What category of awareness document this is
The OWASP Top 10 is a standard awareness document for developers and web application security. The 2025 list page states that the list represents a broad consensus about the most critical security risks to web applications. The list is meant to educate and to start conversations. The list is not a complete test standard.
The OWASP Top 10 is an industry awareness list. The list is not a U.S. statute, and the list is not a certificate scheme.
Ten checked boxes, an ASVS test result, and the LLM Top 10 are three different objects.
Edition covered
The edition string is OWASP Top 10:2025. The introduction calls this list the 8th installment of the OWASP Top 10. Official hubs are https://owasp.org/Top10/2025/ and https://top10.owasp.org/2025/ (the same list). The owasp.org list URL redirects to https://top10.owasp.org/2025/. The introduction on that host still states that this list is the 8th installment. If a newer installment appears, this pin must change. The older claim is then UNKNOWN.
The introduction gives one relevant fact for Top 10 literacy. The 2025 installment adds or expands themes such as Software Supply Chain Failures and Mishandling of Exceptional Conditions. The list page writes A09 as Security Logging and Alerting Failures. The introduction also uses an ampersand in one title of that same category. Rank shifts, weakness identifier lists, and contributor statistics stay on the official introduction.
A01 through A10 are category terms
The ten category titles in the literacy table are the official OWASP Top 10:2025 categories. Those titles are awareness category terms, not a finished test plan. The official category pages hold the risk text, the example attacks, and the weakness lists.
Threat modeling maps to A06:2025 Insecure Design (Threat modeling a service: data flows, trust boundaries, and STRIDE). Dependency risk, the write-versus-promote split, and SBOM evidence map to A03:2025 Software Supply Chain Failures (Direct and transitive dependencies: inherited code in your runtime, CI/CD trust boundaries: writing code vs promoting to production, SBOM evidence and priority: binding inventory to the running build).
The theme first, then the evidence
The habit starts with one real or synthetic application risk. One Top 10:2025 theme gives a shared term for the conversation. The conversation then moves to verifiable evidence. Examples are a threat model, a test note, or an SBOM decision. The Reference card advises teams to link awareness to SAST, DAST, or SCA evidence rather than to a poster in the hallway.
Some questions need testable depth. The OWASP Application Security Verification Standard (ASVS) is a separate requirements and verification project (OWASP ASVS 5.0.0: verifying application security). The OWASP Top 10 for LLM Applications 2026 is a separate awareness list (OWASP LLM Top 10 (2026): AI application risks). Prompt injection is an LLM application risk (Prompt injection and untrusted retrieval (RAG): when data hijacks instructions). The LLM list does not fold into A01 through A10.
Rewrite the one-line claim
The claim "we are OWASP, Top 10, ASVS, and LLM Top 10 compliant" mixes four objects. Exact replacement: "We use OWASP Top 10:2025 as a limited web-risk awareness list (A01 through A10 categories)." That use is different from ASVS test depth and from the LLM Top 10 2026. It is also different from a finished application test.
A slide can state "Top 10 compliant." The team then privately asks which theme was actually tested, and on which application evidence. The team also asks whether the live need is awareness, ASVS-depth requirements, or a separate LLM list.
