 10:2025 and compare it with your own systems.
2. Choose an ASVS level for your most important systems and use it in requirements and procurement.
3. Do a first self-assessment with SAMM to see where your development practice stands.
4. Produce an SBOM for your applications and monitor the components, for example with Dependency-Track.
5. Test your applications regularly with the Web Security Testing Guide.