OWASP Top 10:2025 awareness list (not a certificate, not ASVS, not the LLM Top 10)

What category of awareness document this is

The OWASP Top 10 is a standard awareness document for developers and web application security. The 2025 list page says it represents a broad consensus about the most critical security risks to web applications. It is meant to educate and to start conversations. It is not a complete testing standard.

Who it commonly frames: AppSec path readers who already meet a theme on a ShopCart lesson, Foundations readers who saw the name only as a row on the six-map comparison, and buyers or vendors who treat a Top 10 slide as a certificate. This is an industry awareness list. It is not a U.S. statute, and it is not a certification scheme.

What security people most often confuse: they fold ten checked boxes, an ASVS testing result, the LLM Top 10, and an Atlas lesson into one seal. This page keeps those objects apart. The Reference card at /reference/frameworks/owasp-top-10-2025/ remains the framework summary. This explainer complements that card. It does not replace it, and it does not reprint category bodies.

A01 through A10 are category labels

The ten names in the table on this page are the official OWASP Top 10:2025 category labels. They are awareness category labels, not a finished test plan. This page stops at the name. It does not reprint the risk text, the example attacks, or the weakness lists on the official category pages.

AppSec lessons already use two of these names without reprinting the bodies. A1, the ShopCart threat model at /learn/topics/shopcart-threat-model/, points at A06:2025 Insecure Design. A2, A3, and A4 point at A03:2025 Software Supply Chain Failures: /learn/topics/dependencies-and-transitive-risk/, /learn/topics/pipeline-write-vs-promote/, and /learn/topics/sbom-evidence-and-priority/. Open those lessons for the practice. This page does not rewrite them.

A hallway poster that checks all ten boxes is still a poster. The label tells people which conversation they are in. It does not close a test, and it does not require anyone to memorize ten category essays.

Name the theme, then keep the evidence

Pick one real or synthetic application risk. Use a Top 10:2025 theme as a shared name for the conversation, then move to verifiable evidence: a threat model, a test note, or an SBOM decision. The Reference card says to link awareness to SAST, DAST, or SCA evidence rather than to a poster in the hallway.

ShopCart can carry one risk under a 2025 category label, then point at the threat model, the dependency inventory, the promote split, or the SBOM decision. TrackPort can do the same for a parser, a session, or an access-control note. Those lessons stay the practice. A poster of ten boxes is not that evidence.

When the question needs testable depth, the OWASP Application Security Verification Standard (ASVS) is a separate requirements and verification project. This page names ASVS only. It does not teach ASVS requirements, and it does not pin an ASVS edition (that year is UNKNOWN here, matching the Reference card, which also names ASVS without a year). The OWASP Top 10 for LLM Applications 2026 is a separate awareness list. Prompt injection stays on /learn/topics/prompt-injection-and-retrieval/. Do not fold that list into A01 through A10.

What this card is not

Not a Top 10 encyclopedia. Not a weakness-list dump. Not an ASVS course. Not an LLM Top 10 rewrite. Not a replacement for the Reference framework card at /reference/frameworks/owasp-top-10-2025/. Not red-team exploit homework. Not proof that attackers will skip you. Not permission to invent an adoption statistic from the contributor thank-you list on the introduction. Not an Atlas attestation of Top 10 completion.

Not a CSF 2.0 profile. Outcomes live on /learn/topics/outcomes-then-controls/ and on /reference/frameworks/nist-csf-2-0/. Not a CIS Implementation Group (/learn/explainers/cis-implementation-groups/). Not an ISO/IEC 27001 certificate (/learn/explainers/iso-27001/). Not an SP 800-53 baseline (/learn/explainers/sp-800-53/). Not an ATT&CK coverage score (/learn/explainers/mitre-attack/). The six-map comparison is /reference/frameworks/compare/. The OWASP row there says the purpose is awareness of common application risks, that the list is not ASVS and not the LLM Top 10, that certifiable is No, and that a typical misuse is treating the list as a complete test standard. A row is not this page.

Rewrite the one-line claim

Replace "we are OWASP, Top 10, ASVS, LLM Top 10, and Atlas AppSec compliant" with a reading sentence. We use OWASP Top 10:2025 as a limited web-risk awareness list (A01 through A10 labels). That is different from ASVS testing depth, from the LLM Top 10 2026, and from a finished TrackPort test.

When a slide says "Top 10 compliant," privately ask which theme was actually tested, on which application evidence, and whether the live need is awareness, ASVS-depth requirements, or a separate LLM list. Do not paste proprietary scan exports that contain customer data into Atlas.

Ten boxes are not secure, not ASVS, not the LLM Top 10, and not an Atlas seal

Teaching table only. It does not assign a certificate, a finished test, an ASVS result, an LLM list result, or an AppSec seal.

A01:2025 through A10:2025, as labels

Official 2025 category names, slogan depth only. This table does not reprint OWASP risk text, and it does not list CWE identifiers.

Glossary and nearby pages

• Vulnerability
• Trust boundary
• SBOM
• Evidence
• SAST

• OWASP Top 10 Reference card (framework summary, not replaced by this page)
• Compare the six maps (a row is not this list)
• Map the shop: trust boundaries on a synthetic checkout API (A1)
• What you didn't import still ships with you (A2)
• Who can write, who can promote (A3)
• An SBOM is inventory, not a control (A4)
• Outcomes first, then controls (F8a)
• Prompt injection and retrieval trust (G1, LLM list, separate from this page)
• Application and software supply-chain path
• Privacy is not a CIA checkbox