Ten boxes are not secure, not ASVS, and not the LLM Top 10
| Phrase people use | Literacy correction |
|---|---|
| We checked the ten boxes, so the application is secure / certified | OWASP Top 10:2025 is an awareness list. A check of ten themes is not a finished test and not a certificate scheme. The comparison row lists certifiable as No. Reference card: /reference/frameworks/owasp-top-10-2025/. Six-map comparison: /reference/frameworks/compare/. |
| Top 10 done means ASVS done | ASVS is a separate requirements and verification project for testable depth. ASVS explainer: /learn/explainers/owasp-asvs/. |
| Top 10 done means LLM Top 10 done | The 2026 LLM list covers LLM applications, and the web list does not absorb it. LLM list explainer: /learn/explainers/owasp-llm-top-10/. Lesson: /learn/topics/prompt-injection-and-retrieval/. |
| Top 10 is a complete AppSec standard | The Reference card states that this list is not a complete application-security standard. The Reference card also states that this list is not a substitute for a threat model of a specific API. Practice stays on /learn/topics/shopcart-threat-model/, /learn/topics/dependencies-and-transitive-risk/, /learn/topics/pipeline-write-vs-promote/, and /learn/topics/sbom-evidence-and-priority/. |
| The Top 10 rank is our fix order | The rank reflects broad consensus across many applications. The fix order for one application comes from its threat model and its evidence. |
| No finding in the ten categories means no vulnerabilities | The list covers the most critical risk themes. A clean result against ten titles does not show that other weaknesses are absent. |
Common misconceptions
Ten checkboxes mean a secure product, or an OWASP certificate.
OWASP Top 10:2025 is a limited awareness list. Ten checked themes are an awareness conversation, not a test result or a certificate. The comparison row lists certifiable as No.
The Top 10, ASVS, and the LLM Top 10 are the same list.
Those three items are different objects. Top 10:2025 covers web risk themes. ASVS is a separate requirements project for testable depth. The 2026 LLM list is its own awareness list for LLM applications.
The Top 10 ranks every web risk that matters to one application.
The list is a broad consensus about the most critical web application risks. A threat model for one application can rank risks in a different order or find risks outside the list.
A vendor homepage shield attests Top 10 completion.
A homepage shield is not evidence that a test ran on the application.
The 2021 list is still the current OWASP Top 10.
OWASP Top 10:2025 is the 8th installment and replaces the 2021 list. Software Supply Chain Failures and Mishandling of Exceptional Conditions are 2025 themes.
A01:2025 through A10:2025, as terms
The table uses the official 2025 category titles.
| ID | Official name (2025) | Boundary |
|---|---|---|
| A01:2025 | Broken Access Control | Awareness category term. Not a finished test. |
| A02:2025 | Security Misconfiguration | Awareness category term. Not a finished test. |
| A03:2025 | Software Supply Chain Failures | Awareness category term. Not a finished test. Supply-chain practice stays on the AppSec path. |
| A04:2025 | Cryptographic Failures | Awareness category term. Not a finished test. |
| A05:2025 | Injection | Awareness category term. Not a finished test. |
| A06:2025 | Insecure Design | Awareness category term. Not a finished test. Threat-model practice stays on the AppSec path. |
| A07:2025 | Authentication Failures | Awareness category term. Not a finished test. |
| A08:2025 | Software or Data Integrity Failures | Awareness category term. Not a finished test. |
| A09:2025 | Security Logging and Alerting Failures | Awareness category term. Not a finished test. |
| A10:2025 | Mishandling of Exceptional Conditions | Awareness category term. Not a finished test. A 2025 theme on this list. Not a catalog of error controls. |
CHECK THE CATEGORY
Which sentence matches OWASP Top 10 literacy?
Glossary and nearby pages
- OWASP Top 10 Reference card (framework summary)
- Compare the six maps (a row is not this list)
- Map the shop: trust boundaries on a synthetic checkout API (A1)
- What the team did not import still ships with the build (A2)
- Who can write, who can promote (A3)
- An SBOM is inventory, not a control (A4)
- Outcomes first, then controls (F8a)
- OWASP ASVS explainer (verification requirements, labeled home, not this list)
- OWASP GenAI LLM Top 10 2026 explainer (separate awareness list)
- NIST AI RMF 1.0 explainer (voluntary framework, not this list)
- NIST SSDF Version 1.1 explainer (software practice vocabulary, not this list)
- Prompt injection and retrieval trust (LLM list)
- Application and software supply-chain path
- Privacy is not a CIA checkbox
Use the agency page in the sources for the authoritative text.